humanish 0.136.1 → 0.137.0

package/dist/substrates/e2b/desktop-cdp.js

@@ -1,5 +1,3 @@
-// Chromium DevTools on a hosted E2B desktop, reached from inside the sandbox: browser state reads
-// and mobile emulation.
 import { chromeCdpProbeCommand, parseChromeCdpProbeOutput, } from "./cdp-probe.js";
 import { failureTail, toErrorMessage } from "../../evidence/redaction.js";
 import { readDetachedLog, startDetachedProcess } from "../detached.js";
@@ -18,7 +16,7 @@ import { e2bShell } from "./shell.js";
  * url/text criteria are not being measured, instead of letting the funnel report 0/N.
  */
 export function makeChromeBrowserStateObserver(desktop, requestTimeoutMs, endpoint, options = {}) {
-    const { targetId, onUnavailable, drift } = options;
+    const { targetId, onUnavailable, drift, onClock } = options;
     let reported = false;
     let drifted = false;
     const checkedTargets = new Set(drift === undefined ? [] : [drift.emulatedTargetId]);
@@ -68,6 +66,7 @@ export function makeChromeBrowserStateObserver(desktop, requestTimeoutMs, endpoi
             : `the participant drove a page target other than the emulated launch tab and that page reports a ${fidelity.innerWidth} px viewport where ${drift.expectedWidth} px was requested (DPR ${fidelity.devicePixelRatio}); the mobile user agent and touch events are browser-wide, the viewport override was not re-applied to it`);
     };
     return async () => {
+        onClock?.(undefined);
         let result;
         try {
             result = await shell.run(chromeCdpProbeCommand({
@@ -85,6 +84,7 @@ export function makeChromeBrowserStateObserver(desktop, requestTimeoutMs, endpoi
             return unavailable(`probe exited ${result.exitCode}: ${failureTail(result.stderr || result.stdout)}`);
         }
         const parsed = parseChromeCdpProbeOutput(result.stdout);
+        onClock?.(parsed.now);
         if (parsed.unavailable !== undefined)
             return unavailable(parsed.unavailable);
         if (parsed.targetId !== undefined)
@@ -103,16 +103,19 @@ export const DEFAULT_MOBILE_USER_AGENT = "Mozilla/5.0 (iPhone; CPU iPhone OS 17_
  * Apply mobile emulation to the participant's launch page and read back what the page reports.
  * Fails closed: a request that cannot be applied throws, because a desktop run labelled mobile is
  * the over-trust this feature exists to prevent. A read-back that cannot be taken is a warning
- * (the emulation was applied; only the proof is missing).
+ * (the emulation was applied; only the proof is missing). With `network`, the same holder also
+ * captures requests, and a capture that could not start is reported in `network` without failing
+ * the emulation.
  */
 export async function applyMobileEmulation(desktop, requestTimeoutMs, endpoint, request, options = {}) {
-    const { targetId } = options;
+    const { targetId, network } = options;
     const command = (mode) => chromeCdpProbeCommand({
         ...endpoint,
         ...(targetId === undefined ? {} : { targetId }),
         prefer: "pinned",
         mode,
         emulation: request,
+        ...(mode === "hold" && network !== undefined ? { network } : {}),
     });
     const shell = e2bShell(desktop);
     const read = async () => {
@@ -178,6 +181,7 @@ export async function applyMobileEmulation(desktop, requestTimeoutMs, endpoint,
         userAgent: request.userAgent,
     };
     const emulatedTargetId = applied.targetId ?? fidelityRead.targetId;
+    const capture = applied.network === undefined ? {} : { network: applied.network };
     if (fidelityRead.fidelity === undefined) {
         warnings.push(`Mobile emulation was applied but the page's own report could not be read (${fidelityRead.unavailable ?? "no fidelity read"}); desktopGeometry.fidelity carries the request without a resolved block.`);
         return {
@@ -185,6 +189,7 @@ export async function applyMobileEmulation(desktop, requestTimeoutMs, endpoint,
             warnings,
             holderName,
             ...(emulatedTargetId === undefined ? {} : { targetId: emulatedTargetId }),
+            ...capture,
         };
     }
     const resolved = { ...fidelityRead.fidelity, source: "cdp" };
@@ -207,5 +212,82 @@ export async function applyMobileEmulation(desktop, requestTimeoutMs, endpoint,
         warnings,
         holderName,
         ...(emulatedTargetId === undefined ? {} : { targetId: emulatedTargetId }),
+        ...capture,
     };
 }
+/** The holder stops writing its events file at 32 MiB, so a read stops there too. */
+const NETWORK_EVENTS_MAX_BYTES = 32 * 1024 * 1024;
+/** How many times the capture holder's log is read for its announce, and how far apart. */
+const NETWORK_ANNOUNCE_READS = 6;
+const NETWORK_ANNOUNCE_EVERY_MS = 500;
+/**
+ * Start a holder that records the launch page's requests, and every later tab's, to
+ * `network.eventsPath`, for a participant without mobile emulation; applyMobileEmulation passes
+ * the request to the holder it starts. Sends no Emulation command and no reload. Returns the
+ * holder's process name, which readNetworkCaptureStart reads.
+ */
+export async function startNetworkCapture(desktop, requestTimeoutMs, endpoint, network) {
+    const holderName = `network-capture-${Date.now().toString(36)}`;
+    await startDetachedProcess(e2bShell(desktop), {
+        name: holderName,
+        command: chromeCdpProbeCommand({ ...endpoint, prefer: "pinned", mode: "hold", network }),
+        requestTimeoutMs,
+    });
+    return holderName;
+}
+/**
+ * What the capture holder announced: when capture started on the launch page, on the sandbox
+ * clock, or why it did not. Reads the holder's log up to 6 times, half a second apart by
+ * `desktop.wait`, and reports a holder that printed nothing as unavailable.
+ */
+export async function readNetworkCaptureStart(desktop, requestTimeoutMs, holderName) {
+    const shell = e2bShell(desktop);
+    for (let attempt = 0; attempt < NETWORK_ANNOUNCE_READS; attempt += 1) {
+        if (attempt > 0)
+            await desktop.wait(NETWORK_ANNOUNCE_EVERY_MS).catch(() => undefined);
+        const log = await readDetachedLog(shell, holderName, requestTimeoutMs).catch(() => "");
+        const line = log.split("\n").find((candidate) => candidate.trim().startsWith("{"));
+        if (line === undefined)
+            continue;
+        const announced = parseChromeCdpProbeOutput(line);
+        return (announced.network ?? {
+            unavailable: announced.unavailable ?? "the holder announced without starting capture",
+        });
+    }
+    return {
+        unavailable: `the in-sandbox holder printed nothing within ${(NETWORK_ANNOUNCE_READS * NETWORK_ANNOUNCE_EVERY_MS) / 1000} s of the desktop settling`,
+    };
+}
+/**
+ * The capture holder's events file as text: whole lines only, from at most the first 32 MiB.
+ * Throws when the sandbox cannot stream files or the file cannot be read.
+ */
+export async function readNetworkEvents(desktop, eventsPath, requestTimeoutMs) {
+    if (desktop.files.read === undefined)
+        throw new Error("this E2B SDK cannot stream a sandbox file to the host");
+    const stream = await desktop.files.read(eventsPath, {
+        format: "stream",
+        requestTimeoutMs,
+        streamIdleTimeoutMs: requestTimeoutMs,
+        signal: AbortSignal.timeout(requestTimeoutMs),
+    });
+    const reader = stream.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        while (total < NETWORK_EVENTS_MAX_BYTES) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            const chunk = Buffer.from(value.subarray(0, NETWORK_EVENTS_MAX_BYTES - total));
+            chunks.push(chunk);
+            total += chunk.length;
+        }
+    }
+    finally {
+        await reader.cancel().catch(() => undefined);
+    }
+    const bytes = Buffer.concat(chunks);
+    // A line still being written, or one the cap cut, is dropped.
+    return bytes.subarray(0, bytes.lastIndexOf(0x0a) + 1).toString("utf8");
+}

package/dist/verify/network.d.ts

@@ -0,0 +1,10 @@
+import type { RunBundle } from "../run/bundle.js";
+import type { PreparedRunArtifactPaths } from "../run/paths.js";
+/**
+ * One finding per problem with the run's browser network logs: a stream index without the
+ * schema's shape or naming a file other than network/<its participant id>.ndjson, a file that is
+ * missing, unreadable or does not match its index's byte count, sha256 and record count, a record
+ * outside the schema or on an origin its index does not list, and a file under network/ that no
+ * index names. Each finding names the file and the line, never what the line holds.
+ */
+export declare function networkFindings(bundle: RunBundle, runPaths: PreparedRunArtifactPaths): Promise<string[]>;

package/dist/verify/network.js

@@ -0,0 +1,162 @@
+import { readdir } from "node:fs/promises";
+import path from "node:path";
+import { BROWSER_NETWORK_GAPS, BROWSER_NETWORK_SCHEMA, isIsoTime, networkLogPath, networkRecordProblem, } from "../evidence/browser-network.js";
+import { REDACTION_MARKERS } from "../evidence/redaction.js";
+import { originKeepsNoWithheldLabel, pageProblem } from "../evidence/trace-page.js";
+import { readContainedRegularFile, refusalText, RUN_ARTIFACT_MAX_BYTES, } from "../run/contained-output.js";
+import { boundJsonLines } from "../run/live-items.js";
+import { streamParticipantIdOf } from "../run/participant-records.js";
+import { isNonNegativeSafeInteger, isRecord } from "../run/type-guards.js";
+// A participant's browser network log is a public-safety surface: a header, a cookie or a query
+// string in it would have no shape the text scan matches. So verify reads each log a stream index
+// names, binds it to the index as a live file is bound, and holds every record to the schema the
+// writer holds it to. A file under network/ that no index names was not written by humanish.
+const NETWORK_FOLDER = "network";
+const RECORD = { one: "a record", many: "records" };
+/** The record findings one file reports by line; the rest are counted in one more finding. */
+const LINE_FINDINGS = 10;
+/** Every key of the index type, so a key added to the type is one verify admits. */
+const INDEX_KEYS = new Set(Object.keys({
+    schema: true,
+    path: true,
+    records: true,
+    failed: true,
+    pending: true,
+    bytes: true,
+    sha256: true,
+    startedAt: true,
+    origins: true,
+    complete: true,
+    reason: true,
+    omitted: true,
+}));
+const REASONS = new Set(BROWSER_NETWORK_GAPS);
+/** What is wrong with a stream's network index, or undefined when it has the schema's shape. */
+function networkIndexProblem(index) {
+    if (!isRecord(index))
+        return "is not an object";
+    if (Object.keys(index).some((key) => !INDEX_KEYS.has(key)))
+        return "has a key outside the schema";
+    if (index.schema !== BROWSER_NETWORK_SCHEMA)
+        return `is not ${BROWSER_NETWORK_SCHEMA}`;
+    const file = [index.records, index.failed, index.pending, index.bytes, index.sha256];
+    if (index.path === undefined) {
+        if (file.some((value) => value !== undefined))
+            return "binds a file it gives no path for";
+    }
+    else if (typeof index.path !== "string" ||
+        !isNonNegativeSafeInteger(index.records) ||
+        !isNonNegativeSafeInteger(index.failed) ||
+        !isNonNegativeSafeInteger(index.pending) ||
+        !isNonNegativeSafeInteger(index.bytes) ||
+        typeof index.sha256 !== "string" ||
+        !/^[0-9a-f]{64}$/.test(index.sha256))
+        return "names a file without its record, failed and pending counts, byte count and sha256";
+    if (index.startedAt !== undefined && !isIsoTime(index.startedAt))
+        return "has a start time that is not an ISO time";
+    if (!Array.isArray(index.origins) ||
+        index.origins.some((origin) => pageProblem({ origin, path: "" }) !== undefined ||
+            !originKeepsNoWithheldLabel(String(origin))))
+        return "has an origin that is not an origin alone, or a host label the trace page rule withholds";
+    if (typeof index.complete !== "boolean")
+        return "does not say whether it is complete";
+    if (index.complete ? index.reason !== undefined : !REASONS.has(index.reason))
+        return "has a reason that does not match whether it is complete";
+    const { omitted } = index;
+    if (!isRecord(omitted) ||
+        Object.keys(omitted).length !== 3 ||
+        !isNonNegativeSafeInteger(omitted.otherOrigin) ||
+        !isNonNegativeSafeInteger(omitted.overCap) ||
+        !isNonNegativeSafeInteger(omitted.invalid))
+        return "does not count what it left out as otherOrigin, overCap and invalid";
+    return undefined;
+}
+/**
+ * One finding per problem with the run's browser network logs: a stream index without the
+ * schema's shape or naming a file other than network/<its participant id>.ndjson, a file that is
+ * missing, unreadable or does not match its index's byte count, sha256 and record count, a record
+ * outside the schema or on an origin its index does not list, and a file under network/ that no
+ * index names. Each finding names the file and the line, never what the line holds.
+ */
+export async function networkFindings(bundle, runPaths) {
+    const findings = [];
+    const named = new Set();
+    for (const stream of bundle.streams) {
+        const index = stream.network;
+        if (index === undefined)
+            continue;
+        const problem = networkIndexProblem(index);
+        if (problem !== undefined) {
+            findings.push(`${stream.id} network index ${problem}`);
+            continue;
+        }
+        if (!isRecord(index) || typeof index.path !== "string")
+            continue;
+        named.add(index.path);
+        const participantId = streamParticipantIdOf(stream);
+        if (participantId === undefined || index.path !== networkLogPath(participantId)) {
+            findings.push(`${stream.id} network index path is not network/<its participant id>.ndjson`);
+            continue;
+        }
+        findings.push(...(await fileFindings(runPaths, {
+            path: index.path,
+            origins: new Set(Array.isArray(index.origins) ? index.origins : []),
+            lines: Number(index.records),
+            failed: Number(index.failed),
+            pending: Number(index.pending),
+            bytes: Number(index.bytes),
+            sha256: String(index.sha256),
+        })));
+    }
+    // No folder means no file to name; one the walk cannot list is unscanned there.
+    const listed = await readdir(path.join(runPaths.physicalRunRoot, NETWORK_FOLDER)).catch(() => []);
+    for (const name of listed.toSorted((left, right) => left.localeCompare(right))) {
+        const file = `${NETWORK_FOLDER}/${name}`;
+        if (!named.has(file))
+            findings.push(`${file} is under network/ and no stream index names it`);
+    }
+    return findings;
+}
+/**
+ * The findings for one indexed log: its read and binding, its records by line, each record's
+ * origin against the index's, then its failed and pending counts against the index's, which a
+ * reader such as the Observer shows unchecked. A record's origin can also be the marker tracePage
+ * writes for a page withheld whole.
+ */
+async function fileFindings(runPaths, index) {
+    const read = await readContainedRegularFile(runPaths, index.path, RUN_ARTIFACT_MAX_BYTES);
+    if (read.status === "missing")
+        return [`${index.path} is missing`];
+    if (read.status === "refused")
+        return [refusalText(index.path, read)];
+    const bound = boundJsonLines(read.bytes, index, RECORD);
+    if ("refused" in bound)
+        return [bound.refused];
+    const findings = [];
+    let more = 0;
+    const counted = { failed: 0, pending: 0 };
+    bound.lines.forEach((record, at) => {
+        if (isRecord(record) && record.failed !== undefined)
+            counted.failed += 1;
+        if (isRecord(record) && record.pending !== undefined)
+            counted.pending += 1;
+        const problem = networkRecordProblem(record) ??
+            (isRecord(record) &&
+                !index.origins.has(record.origin) &&
+                record.origin !== REDACTION_MARKERS.urlPart
+                ? "has an origin its index does not list"
+                : undefined);
+        if (problem === undefined)
+            return;
+        if (findings.length < LINE_FINDINGS)
+            findings.push(`${index.path} line ${at + 1} ${problem}`);
+        else
+            more += 1;
+    });
+    if (more > 0)
+        findings.push(`${index.path} has ${more} more lines outside the schema`);
+    for (const key of ["failed", "pending"])
+        if (counted[key] !== index[key])
+            findings.push(`${index.path} holds ${counted[key]} ${key} records where its index says ${index[key]}`);
+    return findings;
+}

package/dist/verify/pages.js

@@ -1,23 +1,8 @@
-import { REDACTION_MARKERS } from "../evidence/redaction.js";
+import { pageProblem } from "../evidence/trace-page.js";
 import { isRecord } from "../run/type-guards.js";
 // A recorded page (`items[].page`, `finalPage`) keeps a URL's origin and path only. The text scan
 // finds secret shapes in it as in any trace text, but a query string, a fragment or user info can
 // carry a short token no pattern matches, so a page holding one is a public-safety finding.
-// The markers that can stand for a whole origin, such as a withheld sandbox host.
-const MARKERS = new Set(Object.values(REDACTION_MARKERS));
-// `scheme:` alone (a non-web URL) or `scheme://host[:port]`, with nothing after the host. The URL
-// parser reads a backslash there as a slash, so a backslash counts as a path too.
-const ORIGIN = /^[a-z][a-z0-9+.-]*:(?:\/\/[^/\\?#@]*)?$/i;
-/** What is wrong with a recorded page, or undefined when it holds an origin and a path only. */
-function pageProblem(page) {
-    if (!isRecord(page) || typeof page.origin !== "string" || typeof page.path !== "string")
-        return "is not an origin and a path";
-    if (/[?#]/.test(page.path))
-        return "has a query string or fragment in its path";
-    if (!MARKERS.has(page.origin) && !ORIGIN.test(page.origin))
-        return "has an origin with user info, a path, a query string or a fragment";
-    return undefined;
-}
 /**
  * One finding per recorded page that holds more than an origin and a path, in each finished
  * trace's items and summary and each running participant's items. A finding names where the page

package/dist/verify/verify.js

@@ -17,6 +17,7 @@ import { runNotFoundMessage } from "../run/run-not-found.js";
 import { actorVerdictConsistencyFindings, noEngagementActorFindings, validateCodexAppServerEvidence, validateTerminalProductEvidence, } from "./actor.js";
 import { invalidRunEvidenceReferences, MAX_REPORTED_FINDINGS, missingLocalEvidenceArtifacts, rawScreenshotPostureWarnings, rawScreenshotStreamIds, redactedShapeFramePaths, scanRunPublicSafetyArtifacts, scanSourceEvidence, streamScreenshotPaths, unscannedMessage, } from "./artifacts.js";
 import { flatContextWarnings } from "./context-growth.js";
+import { networkFindings } from "./network.js";
 import { pageFindings } from "./pages.js";
 import { runNotFinished } from "./liveness.js";
 import { costAndReceiptFindings } from "./costs.js";
@@ -242,6 +243,7 @@ async function loadTraces(runPaths, stored) {
             pastReadLimit: new Set(),
             ...scanned,
             pages: [],
+            network: [],
         };
     // Each trace is source evidence: scanned by the bytes it was joined from, apart from the
     // directory walk and any path exemption the walk makes.
@@ -271,6 +273,7 @@ async function loadTraces(runPaths, stored) {
         pastReadLimit: new Set(unread.map((error) => error.file)),
         ...scanned,
         pages: pageFindings(bundle),
+        network: await networkFindings(bundle, runPaths),
     };
 }
 /** Whether the run file at `file` holds more than RUN_ARTIFACT_MAX_BYTES, read only when it does not. */
@@ -280,7 +283,10 @@ async function pastReadLimit(runPaths, file) {
 }
 /** The continuous recordings the bundle registers, which CONTINUOUS_MEDIA grades. */
 const recordingPaths = (bundle) => new Set(bundle?.streams.flatMap((stream) => (stream.recording ? [stream.recording.path] : [])) ?? []);
-/** The trace scan's results, beside the walk's: each file named once, then each page finding. */
+/**
+ * The trace scan's results, beside the walk's: each file named once, then each page finding and
+ * each network log finding.
+ */
 function addTraceScan(traces, findings, unscanned) {
     for (const file of traces.sensitive)
         if (!findings.includes(`sensitive text ${file}`))
@@ -288,7 +294,7 @@ function addTraceScan(traces, findings, unscanned) {
     for (const file of traces.opaque)
         if (!unscanned.files.includes(file))
             unscanned.files.push(file);
-    findings.push(...traces.pages);
+    findings.push(...traces.pages, ...traces.network);
 }
 /** The top-level run.json sections the shape guard requires. */
 const REQUIRED_SECTIONS = [

package/docs/contracts/run-bundle.md

@@ -515,6 +515,88 @@ entry without loading the whole video into memory. Raw continuous media makes th
 run `local_only` regardless of screenshot redaction. Analysis input remains text
 and screenshots. See [desktop recording](https://humanish.dev/docs/desktop-recording).
 
+## Browser network log
+
+A hosted computer-use participant whose study sets `execution.network` and whose browser is
+Chrome or Chromium carries `streams[].network`:
+
+```yaml
+network:
+  schema: humanish.browser-network.v1
+  path: network/p1.ndjson
+  records: 412
+  failed: 3 # records with `failed`
+  pending: 2 # records with `pending`
+  bytes: 66104
+  sha256: "<hex digest of the file>"
+  startedAt: "2026-10-16T10:00:07.812Z"
+  origins: [https://shop.example]
+  complete: true
+  omitted: { otherOrigin: 1203, overCap: 0, invalid: 0 }
+```
+
+When capture kept at least one request the stream also has `network/<participantId>.ndjson`,
+registered in `streams[].artifacts` with kind `log`. The folder is `network/` because "request"
+in this contract already means a model request. `path`, `records`, `failed`, `pending`, `bytes`
+and `sha256` are absent when no file was written: capture did not start, the file could not be
+read, or capture started and kept no request, which is the case with `startedAt` present. They
+bind the file as a trace index binds its trace, and verify checks each one. `origins` are
+redacted as `items[].page` origins are, and verify reports a record whose origin is not one of
+them or the `[REDACTED_URL_PART]` marker. `startedAt` is when capture answered on the launch
+page, on the desktop's clock.
+
+Each line of the file is one request hop as a JSON object, sorted by `at`:
+
+| Key              | Meaning                                                                                                                                                                                                    |
+| ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `at`             | When the request started, as an ISO time on the desktop's clock                                                                                                                                            |
+| `turn`           | The turn the request fell in, by the rule below. Absent when no checkpoint screenshot recorded a browser-state read                                                                                        |
+| `method`         | `GET`, `HEAD`, `POST`, `PUT`, `DELETE`, `OPTIONS`, `PATCH`, `CONNECT` or `TRACE`; any other method is `OTHER`. Absent on a back-forward record                                                             |
+| `origin`, `path` | The address as `items[].page` records it: no query, fragment or user info, and token-shaped or secret-bearing path segments become `[REDACTED_URL_PART]`                                                   |
+| `type`           | The lowercase CDP resource type: `document`, `fetch`, `xhr`, `prefetch`, `script`, `image` and the rest of the documented list. Any other value is `other`                                                 |
+| `status`         | 100 to 599. Absent when no response arrived                                                                                                                                                                |
+| `ms`             | Start to finish, failure or the next hop, in whole milliseconds. Absent when `pending`, on a back-forward record, and when the events arrived after the request finished, as a cross-origin preflight's do |
+| `redirect`       | `true`: a 3xx response started this hop. The 3xx itself is the hop before it                                                                                                                               |
+| `cache`          | `memory`, `disk`, `prefetch`, `service-worker` or `back-forward`. A `back-forward` record is a page restored from the back-forward cache: `type: document` and no `status`, since no request was sent      |
+| `failed`         | The load's error text without its `net::` prefix, such as `ERR_CONNECTION_REFUSED`. `failed` with no `status` means the request failed before any response                                                 |
+| `pending`        | `true`: no end was recorded. The request was still open when the file was read, or capture stopped first (`reason: capped` or `holder-stopped`)                                                            |
+
+A request's `turn` is the N of the first `turn-NN` or `turn-NN-after-dwell` screenshot whose
+browser-state read came after the request started; requests after the last screenshot carry the
+last N plus 1. The read and `at` use the desktop's clock, so a request that turn N's actions
+started carries N: the actions run before that screenshot's read. A held turn and a reply cut
+off by the output limit take no screenshot, so their requests carry the next screenshot's N.
+
+The file holds no bodies, cookies, header names or values, query strings, fragments or user
+info. Requests to origins outside `origins` are counted in `omitted.otherOrigin` and not
+written. Absent from the file:
+
+- requests that started before `startedAt`. A desktop participant's capture starts once its
+  browser's DevTools answer, several seconds after launch, so most of its first page load is
+  missing; a phone-emulated participant's launch page reloads under capture;
+- requests from workers, service workers and cross-site iframes, and WebSocket frames;
+- a new tab's first request, which can be missing.
+
+Path segments are redacted as `items[].page` redacts them. A run of 16 or more characters is
+withheld only when a piece of it mixes letters and digits, so a short code, a long all-digit
+invite code or a long all-letter token in a path stays in the file. A segment that names a
+sandbox id the run journaled is withheld too, and verify reports a record whose path keeps a
+segment these rules withhold. The in-sandbox holder cuts a path longer than 4,096 characters at
+its last whole segment within them, and the file keeps at most 1,024 characters of the redacted
+path, as `items[].page` does, ending in `[TRUNCATED]` when cut. The file keeps the first 20,000
+records, then up to 5,000 more that failed, are pending or have status 400 or above, and stops
+before 8 MiB.
+
+`complete: false` comes with `reason`: `no-capture` (capture did not start: a browser other than
+Chrome or Chromium, or a holder that could not start it), `not-collected` (the file could not be
+read at teardown), `capped` (records past the file's caps, counted in `omitted.overCap`; or the
+holder's events file reached 32 MiB, after which requests are absent and counted nowhere) or
+`holder-stopped` (the in-sandbox holder stopped during the session: it wrote its exit line, or
+its process had exited by teardown, as a holder killed by a signal has). A stream with no `network`
+field had capture off, or its participant never started: a dry run, or one skipped before its
+desktop was created. Example: `jq -c 'select(.turn==7 and (.failed or .pending or
+.status>=400))' network/p1.ndjson` lists what failed in turn 7.
+
 ## Hosted Desktop Geometry
 
 Hosted browser streams may carry additive `desktopGeometry` evidence. Its fields keep five
@@ -786,11 +868,14 @@ For run id `example-2026-06-02t10-00-00-000z-proof`, the core layout is:
 .humanish/runs/example-2026-06-02t10-00-00-000z-proof/observer/observer-data.json
 .humanish/runs/example-2026-06-02t10-00-00-000z-proof/events.ndjson
 .humanish/runs/example-2026-06-02t10-00-00-000z-proof/actors/stream-001.json
+.humanish/runs/example-2026-06-02t10-00-00-000z-proof/network/p1.ndjson
 .humanish/runs/latest.json
 ```
 
 `actors/<stream>.json` (or `actor.json` for one participant) is a participant's trace file; see
-[Participant traces](#participant-traces).
+[Participant traces](#participant-traces). `network/<participantId>.ndjson` is a participant's
+browser network log, present only when its study set `execution.network`; see
+[Browser network log](#browser-network-log).
 
 Absolute paths, traversal segments, remotes, hosted logs, and private artifact
 URLs are not part of the core layout.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "humanish",
-  "version": "0.136.1",
+  "version": "0.137.0",
   "description": "Synthetic user research for apps, CLIs, and agent-facing product flows.",
   "keywords": [
     "cli",