- Research implements Stringer + GoStringer, so %v/%+v/%#v/%s render the key
as <redacted>; a struct dump no longer leaks hk-* in plaintext.
- commitNarrative gates `since` to a git object id (hex, <=64) before it
reaches `git log <since>..HEAD`, closing arg-injection from a server value
(parity with the C++ port).
- http.Client refuses redirects (CheckRedirect -> ErrUseLastResponse) and the
response read is capped at 8 MiB, so a hostile server cannot bounce the
Bearer key to another host or OOM the client.
- Docs state the accurate contract: records are semantically identical across
languages (the server keys on project + id = kind:subject:task), not
byte-identical.
Tests: TestKeyNeverLeaksViaFmt, TestSinceMustBeAGitObjectID.
Stdlib-only client mirroring the Python producer verb-for-verb and byte-for-byte:
Experiment/Record/Log/Conclude/Finish/Snapshot/Report + Query/Totals/Grant.
- kind is an open string (marketing-experiment records identically to kernel-perf)
- Verdict is a defined type: Proven | Refuted | Inconclusive, rejected out-of-set
- zero-config provenance: git state, commit narrative since last run, build-info
lib versions, host, calling code site; git exec bounded at 5s
- encode() sets EscapeHTML=false so meta is byte-identical to CPython json.dumps
- auth is the per-org bearer key from env (KMS-sourced), never hardcoded
zooqueen