Studio experiment E05 · the explainer

Pivoting, frame by frame

The one sentence: an agent does not stay where it was put; each hop to the next system is a step it was able to take. Two public cases are told the same way, and only the hops the studio's files state are drawn.

The frames (v1)

Seconds from the start; it ends at 44 s and holds still. Stops for the player: 0, 3, 18, 28 and 33 s.

From	What is on screen
0 s	The headline, "One step it was able to take, then the next.", and the ID E05.
3 s	Nx s1ngularity, "real-world incident · Aug 2025 · grade A4", and five systems separated by dashed lines. From 3.6 s, every 2.6 s, the path reaches the next system: npm ("a compromised release"), a victim's machine ("it ran on install"), its coding agents, Claude Code, Gemini CLI and Amazon Q ("called, with permission checks off"), the machine ("searched for secrets"), public ("thousands of secrets and tokens leaked publicly for about 8 hours"). At each line the path opens the line and changes colour: amber for what set it going, the agent's red from the agents on, violet where it ended. All five are in place by 15 s.
18 s	AI-orchestrated espionage, "attack: pointed on purpose · reported Nov 2025". From 18.6 s, the same way: a state actor ("pointed on purpose"), Claude Code ("driven through the whole campaign"), an espionage campaign ("80 to 90 per cent of the work done by the model, as Anthropic reported it").
28 s	Beside it, a dashed empty box: "Hops not stated in our files: left empty". No line is drawn into it.
33 s	The line at the foot: "Each hop: a step it was able to take. Only the hops our files state." It holds as a still to 44 s. More cases are asked of the researcher.

Where every word comes from

Nx s1ngularity: the "install scripts" source in injection-sources.json, its case. The heading reads title, label, date (shown as the month) and grade; its note is empty. The five systems and their steps restate what_happened, "A compromised npm release ran on install and called the coding agents already installed, with permission checks off, to search the machine for secrets". The agents' names are target_agent without "on victims' machines"; the last step is impact, word for word.
The espionage campaign: the incident espionage in incidents.json. The heading reads name, kind with its meaning from kinds ("attack: pointed on purpose") and when, which when_note says is the month Anthropic reported it, hence "reported". The three systems restate what, "A state actor drives Claude Code through a whole espionage campaign, the model doing 80 to 90 per cent of the work"; agent names Claude Code, and the last step is figure's value and what it is of.
Words the slide adds: the headline, the system names "npm", "a victim's machine", "its coding agents", "the machine", "public", "a state actor", "an espionage campaign" (each named in the case's own sentence), the empty box and the foot line.
Never on screen: the incident's targets figure, which the file marks to_confirm: "on the current slide but not in the script; check against the report before using". The payload: the source file holds only a defanged summary and the slide shows none of it.

Technique

One slide on the engine, driven: the SVG and the labels are built once from the two data files, then every frame is drawn from the slide's clock by SLIDE_RENDER, so the player can seek, pause and replay it, and ?static shows the end state. The stages are declared in window.RUV_STEPS.
E04 v2's language for a path at a line: the path draws itself, and where it crosses the line between two systems the line opens and the path takes the next system's colour.
Three colours of meaning: amber for what set the path going, the agent's red for the agent, violet for where it ended. Everything else is neutral. Every text is 20 px or larger on the 1280 by 720 canvas; both themes (?theme=light).
It runs only over HTTP. The slide reads both files with fetch when it loads; opened as a file from disk it shows only the headline.

What was left out

The espionage campaign's hops, system by system. incidents.json gives the campaign in one sentence; a hop the file does not state is not drawn, so the box beside it stays empty; more cases are asked of the researcher.
The number of organisations targeted. Marked to confirm in the file.
How the secrets reached the public in Nx s1ngularity. The file says they leaked publicly, not by which step, so the last hop is drawn to "public" without saying who carried them.
The programme's own example, a token found in a file opening a second system that holds a credential for a third. It is the idea of the piece, not a case in the files, so it is not drawn as one.
Other cases in the files where words steered an agent, such as EchoLeak: they show an agent steered, not an agent moving system to system, and belong to E03.

How it was made

v1 by ruv.sgit@the-ultimate-insider in run r20-e05-pivoting, at deck@'s request, the editor's word: a Ruflo hive with a builder who made the slide and these pages from the request and the two data files, screenshotted in both themes at several times. Its row is in the ledger.