cowork-harness 0.18.0 → 0.19.0

package/CHANGELOG.md

@@ -6,6 +6,60 @@ All notable changes to this project are documented here. The format is based on
 
 ## [Unreleased]
 
+## [0.19.0] — 2026-06-30
+
+### Changed
+
+- **The default `--decider-llm` answering model is now Sonnet (`claude-sonnet-4-5`), not Haiku.** A
+  measurement on a real-doc skill with judgment-heavy gates found the prior Haiku default
+  **prose-declined ~50% of them** (replying "I don't have information…" instead of picking an option →
+  a fail-loud whiff); a Sonnet decider binds those gates and the run proceeds. ⚠️ This **raises per-gate
+  token cost** for every `--decider-llm` run, and a gate a weaker model would have prose-declined (and
+  failed fast) is now more likely to be answered and the run to continue (longer/costlier). Pin a
+  cheaper model to restore the old cost/behavior: `--decider-model <haiku-id>` or
+  `COWORK_HARNESS_DECIDER_MODEL`. (n is small — read this as "Haiku is too weak for judgment-heavy
+  gates," not a precise rate.) The whiff error now also names the `--decider-model` lever.
+  ⚠️ **False-green caveat (new guidance, no behavior change):** binding-and-proceeding is the upside,
+  but a *decided* answer is the decider's best guess from the transcript tail — it never sees the
+  mounted documents — so it can fabricate (oracle-less gate) or get a doc-answerable fact wrong, and a
+  green run resting on it is a false pass. **Script any gate whose answer feeds a _semantic_ assertion
+  (`--answer` / `--answer-policy`); reserve `--decider-llm` for structural-assertion runs.** See
+  `references/fidelity-and-answers.md` in the skill.
+- **Stall detector now also flags a stall AFTER an answered gate (H3).** The `stalled` verdict signal
+  previously fired only when a run ended on a question having made *no tool calls at all*. It now fires
+  when a run ends on a question and made **no productive tool call after its last `AskUserQuestion` gate** —
+  catching the case where the agent answers a gate, then re-asks in plain text and stops with the
+  deliverable never produced (previously a `result: "success"` false-green). The no-gate case is unchanged.
+  Re-derives identically on replay. ⚠️ This can flip a previously-green scenario to red — set
+  `allow_stall: true` to restore the prior verdict if ending on a question is the intended terminal state
+  (e.g. a skill that writes its output and then ends on a confirmation/"anything else?" question). The signal
+  is a *tool-position heuristic*, not deliverable detection, so it is imprecise in both directions: a post-gate
+  tool *call* (successful or errored) clears the flag even if nothing useful was produced (false negative);
+  and a deliverable produced *before* the final gate does NOT clear it, so a write-then-confirm-then-question
+  run is flagged (false positive). Assertions are the real guard — assert the deliverable
+  (`file_exists`/`artifact_json`), never `result` alone — and use `allow_stall` for a deliberate
+  question-terminal skill.
+
+### Fixed
+
+- **`--decider-llm` now binds an echoed grant label on a `web_fetch` approval gate** instead of failing
+  loud. The web_fetch permission-approval path matched the model's reply with an exact-label check only,
+  so a reply that echoed the option plus a self-glossed tail past a `:` boundary (e.g.
+  `Allow once: fetch this URL one time` against option `Allow once`) aborted the run — the same echo shape
+  the `AskUserQuestion` path already tolerates. The permission path now applies the same `echoPrefixMatch`
+  backstop, so the echoed label binds. Out-of-set replies still fail loud.
+- **The three non-retried `--decider-llm` transport failures now name their mitigation in the error.** A
+  timeout, a `maxBytes` overflow, and a spawn failure (e.g. `ENOENT`) forfeit the run by design — they are
+  not transient — but the surfaced message previously named only the failure. It now points at the lever:
+  `COWORK_HARNESS_LLM_TIMEOUT_MS`, `COWORK_HARNESS_LLM_MAX_BYTES`, and `PATH` / `COWORK_HARNESS_CLAUDE_BIN`
+  respectively. No retry behavior changed.
+- `doctor`'s "no token, but a Claude Code Keychain entry exists" remedy now also names the
+  `--dotenv` workaround. The macOS Keychain branch previously printed only "copy the token into
+  `./.env`", which led an operator whose token lived in a *different* file to conclude `doctor`
+  ignores `--dotenv` — it does not (the global `--dotenv <path>` is honored by `doctor` exactly as
+  by `skill`/`run`, since it loads into `process.env` before dispatch). The remedy now reads
+  "… or, if the token is already in another file, point at it: `cowork-harness --dotenv <path> <cmd>`".
+
 ## [0.18.0] — 2026-06-27
 
 ### Fixed

package/README.md

@@ -149,7 +149,7 @@ This repo ships a **companion skill** (`.claude/skills/cowork-harness/`) that te
 /plugin install cowork-harness@cowork-harness
 ```
 
-The skill **self-bootstraps the CLI**: if `cowork-harness` isn't on your PATH it falls back to `npx cowork-harness@>=0.18.0` (a version floor that fails loud rather than silently fetching a too-old CLI; Node ≥ 20). Tiers above `protocol` still need Docker/Lima and a Claude Desktop agent binary — see the prerequisites below.
+The skill **self-bootstraps the CLI**: if `cowork-harness` isn't on your PATH it falls back to `npx cowork-harness@>=0.19.0` (a version floor that fails loud rather than silently fetching a too-old CLI; Node ≥ 20). Tiers above `protocol` still need Docker/Lima and a Claude Desktop agent binary — see the prerequisites below.
 
 It also follows the open [Agent Skills](https://github.com/vercel-labs/skills) spec, so it installs cross-editor (Cursor, Codex, OpenCode, …) by pointing the `npx skills` CLI at `.claude/skills/cowork-harness` in this repo. (Working *inside* this repo, the skill auto-loads as a project skill — no install needed.)
 
@@ -482,7 +482,7 @@ Most runs need **none** of these — the defaults are correct. They're grouped b
 - `COWORK_CONTAINER_RUNTIME=podman` — use Podman instead of Docker.
 - `COWORK_AGENT_IMAGE=<tag>` — override the agent image name (default `cowork-agent-base:2`); `COWORK_AGENT_BINARY=<path>` — override the auto-detected staged agent ELF.
 - `COWORK_SKIP_CAPABILITY_PROBE=1` — skip the per-run capability probe (the harness otherwise probes the agent image/VM for the document/OCR/Office capabilities the real Cowork rootfs ships and **fails a run that uses one the image omits** — a likely false negative; suppress per-scenario with `allow_missing_capability: true`, or rebuild full parity).
-- `COWORK_HARNESS_DECIDER_MODEL` — the default `--decider-llm` answering model (overridden by the `--decider-model` flag; falls back to the Haiku default). `COWORK_HARNESS_DECIDER_DIR_POLL_MS` / `_TIMEOUT_MS` — tune the `--decider-dir` rendezvous poll/backstop; `COWORK_HARNESS_DECIDER_CMD_TIMEOUT_MS` / `COWORK_HARNESS_LLM_TIMEOUT_MS` — backstop a hung `--decider-cmd` helper / `--decider-llm` model call (default 600 s, fail loud); `COWORK_HARNESS_LLM_RETRIES` — bounded retries for a transient non-zero `claude -p` exit in the `--decider-llm` transport (default 2, clamped to 0–10; set `0` to disable, e.g. deterministic CI); `COWORK_HARNESS_DIALOG_TIMEOUT_MS` — override the 6 s dialog auto-cancel.
+- `COWORK_HARNESS_DECIDER_MODEL` — the default `--decider-llm` answering model (overridden by the `--decider-model` flag; falls back to the Sonnet default — pin a cheaper model for simple gates to cut cost). `COWORK_HARNESS_DECIDER_DIR_POLL_MS` / `_TIMEOUT_MS` — tune the `--decider-dir` rendezvous poll/backstop; `COWORK_HARNESS_DECIDER_CMD_TIMEOUT_MS` / `COWORK_HARNESS_LLM_TIMEOUT_MS` — backstop a hung `--decider-cmd` helper / `--decider-llm` model call (default 600 s, fail loud); `COWORK_HARNESS_LLM_RETRIES` — bounded retries for a transient non-zero `claude -p` exit in the `--decider-llm` transport (default 2, clamped to 0–10; set `0` to disable, e.g. deterministic CI); `COWORK_HARNESS_LLM_MAX_BYTES` — stdout cap on a `--decider-llm` model call (default 8 MiB, fail loud past it); `COWORK_HARNESS_DIALOG_TIMEOUT_MS` — override the 6 s dialog auto-cancel.
 - `COWORK_HARNESS_RUNS_DIR` (or the `--run-dir <path>` flag — a **global** flag that must precede the subcommand, like `--dotenv`) — override the default run-output root `~/.cowork-harness/runs` (kept out of any working tree so sensitive skill inputs/outputs don't land in a repo). Precedence: `--run-dir` > env > default. The root is flat and machine-global (shared across projects); pinned `--session-id` runs are guarded against cross-project overwrite, and `prune` never prunes them. In CI, set it to a workspace path (e.g. `runs`) so artifact upload can collect the runs. `COWORK_HARNESS_ALLOW_FOREIGN_RESUME=1` overrides the guard that blocks `--resume` onto another project's pinned session.
 - **Networking / loop:** `COWORK_EGRESS_PROXY` overrides the egress-proxy URL injected into the sandbox; `COWORK_PROXY_IMAGE` overrides the egress proxy Docker image name (default `cowork-egress-proxy:1`); `COWORK_DOCKER_NETWORK` pins the Docker network the agent container joins; `CLAUDE_FORCE_HOST_LOOP=1` forces the host-loop path regardless of the baseline's loop decision (the `cowork` tier's auto-pick). `COWORK_LIMACTL` overrides the `limactl` binary path (default `/opt/homebrew/bin/limactl`).
 - **Strictness escape hatches** (the harness fails loud by default): `COWORK_HARNESS_SOFT_MISSING=1` downgrades a missing mount source from a hard error to warn-and-exclude; `COWORK_HARNESS_ALLOW_CONFIG_DIR_WRITE=1` permits writing into an existing pinned `plugins.config_dir` (otherwise refused, to avoid clobbering a real Claude config).
@@ -570,7 +570,7 @@ This repo is built to be driven by agents, not just read by humans:
 
 - ✅ **Three isolation tiers (L0/L1/L2) + two loop-mode overlays** — `protocol` (L0 control loop), `container` (L1 sandboxed arm64 + per-run default-deny egress sidecar), `microvm` (L2 real Apple-VZ Linux microVM + guest firewall); plus the loop-mode overlays `hostloop` (production split-execution: agent loop on host, shell/web via the workspace SDK-MCP server) and `cowork` (auto-picks host-loop vs container the way Cowork does — gate `1143815894`). Egress enforced at container/microvm/hostloop; `boundary-check` reports **ALL CONSTRAINTS ENFORCED**.
 - ✅ **Three-seam driver** — `AgentSession` (control protocol) → `Decider` (scripted + `on_unanswered` policy, no silent false-greens) → `Run` (turn loop, sub-agent dispatch tree, `RunRecord`). Multi-turn `chat`, deterministic cassette `record`/`replay` (no token), `run.jsonl`/`trace.json` logging with secret-scrub.
-- ✅ **Answering live questions, every way you'd need** — `--decider-llm --intent "<one line>"` (a small model picks per question, steered by your test intent — the ergonomic default; it replies with the option **number**, mapped to the exact label, so it can't whiff by parroting the label text, and an out-of-set reply fails loud; raise the answering model for ambiguous judgment gates with **`--decider-model <id>`**; non-determinism is flagged so a green isn't mistaken for a scripted pass), `--answer-policy <yaml>`/`--answer "rx=c"` (declarative regex→label, deterministic CI — accepts a **stable partial anchor** for skills whose labels drift run-to-run), `--decider-cmd '<helper>'` (custom logic — the Python `serve_decider(fn)` adapter pre-builds the wire loop so the helper writes only the decision), and **`--decider-dir <dir>`** (the *driving agent* answers each gate **in-band** with full context — it arms a Monitor on `cowork-harness gates <dir> --follow` and replies with `cowork-harness answer <dir> --gate <N> --choose <label>`; the session-under-test stays live, no resume/re-worded question — binary-verified). **multiSelect gates** are answerable on every channel — repeat `--choose` (or, for `--decider-llm`, a comma-list of option numbers; or a JSON-array reply from a `--decider-cmd` helper / hand-written `resp-N.json`); all deliver the binary-verified `", "`-joined wire shape. Every channel keeps stdout free, so all compose with `--output-format json`. A question is **never silently answered with option 1** — unhandled fails loud. Validate any decider in ~2s with `cowork-harness decide`.
+- ✅ **Answering live questions, every way you'd need** — `--decider-llm --intent "<one line>"` (a model picks per question, steered by your test intent — the ergonomic default; defaults to **Sonnet** (a weaker model prose-declines ambiguous judgment gates → fail-loud), override with **`--decider-model <id>`** — pin a cheaper model for simple gates or a stronger one for the hardest; it replies with the option **number**, mapped to the exact label, so it can't whiff by parroting the label text, and an out-of-set reply fails loud; non-determinism is flagged so a green isn't mistaken for a scripted pass — and ⚠️ a *decided* gate whose answer feeds a **semantic** assertion can still false-green, so script those), `--answer-policy <yaml>`/`--answer "rx=c"` (declarative regex→label, deterministic CI — accepts a **stable partial anchor** for skills whose labels drift run-to-run), `--decider-cmd '<helper>'` (custom logic — the Python `serve_decider(fn)` adapter pre-builds the wire loop so the helper writes only the decision), and **`--decider-dir <dir>`** (the *driving agent* answers each gate **in-band** with full context — it arms a Monitor on `cowork-harness gates <dir> --follow` and replies with `cowork-harness answer <dir> --gate <N> --choose <label>`; the session-under-test stays live, no resume/re-worded question — binary-verified). **multiSelect gates** are answerable on every channel — repeat `--choose` (or, for `--decider-llm`, a comma-list of option numbers; or a JSON-array reply from a `--decider-cmd` helper / hand-written `resp-N.json`); all deliver the binary-verified `", "`-joined wire shape. Every channel keeps stdout free, so all compose with `--output-format json`. A question is **never silently answered with option 1** — unhandled fails loud. Validate any decider in ~2s with `cowork-harness decide`.
 - ✅ **Sub-agent aggregation + `trace`** — recognizes the real `Agent` dispatch tool (binary-verified; `Task` is its alias) so `subagent_dispatched`/`dispatch_count_max` fire under `--fidelity cowork`, excluding the `TaskCreate` todo list; `cowork-harness trace <id> --view tools` digests `events.jsonl` (each tool row now shows its **result status** `ok`/`error`), and `trace <id> --view questions` shows the gate lifecycle (**question → injected answer → delivered result**); `result.json`/`--keep` surface the deep `mnt/outputs` deliverable path.
 - ✅ **Answer delivery is verified, not assumed** — an AskUserQuestion answer is injected as the binary's full tool input (`{questions, answers}`, ELF-verified), so the answer actually reaches the model; `RunResult.gateDeliveries[]` + the `gate_answers_delivered` assertion catch any delivery failure, and `RunResult.toolCounts` gives the **truthful** per-tool call count (host-routed `WebSearch` shows here, not the always-0 `usage.server_tool_use`).
 - ✅ **Binary-grounded fidelity** — cwd `/sessions/<id>`, the three-channel MCP model (`--mcp-config` honored in plain cowork mode; host/API-routed `web_fetch`; SDK-server delivery), host-loop tool partition, auth-env token-only drop, and production GrowthBook gates pinned per release.

package/baselines/desktop-1.15962.1.json

@@ -0,0 +1,220 @@
+{
+  "baselineVersion": 1,
+  "appVersion": "1.15962.1",
+  "agentVersion": "2.1.187",
+  "agentBinary": {
+    "stagedPath": "~/Library/Application Support/Claude/claude-code-vm/2.1.187/claude",
+    "format": "elf-aarch64"
+  },
+  "guest": {
+    "os": "linux",
+    "arch": "arm64",
+    "baseImage": "ubuntu:22.04"
+  },
+  "spawn": {
+    "configDirInGuest": "mnt/.claude",
+    "settingSources": [
+      "user"
+    ],
+    "permissionMode": "default",
+    "maxThinkingTokens": 31999,
+    "effortDefault": "medium",
+    "tools": [
+      "Task",
+      "Bash",
+      "Glob",
+      "Grep",
+      "Read",
+      "Edit",
+      "Write",
+      "NotebookEdit",
+      "WebFetch",
+      "TaskCreate",
+      "TaskUpdate",
+      "TaskGet",
+      "TaskList",
+      "TaskStop",
+      "WebSearch",
+      "Skill",
+      "REPL",
+      "JavaScript",
+      "AskUserQuestion",
+      "ToolSearch"
+    ],
+    "allowedTools": [
+      "Task",
+      "Bash",
+      "Glob",
+      "Grep",
+      "Read",
+      "Edit",
+      "Write",
+      "NotebookEdit",
+      "WebFetch",
+      "TaskCreate",
+      "TaskUpdate",
+      "TaskGet",
+      "TaskList",
+      "TaskStop",
+      "WebSearch",
+      "Skill",
+      "REPL",
+      "JavaScript",
+      "ToolSearch"
+    ],
+    "env": {
+      "CLAUDE_CODE_IS_COWORK": "1",
+      "CLAUDE_CODE_ENTRYPOINT": "local-agent",
+      "CLAUDE_CODE_TAGS": "lam_session_type:chat",
+      "CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST": "1",
+      "CLAUDE_CODE_ENABLE_ASK_USER_QUESTION_TOOL": "true",
+      "CLAUDE_CODE_DISABLE_CRON": "1",
+      "CLAUDE_CODE_DISABLE_BACKGROUND_TASKS": "1",
+      "CLAUDE_CODE_DISABLE_AGENTS_FLEET": "1",
+      "CLAUDE_CODE_ENABLE_APPEND_SUBAGENT_PROMPT": "1",
+      "CLAUDE_CODE_ENABLE_TASKS": "true",
+      "CLAUDE_CODE_DISABLE_TERMINAL_TITLE": "1",
+      "ENABLE_PROMPT_CACHING_1H": "1",
+      "DISABLE_MICROCOMPACT": "1",
+      "MCP_CONNECTION_NONBLOCKING": "true"
+    },
+    "promptTemplate": "prompts/desktop-1.15200.0/system-prompt-append.md",
+    "subagentAppend": "prompts/desktop-1.15200.0/subagent-append-vm.md",
+    "$comment": "Binary-verified Desktop->agent spawn contract (asar 1.12603.1). See docs/cowork-spawn-contract-1.12603.1.md.",
+    "$comment_notSet": "Deliberately NOT set: CLAUDE_CODE_USE_COWORK_PLUGINS (Desktop never sets it; would flip the agent to cowork_settings.json/cowork_plugins). Host-derived (TZ, account UUIDs, WORKSPACE_HOST_PATHS, OTEL) injected at runtime, not pinned.",
+    "$comment_prompts": "Reconstructed cowork-specific sections, re-paraphrased from asar 1.15200.0 const MZi (system prompt) + generator CVr (subagent) — not the full base prompt (not cleanly extractable), and excluding the generic refusal/safety tail. The main append is delivered via the --append-system-prompt CLI flag (layered on the agent's built-in base prompt), NOT the initialize handshake; only the subagent append goes over initialize (appendSubagentSystemPrompt), gated on CLAUDE_CODE_ENABLE_APPEND_SUBAGENT_PROMPT."
+  },
+  "mountLayout": {
+    "sessionRoot": "/sessions/{sessionId}",
+    "cwd": "/sessions/{sessionId}",
+    "mntRoot": "/sessions/{sessionId}/mnt",
+    "mounts": [
+      {
+        "name": "uploads",
+        "mountPath": "uploads",
+        "mode": "r",
+        "purpose": "user-uploaded files (read-only — asar 'ro')"
+      },
+      {
+        "name": "projects",
+        "mountPath": ".projects/{projectId}",
+        "mode": "rw",
+        "purpose": "RESERVED namespace (and the separate UUID project-sync feature) — NOT the work-folder path. From Desktop 1.14271.0 selected work folders mount at mnt/<collision-resolved-basename> (dynamic, derived per session by buildLaunchPlan; see MOUNT_BARE_NAME_MIN_VERSION). This decorative row is not consumed for binding (staged paths come from plan.mounts)."
+      },
+      {
+        "name": "local-plugins",
+        "mountPath": ".local-plugins/marketplaces",
+        "mode": "r",
+        "purpose": "marketplace skills/plugins, runtime-discovered"
+      },
+      {
+        "name": "remote-plugins",
+        "mountPath": ".remote-plugins",
+        "mode": "r",
+        "purpose": "org-remote plugins, runtime-discovered"
+      },
+      {
+        "name": "outputs",
+        "mountPath": "outputs",
+        "mode": "rw",
+        "purpose": "session outputs/artifacts — delete denied by default (asar IX); rwd only when approved"
+      }
+    ]
+  },
+  "network": {
+    "mode": "gvisor",
+    "allowKind": "allowlist",
+    "allowDomains": [
+      "sentry.io",
+      "preview.claude.ai",
+      "downloads.claude.ai",
+      "api.anthropic.com",
+      "a-cdn.anthropic.com",
+      "a-api.anthropic.com",
+      "assets.claude.ai",
+      "console.anthropic.com",
+      "api-staging.anthropic.com",
+      "www.anthropic.com",
+      "docs.anthropic.com",
+      "mcp-proxy.anthropic.com",
+      "pivot.claude.ai",
+      "support.anthropic.com"
+    ]
+  },
+  "bgEnvStrip": {
+    "knownVars": [
+      "CLAUDE_CODE_OAUTH_TOKEN",
+      "CLAUDE_CODE_SESSION_KIND",
+      "CLAUDE_CODE_SESSION_ID",
+      "CLAUDE_CODE_SESSION_NAME",
+      "CLAUDE_CODE_SESSION_LOG"
+    ]
+  },
+  "$comment": "Platform baseline auto-derived by `cowork-harness sync` from a live Claude Desktop install + app.asar. VOLATILE per-release facts only. Regenerate per release; review the diff. Captured 2026-06-27 on macOS arm64.",
+  "capturedAt": "2026-06-27",
+  "platform": "darwin-arm64",
+  "settings": {
+    "autoMountFolders": {
+      "key": "autoMountFolders",
+      "default": false
+    },
+    "localAgentModeTrustedFolders": {
+      "key": "localAgentModeTrustedFolders",
+      "default": []
+    }
+  },
+  "provenance": {
+    "asarPath": "/Applications/Claude.app/Contents/Resources/app.asar",
+    "asarFingerprint": "687dfcfca5bdfc0f",
+    "gates": {
+      "$comment": "Production GrowthBook gate states decoded from ~/Library/Application Support/Claude/fcache (standard interactive Anthropic account, 2026-06-13; binary-verified app.asar 1.12603.1). Pin per release. Behavior-affecting gates the harness models: 1143815894 (loop), 1648655587 (dispatch cap), 1978029737 (web_fetch routing). Telemetry/auth-internal gates omitted.",
+      "bridgeSdkTransport:583857784": {
+        "on": true,
+        "source": "force",
+        "value": true,
+        "note": "— Cowork uses the SDK-based transport (control protocol), confirming the harness's sdkMcpServers/mcp_message path is the production transport."
+      },
+      "hostLoop:1143815894": {
+        "on": true,
+        "source": "force",
+        "value": true
+      },
+      "taskDispatchLimiter:1648655587": {
+        "on": true,
+        "source": "force",
+        "value": {
+          "perTask": 1,
+          "global": 3
+        },
+        "note": "perTask=1 global=3 (host-side SKIP: recordSkipAndEmit/GCA.PerTaskLimit — NOT queue/deny). A dispatch session launches <=1 sub-task; <=3 concurrent globally."
+      },
+      "coworkRuntimeConfig:1978029737": {
+        "on": true,
+        "source": "force",
+        "value": {
+          "sessionsBridgePollBlockMs": 30,
+          "coworkNativeFilePreview": true,
+          "coworkWebFetchViaApi": true,
+          "coworkWebFetchPrompt": true,
+          "workspaceBashWaitLonger": true
+        },
+        "note": "coworkWebFetchViaApi=true coworkWebFetchPrompt=true workspaceBashWaitLonger=true sessionsBridgePollBlockMs=30 — web_fetch is host/API-routed (POST /api/organizations/<org>/cowork/web_fetch), NOT container egress; gated by a separate web-fetch hostname allowlist + URL provenance."
+      },
+      "cliPlugin:2307090146": {
+        "on": false,
+        "source": "defaultValue",
+        "value": false,
+        "note": "— the CLI-plugin credential broker is dark-launched off for standard interactive accounts (Ch23/L106)."
+      },
+      "pluginSyncSparkplug:2340532315": {
+        "on": true,
+        "source": "force",
+        "value": true,
+        "note": "— startup syncPlugins(); plugins load via --plugin-dir (registry inert in-VM)."
+      }
+    },
+    "eipcChannelUuid": "4f426349-8d6f-45f3-ae22-280fef323564",
+    "$comment": "eipcChannelUuid is per-build; recorded for provenance only — the harness does not use Desktop IPC."
+  },
+  "requireFullVmSandbox": null
+}

package/dist/cli.js

@@ -170,16 +170,16 @@ Questions:
       first    pick option 1, loudly warn — then the footer prints the --answer to lock it in
       (the footer always echoes auto-answered questions as copy-pasteable --answer lines)
       (to answer LIVE questions, use --decider-llm / --decider-cmd / --decider-dir below)
-  --decider-llm [--intent "<one line>"]   answer LIVE questions with a small model (the ergonomic
+  --decider-llm [--intent "<one line>"]   answer LIVE questions with a model (Sonnet default; the ergonomic
                                    default for agent-driven runs: state the test's intent once instead of
                                    writing a helper). The model replies with the option NUMBER (code maps it
                                    to the exact label); an out-of-set answer FAILS LOUD. NON-deterministic —
                                    the footer flags the run so a green isn't mistaken for a scripted pass;
                                    pin with --answer for CI.
   --decider-model <id>             override the --decider-llm answering model (flag > env
-                                   COWORK_HARNESS_DECIDER_MODEL > Haiku default). Use a stronger model for
-                                   genuinely ambiguous judgment gates; it won't make an under-specified gate
-                                   deterministic. Requires --decider-llm.
+                                   COWORK_HARNESS_DECIDER_MODEL > Sonnet default). Pin a cheaper model
+                                   (e.g. a Haiku id) for simple gates to cut cost; it won't make an
+                                   under-specified gate deterministic. Requires --decider-llm.
   --decider-cmd '<helper>'         answer the LIVE question via a spawned helper (for custom logic). The
                                    helper reads a {"type":"decision_request",…} line on stdin and writes
                                    back {"answers":{"<q>":"<label or 1-based index>"}} (MUST flush per
@@ -231,7 +231,7 @@ Input policy:
   (run omits --decider-llm by design — scenarios pin answers for reproducibility; a scenario may still
    opt into the model with 'on_unanswered: llm' in its YAML, which flags the run non-deterministic)
   --decider-model <id>             override the answering model for 'on_unanswered: llm' scenarios
-                                   (flag > env COWORK_HARNESS_DECIDER_MODEL > Haiku default); no-op for
+                                   (flag > env COWORK_HARNESS_DECIDER_MODEL > Sonnet default); no-op for
                                    scenarios that don't use the model terminal.
   (per-scenario answers/on_unanswered in the YAML take precedence where set)
 
@@ -821,7 +821,7 @@ async function cmdRun(rawArgs) {
     if (hasHelp(rawArgs))
         return void log(RUN_HELP);
     // --decider-model overrides the LLM decider's answering model for scenarios that use `on_unanswered: llm`
-    // (flag > env COWORK_HARNESS_DECIDER_MODEL > Haiku default). `takeCommonFlags` doesn't know it (it's not a
+    // (flag > env COWORK_HARNESS_DECIDER_MODEL > Sonnet default). `takeCommonFlags` doesn't know it (it's not a
     // common flag), so pull it out of argv first — otherwise it would land as an "unexpected argument".
     let deciderModel;
     const preArgs = [];

package/dist/decide/decider.js

@@ -383,7 +383,7 @@ export function coerceWebFetchGrant(answer) {
     throw new UnansweredError(`web_fetch approval answer "${answer.trim().slice(0, 60)}" is not a valid grant option`, "expected one of: Allow once | Allow all for website | Deny");
 }
 /**
- * `agent` policy — the LLM decider. Per live question, asks a small model to pick ONE option (by label,
+ * `agent` policy — the LLM decider. Per live question, asks the answering model to pick ONE option (by label,
  * never index — options reorder run-to-run), optionally steered by a one-line `--intent`. The ergonomic
  * default for agent-driven runs: state the test's meaning once instead of hand-writing a `--decider-cmd`
  * helper. NON-DETERMINISTIC by nature — `executeScenario` flags the run so a green LLM-steered pass can't
@@ -394,7 +394,7 @@ export class LlmDecider {
     intent;
     model;
     secrets;
-    constructor(complete, intent, model = process.env.COWORK_HARNESS_DECIDER_MODEL || "claude-haiku-4-5-20251001", 
+    constructor(complete, intent, model = process.env.COWORK_HARNESS_DECIDER_MODEL || "claude-sonnet-4-5", 
     // #62: the default transport spawns `claude -p <prompt>` with the prompt as ARGV (process-table visible).
     // The prompt embeds an unscrubbed transcript tail, so without these a tracked secret in the last ~1000
     // chars lands in `ps`/`/proc/<pid>/cmdline`. Scrub the prompt at each complete() call — symmetric with
@@ -413,7 +413,14 @@ export class LlmDecider {
                 return ABSTAIN;
             const labels = req.options.map((o) => o.label);
             const raw = await this.complete(scrub(this.permPrompt(req, ctx), this.secrets), this.model);
-            const pick = matchLabel(raw, labels);
+            // Echo backstop, at parity with the question path's `echoPrefixMatch` tier: the model often
+            // parrots the offered option plus a self-glossed tail past a `:` boundary ("Allow once: fetch
+            // this URL one time"). Bind the echoed label instead of failing loud. The OTHER:/suffix tiers are
+            // inapplicable to a web_fetch grant (a closed set — no free-text, no "(Recommended)" labels), so
+            // only the echo tier is added; the bound value is a bare canonical label coerceWebFetchGrant accepts.
+            let pick = matchLabel(raw, labels);
+            if (!pick)
+                pick = echoPrefixMatch(raw, labels);
             if (!pick)
                 throw new UnansweredError(`LLM decider answer "${raw.trim().slice(0, 60)}" is not one of the options for "${req.tool}"`, `options were: ${labels.join(" | ")}`);
             const { behavior, grant } = coerceWebFetchGrant(pick);
@@ -520,7 +527,10 @@ export class LlmDecider {
                 pick = echoPrefixMatch(raw, labels);
             if (!pick) {
                 const near = nearestLabel(raw, labels);
-                throw new UnansweredError(`LLM decider answer "${raw.trim().slice(0, 60)}" is not one of the options for "${text}"`, `options were: ${labels.join(" | ")}${near ? ` — closest: ${JSON.stringify(near)}` : ""}. Reply the option NUMBER, or \`OTHER: <value>\` for a custom answer.`);
+                throw new UnansweredError(`LLM decider answer "${raw.trim().slice(0, 60)}" is not one of the options for "${text}"`, `options were: ${labels.join(" | ")}${near ? ` — closest: ${JSON.stringify(near)}` : ""}. Reply the option NUMBER, or \`OTHER: <value>\` for a custom answer. ` +
+                    `If the model declined in prose instead of picking an option, the answering model is set by ` +
+                    `\`--decider-model\` / \`COWORK_HARNESS_DECIDER_MODEL\` (a different/more capable model may bind it; ` +
+                    `on a gate whose answer isn't in the inputs it may guess rather than truly know).`);
             }
             process.stderr.write(`[llm-decider] "${text}" → "${pick}"${this.intent ? ` (intent: ${this.intent})` : ""}\n`);
             answers[text] = pick;

package/dist/decide/llm-transport.js

@@ -30,7 +30,7 @@ function spawnOnce(bin, prompt, model, timeoutMs, maxBytes) {
                 /* already gone */
             }
             // NOT a TransportExit → not retried: a child that ate the whole timeout budget is not a quick transient.
-            reject(new Error(`LLM decider transport (${bin} -p) timed out after ${timeoutMs}ms`));
+            reject(new Error(`LLM decider transport (${bin} -p) timed out after ${timeoutMs}ms — raise COWORK_HARNESS_LLM_TIMEOUT_MS to allow a longer gate`));
         }, timeoutMs);
         // Bound stdout too — the wall-clock timeout above caps a fully-hung child, but not one that is
         // actively spewing. Past the cap, SIGKILL and reject loud rather than growing the buffer unbounded.
@@ -52,7 +52,7 @@ function spawnOnce(bin, prompt, model, timeoutMs, maxBytes) {
                 }
                 clearTimeout(timer);
                 // NOT a TransportExit → not retried: a spewing child would just spew again.
-                reject(new Error(`LLM decider transport (${bin} -p) exceeded ${maxBytes} bytes — aborting`));
+                reject(new Error(`LLM decider transport (${bin} -p) exceeded ${maxBytes} bytes — aborting; raise COWORK_HARNESS_LLM_MAX_BYTES if this output is legitimately large`));
                 return;
             }
             chunks.push(d);
@@ -65,7 +65,7 @@ function spawnOnce(bin, prompt, model, timeoutMs, maxBytes) {
         child.on("error", (e) => {
             clearTimeout(timer);
             // NOT a TransportExit → not retried: a spawn failure (e.g. ENOENT — `claude` not on PATH) is deterministic.
-            reject(new Error(`LLM decider transport (${bin} -p) failed to spawn: ${e.message}`));
+            reject(new Error(`LLM decider transport (${bin} -p) failed to spawn: ${e.message} — ensure 'claude' is installed and on PATH, or set COWORK_HARNESS_CLAUDE_BIN to its path`));
         });
         child.on("close", (code) => {
             clearTimeout(timer);
@@ -88,7 +88,7 @@ function spawnOnce(bin, prompt, model, timeoutMs, maxBytes) {
  * over a direct `POST /v1/messages` (Opus H1): the harness PROCESS is not behind the egress proxy
  * (only the spawned agent child is), so a direct API call would bypass the very allowlist the harness
  * enforces. `claude -p` reuses the run's own auth path and is dogfood-consistent. One short, tool-less
- * call per gate on a small model — bounded cost/latency, no recursion into the harness.
+ * call per gate (one call, no recursion into the harness; model is the decider default or --decider-model).
  *
  * Non-zero-exit retry: a single `claude -p` spawn can exit non-zero on a TRANSIENT upstream hiccup
  * (rate-limit/overload/network) during a long back-to-back batch — observed live, not reproducible on demand.

package/dist/run/doctor.js

@@ -222,7 +222,7 @@ export function runDoctorChecks(tier, probe = realProbe) {
         remedy: token
             ? undefined
             : keychainOnly
-                ? "copy your Keychain token into ./.env so the in-Docker agent can read it: echo CLAUDE_CODE_OAUTH_TOKEN=$(claude setup-token) >> .env"
+                ? "copy your Keychain token into ./.env so the in-Docker agent can read it: echo CLAUDE_CODE_OAUTH_TOKEN=$(claude setup-token) >> .env — or, if the token is already in another file, point at it: cowork-harness --dotenv <path> <cmd> (the global --dotenv is honored by doctor too)"
                 : worktreeEnv
                     ? `the main checkout has a .env — point at it: cowork-harness --dotenv ${worktreeEnv} <cmd> (or set CLAUDE_CODE_OAUTH_TOKEN)`
                     : "export CLAUDE_CODE_OAUTH_TOKEN=$(claude setup-token), put it in ./.env, or point at another file: cowork-harness --dotenv <path> <cmd>",

package/dist/run/run.js

@@ -220,17 +220,27 @@ export class Run {
             this.session.close();
         }
         this.rec.transcript = transcript.join("\n");
-        // H2: stall-on-question detection. A turn that ends on a plain-text re-ask ("which file?") gets
+        // H2/H3: stall-on-question detection. A turn that ends on a plain-text re-ask ("which file?") gets
         // is_error:false → result:"success" (a false-green — the SDK turn didn't error, but the task didn't
         // complete). Flag it (computeVerdict turns it into a `stalled` fail unless allow_stall). Conservative
         // conjunction to keep the default-fail safe: (1) the run cleanly succeeded, (2) the FINAL top-level
-        // assistant message is a question, (3) the agent took NO action the whole run (no tool_use — a Write/Bash
-        // that produced an artifact is in toolLog, so this subsumes "wrote nothing"), and (4) NO structured
-        // AskUserQuestion gate ever occurred (those are already on_unanswered's job — `rec.questions` is the
-        // reliable signal, NOT event adjacency). Reads only `rec`/local state, so it re-derives identically on the
-        // replay re-drive. Scenario-lane only (a single oneShot turn); not exercised by the multi-turn chat driver.
+        // assistant message is a question, and (3) NO productive tool ran AFTER the last gate.
+        //
+        // (3) is keyed on toolLog position, not "no tools at all": an AskUserQuestion gate arrives as a real
+        // assistant tool_use block (→ toolLog; see toolCounts in any gated result.json), so a naive
+        // `toolLog.length === 0` would miss H3 — the founder repro where the agent answered a gate, then re-asked
+        // in plain text and stalled, having done productive work BEFORE the gate. So we slice toolLog AFTER the
+        // last AskUserQuestion and count non-gate calls: zero ⇒ the agent waited on input and did nothing further.
+        // With no gate, lastIndexOf === -1 → the slice is the whole log → this reduces to H2's exact "no tools at
+        // all" behavior. The count includes parented(subagent)/synthetic entries (toolLog pushes unconditionally)
+        // — they only RAISE the count, never a new false positive. on_unanswered owns the *unanswered* gate; this
+        // owns the agent stalling AFTER an answered one. Reads only local/rec state, so it re-derives identically
+        // on the replay re-drive. Scenario-lane only (one oneShot turn); the chat driver runs it but never reads
+        // the flag (no computeVerdict), so it is inert there.
         const lastText = transcript.length > 0 ? transcript[transcript.length - 1].trim() : "";
-        if (this.rec.result === "success" && lastText.endsWith("?") && this.toolLog.length === 0 && this.rec.questions.length === 0) {
+        const lastGateIdx = this.toolLog.map((t) => t.name).lastIndexOf("AskUserQuestion");
+        const productiveAfterGate = this.toolLog.slice(lastGateIdx + 1).filter((t) => t.name !== "AskUserQuestion").length;
+        if (this.rec.result === "success" && lastText.endsWith("?") && productiveAfterGate === 0) {
             this.rec.stalledOnQuestion = true;
         }
         // Part 3: pair each answered gate with its tool_result (by toolUseId). delivered=true iff a non-error

package/dist/types.js

@@ -201,7 +201,7 @@ export const Assertion = z.object({
     allow_stall: z
         .boolean()
         .optional()
-        .describe("(verdict modifier) suppress the default-fail when a run ends on an unanswered question (the agent asked for input and stopped) — assert this only when ending on a question is the intended terminal state; otherwise script the answer (answer:/--answer/decider)"),
+        .describe("(verdict modifier) suppress the default-fail when a run ends on a question having done no productive tool work after its last gate (the agent asked for input and stopped — incl. re-asking in plain text after answering an AskUserQuestion) — assert this only when ending on a question is the intended terminal state; otherwise script the answer (answer:/--answer/decider)"),
     replay_protocol_fidelity: z
         .boolean()
         .optional()

package/docs/cassette.md

@@ -38,7 +38,7 @@ Use a live `run` for filesystem/egress assertions; use `replay` for the token-fr
     { "path": "outputs/x.json", "bytes": 24, "sha256": "…", "body": "{…}" }, // body inlined ≤ 64 KiB
     { "path": "outputs/big.bin", "bytes": 9e6, "sha256": "…", "truncated": true } // oversized → hash-only
   ],
-  "fingerprint": { "baseline": "1.15962.0", "skillHash": "…", "mode": "git", "contentSig": "…", "fileSigs": [["skills/x/SKILL.md", "…"]], "skillSources": ["…"] }, // staleness tripwire (v5: fileSigs only; v6: mode + git default; v7: NUL-delimited hash entries)
+  "fingerprint": { "baseline": "1.15962.1", "skillHash": "…", "mode": "git", "contentSig": "…", "fileSigs": [["skills/x/SKILL.md", "…"]], "skillSources": ["…"] }, // staleness tripwire (v5: fileSigs only; v6: mode + git default; v7: NUL-delimited hash entries)
   "authoring": { "nonDeterministic": true, "channel": "decider-dir" } // present ONLY when a live decider answered ≥1 gate (see §Answering gates during recording); re-record may drift, replay is still deterministic
 }
 ```

package/docs/cowork-spawn-contract-1.12603.1.md

@@ -1,6 +1,6 @@
 # Cowork spawn contract — app.asar 1.12603.1 / agent ELF 2.1.170
 
-> **Applicability note:** verified on `desktop-1.12603.1`. The current baseline is `desktop-1.15962.0`
+> **Applicability note:** verified on `desktop-1.12603.1`. The current baseline is `desktop-1.15962.1`
 > (agent ELF 2.1.187). Control-protocol fields documented here (spawn flags, handshake envelope,
 > permission/question shapes) are **unchanged**; the **mount layout changed at ≥1.14271.0** (work folders
 > now mount at `mnt/<name>`, not `mnt/.projects/<id>` — see CHANGELOG). Volatile fields — `agentVersion`,

package/docs/decider-dir.md

@@ -6,7 +6,7 @@ stays live. There is no resume, no re-worded question: the harness blocks on eac
 reads it, writes an answer, and the run continues from exactly where it paused.
 
 This is the fourth answer channel, alongside scripted `--answer`/`--answer-policy` (deterministic),
-`--decider-llm` (a small model picks), and `--decider-cmd '<helper>'` (a spawned helper). Unlike the
+`--decider-llm` (a model picks — defaults to Sonnet), and `--decider-cmd '<helper>'` (a spawned helper). Unlike the
 scripted channels, `--decider-dir` answers questions you don't know in advance — so the harness
 **flags the run non-deterministic** (the footer says so), and a fresh, empty directory is **required**
 per run. Like every channel, it keeps the CLI's stdout free, so it composes with `--output-format json`.

package/docs/scenario.md

@@ -116,12 +116,14 @@ the CLI's `--decider-llm`). It is **non-deterministic** by construction, so a ru
 `nonDeterministic` in the record — keep it out of deterministic CI regressions; prefer scripted answers +
 `fail` there. See the determinism note above and the decider flags in the [README](../README.md).
 
-> **For large unattended batches, script the stable gates.** A pure live decider re-asks a small model
+> **For large unattended batches, script the stable gates.** A pure live decider re-asks the model
 > once per gate; across a back-to-back batch that is more wall-clock, more paid calls, and more exposure to
 > a transient `claude -p` exit (now bounded-retried, but not free). For unattended multi-doc completion
-> prefer scripted `--answer` / `--answer-policy` on the gates you can name (a stronger `--decider-model`
-> only for the genuinely ambiguous *judgment* gates), and keep `--decider-llm` for exploration. The partial
-> run on a stall already echoes the gate + numbered options — paste them straight into `--answer`.
+> prefer scripted `--answer` / `--answer-policy` on the gates you can name, and keep `--decider-llm` for
+> exploration. **Also script any gate whose answer feeds a *semantic* assertion:** a decided answer can be a
+> confident guess — the decider sees only the transcript tail, not the mounted documents, so it can get a
+> doc-answerable fact wrong (a stronger model included) — and a green run resting on it is a false pass.
+> The partial run on a stall already echoes the gate + numbered options — paste them straight into `--answer`.
 
 > **Where scripted answers hold up — and where they don't.** The `when_question` regex absorbs *wording*
 > drift (an LLM phrases "confirm the stage" many ways), so scripting is robust for skills whose gates are
@@ -264,7 +266,7 @@ if *every* key passes (don't rely on the first; keep one concern per item unless
 | `allow_permissive_auto_allow: true` | verdict modifier — suppresses the default-fail when the run recorded a cowork-parity permissive auto-allow; use this for tests that **deliberately** assert Cowork's permissive behavior rather than strict scripted coverage |
 | `allow_missing_capability: true` | verdict modifier (**live tiers only**) — suppresses the default-fail when the lean/`core` agent image omits a capability the skill used but real Cowork ships (OCR/LibreOffice/markitdown/opencv/PDF-tables); assert only when the skill's fallback is genuinely equivalent, else rebuild full parity (`--build-arg COWORK_FULL_PARITY=1`). Also opts out of the `requires_capabilities` declared-need check below. |
 | `allow_l0_plugin_divergence: true` | verdict modifier — opts into L0/protocol plugin divergence, suppressing the plugin-fidelity default-fail |
-| `allow_stall: true` | verdict modifier — suppresses the default-fail when a run ends on an unanswered plain-text question (the agent asked for input and stopped); assert only when ending on a question is the intended terminal state, otherwise script the answer (`answer:` / `--answer` / a decider) |
+| `allow_stall: true` | verdict modifier — suppresses the default-fail when a run ends on a question having done no productive tool work after its last gate (the agent asked for input and stopped — incl. re-asking in plain text *after* answering an `AskUserQuestion`); assert only when ending on a question is the intended terminal state, otherwise script the answer (`answer:` / `--answer` / a decider) |
 | `transcript_no_host_path: true` | no host path (`/Users/`, `/opt/cowork/`, `/home/`, `/root/`) leaked into model-visible text |
 | `egress_denied: <host>` | the host was blocked by the egress proxy |
 | `egress_allowed: <host>` | the host was allowed through |
@@ -449,7 +451,7 @@ in the `--output-format json` envelope.
 `--verbose`/`-V` shows the transcript for every scenario, `--quiet` shows only the verdict. `--output-format
 json` emits the machine envelope `{tool, version, command, ok, results[], error}` on stdout (one
 `RunResult` per scenario; overall pass = `result==="success" && assertions.every(pass)` **AND a clean
-`computeVerdict`** — a verdict signal like `stalled` (ended on an unanswered question), `transport_error`, or a
+`computeVerdict`** — a verdict signal like `stalled` (ended on a question with no productive work after its last gate), `transport_error`, or a
 missing-capability/boundary signal can still fail a run whose `result` is `success` and whose assertions all
 pass, unless the matching `allow_*` modifier is asserted) — full schema
 in [SPEC §11](../SPEC.md). Human output is stderr; stdout stays machine-only under `--output-format json`.

package/examples/replays/README.md

@@ -13,7 +13,7 @@ replay path end-to-end, including:
 
 Run it with:
 
-> Assumes the `cowork-harness` CLI is available — from a source checkout run `npm ci && npm run build && npm link` first, or `npm i -g cowork-harness@>=0.18.0`. (`replay` itself needs nothing else — no token, no Docker.)
+> Assumes the `cowork-harness` CLI is available — from a source checkout run `npm ci && npm run build && npm link` first, or `npm i -g cowork-harness@>=0.19.0`. (`replay` itself needs nothing else — no token, no Docker.)
 
 ```sh
 cowork-harness replay examples/replays/example-pdf-skill.cassette.json

package/examples/replays/example-pdf-skill.cassette.json

@@ -92,7 +92,7 @@
   ],
   "scenarioSource": "../scenarios/example-pdf-skill.yaml",
   "fingerprint": {
-    "baseline": "1.15962.0",
+    "baseline": "1.15962.1",
     "skillHash": "4db1ddd5d109abc71f9b28807d3e31729f9882d9b85d6d0a9dd7a1980bed3110",
     "contentSig": "e8022822156176fa10e04f0e31d1269719fd09890488db3dfd6351ea8c34431c",
     "skillSources": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cowork-harness",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "Scriptable, CI-friendly harness for Claude Cowork's runtime contract for testing skills across scenarios — same agent, mounts, egress allowlist, permission protocol, and sandbox limitations.",
   "license": "MIT",
   "type": "module",

package/schema/run-result.json

@@ -20,7 +20,7 @@
     },
     "stalledOnQuestion": {
       "type": "boolean",
-      "description": "H2: the run ended on an unanswered plain-text question (the agent asked for input and stopped) while result==='success'. computeVerdict fails on this (a 'stalled' signal) unless the scenario asserts allow_stall."
+      "description": "H2/H3: the run ended on a question having done no productive tool work after its last gate (the agent asked for input and stopped — incl. re-asking in plain text after answering an AskUserQuestion) while result==='success'. computeVerdict fails on this (a 'stalled' signal) unless the scenario asserts allow_stall."
     },
     "capabilityProbe": {
       "type": "string",

package/schema/scenario.schema.json

@@ -230,7 +230,7 @@
             "type": "boolean"
           },
           "allow_stall": {
-            "description": "(verdict modifier) suppress the default-fail when a run ends on an unanswered question (the agent asked for input and stopped) — assert this only when ending on a question is the intended terminal state; otherwise script the answer (answer:/--answer/decider)",
+            "description": "(verdict modifier) suppress the default-fail when a run ends on a question having done no productive tool work after its last gate (the agent asked for input and stopped — incl. re-asking in plain text after answering an AskUserQuestion) — assert this only when ending on a question is the intended terminal state; otherwise script the answer (answer:/--answer/decider)",
             "type": "boolean"
           },
           "replay_protocol_fidelity": {