cowork-harness 0.22.0 → 0.23.0

package/.claude/skills/cowork-harness/SKILL.md

@@ -3,8 +3,8 @@ name: cowork-harness
 description: Test or debug a Claude Code skill/plugin under Claude Cowork's runtime — sandboxed agent, default-deny egress, the can_use_tool permission/question protocol — using the cowork-harness CLI. Use when validating or regression-testing a skill, authoring or debugging a scenario YAML (prompt + scripted answers + assert:), choosing a fidelity tier, scripting AskUserQuestion / tool-permission answers, or asserting artifacts, egress, or sub-agent dispatch. Especially when a harness run no-ops an assertion, fails on an unanswered gate, false-greens, a steered answer never reaches the model, or a web_fetch is unexpectedly denied or gated. NOT for generic unit testing (pytest/vitest of your own scripts) or non-Cowork CI. Covers the skill / run / chat / record / replay / trace / decide / assertions / scaffold commands and the session-vs-scenario split.
 metadata:
   author: cowork-harness
-  version: 0.22.0
-  tracks-harness: cowork-harness 0.22.0 (baseline desktop-1.18286.0)
+  version: 0.23.0
+  tracks-harness: cowork-harness 0.23.0 (baseline desktop-1.18286.0)
 ---
 
 # cowork-harness
@@ -22,7 +22,7 @@ flagged with a loud `::warning::`, not silent — auto-answer a gate, observe an
 allowlist). This skill exists mostly to keep you out of those traps — the Gotchas section below is
 the highest-value part. Read it.
 
-> **Version note:** the facts and `file:line` pointers here track `cowork-harness 0.22.0` (baseline
+> **Version note:** the facts and `file:line` pointers here track `cowork-harness 0.23.0` (baseline
 > `desktop-1.18286.0`). If your checkout is newer, prefer the live `--help`, `SPEC.md`, and
 > `docs/*.md` over this snapshot, and re-run the bundled linter.
 
@@ -38,7 +38,7 @@ cowork-harness skill ./my-skill "do X"      # run the skill once against the sta
 Before the first command, confirm the CLI is reachable and **fail loud** (never fake a pass) when a tier's dependencies are missing:
 
 - **One-shot check.** Run `cowork-harness doctor [--tier <tier>]` first — a read-only prerequisite check that inspects Docker, the staged agent, the token, and the baseline in one pass. The bullets below explain each thing it checks (and how to fix it).
-- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 0.22.0**. If it's missing or older, prefix every command with the version floor `npx cowork-harness@>=0.22.0 <cmd>` (Node ≥ 20), or install once with `npm i -g cowork-harness@>=0.22.0`. **Pin `@>=0.22.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published. (≥ 0.22.0 is what gates the commands/assertions this skill teaches: `assertions --list`, `scaffold <run-id>`, `trace --view dispatches`, `artifact_json` incl. the `in:` operator, `verify-cassettes`, batch `record <dir>`/`--rerecord-stale`, `record --concurrency <N>`, record-time redaction, multiSelect/`answer:`, `verify-run` answer-coverage, `record --max-artifact-bytes`, live record-time deciders, `verify-cassettes --allow-domain`/`--allow-email`/`--allow-path`/`--allow-file` (`path` — local absolute filesystem paths — is the scanner's 4th class, new in 0.21.0), scenario `skills:` staleness scoping with `COWORK_HARNESS_AGENT_SCOPE=skill`, `chat --plugin`, `/help` in the REPL, `hostloop`'s native host/VM process split with its `allow_host_writes:` consent field, and `computer_links_resolve` (new in 0.22.0).)
+- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 0.23.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@>=0.23.0" <cmd>` (Node ≥ 20), or install once with `npm i -g "cowork-harness@>=0.23.0"`. **Pin `@>=0.23.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published. (≥ 0.23.0 is what gates the commands/assertions this skill teaches: `assertions --list`, `scaffold <run-id>`, `trace --view dispatches`, `artifact_json` incl. the `in:` operator, `verify-cassettes`, batch `record <dir>`/`--rerecord-stale`, `record --concurrency <N>`, record-time redaction, multiSelect/`answer:`, `verify-run` answer-coverage, `record --max-artifact-bytes`, live record-time deciders, `verify-cassettes --allow-domain`/`--allow-email`/`--allow-path`/`--allow-file` (`path` — local absolute filesystem paths — is the scanner's 4th class, new in 0.21.0), scenario `skills:` staleness scoping with `COWORK_HARNESS_AGENT_SCOPE=skill`, `chat --plugin`, `/help` in the REPL, `hostloop`'s native host/VM process split with its `allow_host_writes:` consent field, and `computer_links_resolve` (new in 0.22.0).)
 - **Agent binary (sandboxed live tiers — `container`/`microvm`/`hostloop`/`cowork`).** The staged Claude Code agent is **bind-mounted** from a local Claude Desktop install, or point `COWORK_AGENT_BINARY` at a `claude-code-vm/<ver>/claude` ELF. Nothing is bundled. `protocol` (L0) and `replay` need no staged agent; for the sandboxed tiers, no agent → no run; report that, don't skip silently.
 - **Docker / Lima.** Only `--fidelity protocol` (L0) runs without them. `container` / `microvm` / `hostloop` / `cowork` need Docker (Lima for L2). If they're absent, drop to `--fidelity protocol` and **say so** — a green that never exercised the sandbox is not a sandbox pass.
 - **Auth.** `CLAUDE_CODE_OAUTH_TOKEN` (preferred) or `ANTHROPIC_API_KEY`, via env or `.env`. Minting an OAuth token needs the **`claude` CLI** (`npm i -g @anthropic-ai/claude-code`, then `claude setup-token`).
@@ -55,7 +55,12 @@ Before the first command, confirm the CLI is reachable and **fail loud** (never
 
 Full command set: `skill · run · chat · record · replay · verify-cassettes · rehash · prune · lint ·
 verify-run · trace · inspect · diff · stats · decide · gates · answer · scaffold · assertions --list · sync ·
-list · boundary-check · vm <init|status|delete|prune> · doctor`. Always check `cowork-harness <cmd> --help`.
+list · boundary-check · status · vm <init|status|delete|prune> · doctor`. Always check `cowork-harness <cmd> --help`.
+
+**Two different `scaffold` tools — don't confuse them.** The native `cowork-harness scaffold <run-id>`
+above turns an already-*recorded* run into a scenario (needs a run to exist first). The bundled
+`scripts/scenario.py scaffold --name … --skill …` in §9 builds a scenario from flags alone, no run
+required. Passing §9's flag set to the native command fails with `unknown flag: --name` (exit 2).
 
 ## 2. Two files: session vs scenario
 
@@ -94,7 +99,8 @@ the folder basename (collision-resolved); there is no `to:` override. See `refer
 | `hostloop` / `cowork` | Production split-exec: the agent loop is a **native process on the host** (no container around the file tools — matching production), with native Bash/WebFetch disabled and routed host-side via the workspace SDK-MCP server into a Docker VM sidecar | Highest-fidelity / parity runs. A writable connected folder needs `allow_host_writes: true` (see scenario-schema.md). |
 
 Set the tier in the **scenario's `fidelity:` field**, not a flag — `run` rejects `--fidelity`
-(it's a `skill`-only flag). See `references/fidelity-and-answers.md`.
+(it's a `skill`/`chat` flag; `run` takes fidelity only from the scenario). See
+`references/fidelity-and-answers.md`.
 
 ## 5. Choose an answer path (gates: AskUserQuestion + tool-permission)
 
@@ -265,7 +271,7 @@ known-good skeleton (right tier, scripted `answers:` + `on_unanswered: fail`, co
 separated from live-only ones, one concern per item) and **self-lints its own output**:
 
 ```bash
-S="${CLAUDE_PLUGIN_ROOT}/skills/cowork-harness/scripts/scenario.py"
+S="${CLAUDE_PLUGIN_ROOT}/scripts/scenario.py"
 # Working from a repo checkout instead of an installed plugin?
 # S=".claude/skills/cowork-harness/scripts/scenario.py"
 python3 "$S" scaffold --name report-check --skill ./skills/report-gen \
@@ -392,23 +398,29 @@ are the ones that bite hardest.
     prompt. *Fix:* treat `prompt_asset_missing` as a blocking error in CI by checking the signals
     array.
 13. **`result: success` means the agent didn't error, NOT that the task completed — always assert on
-    artifacts/content.** A turn that ends on a plain-text re-ask ("which file did you mean?") still
-    reports `result: success`. The harness catches a run that ends on a question and did **no productive
-    work after its last gate** — both the no-gate case ("which file?" with no tool calls) AND the
-    *answered-gate-then-re-ask* case (the agent answers an `AskUserQuestion`, then asks again in plain text
-    and stops) — with a **`stalled`** verdict signal (suppress with `allow_stall: true` if ending on a
-    question is intended). The signal is a **tool-position heuristic**, not deliverable detection, so it is
-    imprecise both ways: (a) a post-gate tool *call* clears the flag whether it **succeeded or errored** (false
-    negative — an agent that ran a tool after the gate and still stalled is not caught); and (b) a deliverable
-    written *before* a final confirmation gate does **not** clear it, so a write-then-confirm-then-question run
-    is flagged (false positive — use `allow_stall: true` for a deliberate confirm-terminal skill). The broad
-    guard is therefore YOUR assertions — assert the deliverable
-    (`file_exists` / `artifact_json` / `transcript_matches`), never just `result: success`. Note:
-    `on_unanswered` governs **unanswered** `AskUserQuestion` gates; the `stalled` signal covers stalling
-    *after* one is answered. A "type-it-in-notes" option has **no scripted deterministic answer** today (the
-    `OTHER:` directive works only on the LLM-decider path, not scripted `choose:`; on an options-bearing gate
-    a bare out-of-set LLM answer fails loud (exit 2) — see the LLM-decider free-text note in
-    `references/fidelity-and-answers.md`).
+    artifacts/content.**
+    - A turn that ends on a plain-text re-ask ("which file did you mean?") still reports
+      `result: success`.
+    - The harness catches this with a **`stalled`** verdict signal: a run that ends on a question and
+      did **no productive work after its last gate** — both the no-gate case ("which file?" with no
+      tool calls) AND the *answered-gate-then-re-ask* case (the agent answers an `AskUserQuestion`,
+      then asks again in plain text and stops). Suppress with `allow_stall: true` if ending on a
+      question is intended.
+    - The signal is a **tool-position heuristic**, not deliverable detection, so it is imprecise both
+      ways:
+      - **False negative:** a post-gate tool *call* clears the flag whether it **succeeded or
+        errored** — an agent that ran a tool after the gate and still stalled is not caught.
+      - **False positive:** a deliverable written *before* a final confirmation gate does **not**
+        clear it, so a write-then-confirm-then-question run is flagged — use `allow_stall: true` for a
+        deliberate confirm-terminal skill.
+    - The broad guard is therefore YOUR assertions — assert the deliverable (`file_exists` /
+      `artifact_json` / `transcript_matches`), never just `result: success`.
+    - `on_unanswered` governs **unanswered** `AskUserQuestion` gates; the `stalled` signal covers
+      stalling *after* one is answered — two different failure modes.
+    - **Free-text aside:** a "type-it-in-notes" option has **no scripted deterministic answer** today
+      (the `OTHER:` directive works only on the LLM-decider path, not scripted `choose:`; on an
+      options-bearing gate a bare out-of-set LLM answer fails loud (exit 2) — see the LLM-decider
+      free-text note in `references/fidelity-and-answers.md`).
 14. **A positional `choose` (`first` / index) is order-dependent.** `choose: "2"` survives label drift
     but NOT option *re-ordering* — if the gate presents its options in a different order run-to-run, the
     index lands on a different option (a silent re-record flake). Prefer an exact label when order is

package/.claude/skills/cowork-harness/references/ci-recipe.md

@@ -1,6 +1,6 @@
 # CI recipe — replay vs live lanes
 
-Self-contained reference. Tracks `cowork-harness 0.22.0` (baseline `desktop-1.18286.0`).
+Self-contained reference. Tracks `cowork-harness 0.23.0` (baseline `desktop-1.18286.0`).
 
 **Fastest path: the packaged Action.** One step gets you `replay`/`lint`/`verify-cassettes` plus a PR
 job-summary reporter (verdict table, staleness findings, cost/turns when available):
@@ -53,7 +53,7 @@ sha256-*checked* but not hard-blocking on mismatch — it's advisory for an inte
 GitHub-hosted runners, no token/Docker/agent:
 
 ```yaml
-- run: npm i -g cowork-harness@>=0.22.0
+- run: npm i -g "cowork-harness@>=0.23.0"
 - run: cowork-harness lint scenarios/*.yaml          # no silent false-greens
 - run: cowork-harness verify-cassettes cassettes/    # privacy + staleness
 - run: cowork-harness replay cassettes/              # token-free content/structure
@@ -128,8 +128,9 @@ dollar figures). In a skill repo these cassettes get **committed**. So:
   `_KEYS`); empty by default. Redaction is **verdict-preserving** — `record` refuses to write if
   redaction would flip an assertion (a manufactured green). `--no-redact` skips it for known-synthetic
   inputs.
-- **Always-on scan gate** — `verify-cassettes` flags email / currency / bare-domain / local-path matches
-  it finds in the committed cassettes and **exits non-zero**, so "no leak" is a gate, not discipline.
+- **Always-on scan gate** — `verify-cassettes` flags email / currency / bare-domain / local-path /
+  machine-inventory matches it finds in the committed cassettes and **exits non-zero**, so "no leak" is
+  a gate, not discipline.
   Suppress synthetic / public reference names (NVCA, Cooley GO, …) with `--allow <regex>`. (Multi-word
   proper names are NOT a default class — too noisy to gate on; add a pattern via config if your corpus
   needs it.)
@@ -178,7 +179,7 @@ jobs:
         with: { node-version: '20' }
       - uses: actions/setup-python@v5
         with: { python-version: '3.x' }                                       # python3 only — PyYAML is bundled with the linter
-      - run: npm i -g cowork-harness@>=0.22.0
+      - run: npm i -g "cowork-harness@>=0.23.0"
       - run: cowork-harness lint scenarios/*.yaml                              # no-silent-false-green (needs python3; PyYAML bundled)
       - run: cowork-harness verify-cassettes cassettes/ --output-format json   # privacy + staleness gate
       - run: cowork-harness replay cassettes/ --output-format json             # token-free content/structure
@@ -207,7 +208,7 @@ jobs:
             echo "live=true" >> "$GITHUB_OUTPUT"
           fi
       - if: steps.guard.outputs.live == 'true'
-        run: npm i -g cowork-harness@>=0.22.0
+        run: npm i -g "cowork-harness@>=0.23.0"
       - if: steps.guard.outputs.live == 'true'
         run: cowork-harness run scenarios/ --output-format json
         env:

package/.claude/skills/cowork-harness/references/fidelity-and-answers.md

@@ -1,6 +1,6 @@
 # Fidelity tiers & answer paths
 
-Self-contained reference. Tracks `cowork-harness 0.22.0` (baseline `desktop-1.18286.0`).
+Self-contained reference. Tracks `cowork-harness 0.23.0` (baseline `desktop-1.18286.0`).
 
 ## Fidelity tiers (`fidelity:` in the scenario)
 
@@ -187,5 +187,6 @@ and `scaffold` refuse to treat a partial run's half-finished output as a passing
   redact from logs (beyond the auth tokens + `ANTHROPIC_CUSTOM_HEADERS`).
 - `COWORK_HARNESS_SOFT_MISSING` — downgrade a missing mount source from hard-error to warn-and-skip.
 - `COWORK_VM_GATEWAY` / `COWORK_VM_PROXY_PORT` / `COWORK_LIMA_INSTANCE` — L2 (microVM) knobs.
-- `COWORK_LOCKDOWN` — default `on`: **aborts loudly** if the L2 guest firewall fails to apply (no
-  silent unprotected run). Set `=off` to opt out and run without isolation deliberately.
+- `COWORK_LOCKDOWN` — default `on`: gates sandbox hardening on every isolated tier — **aborts loudly**
+  if the L2 guest firewall fails to apply (no silent unprotected run), and also gates the
+  `container`/`hostloop` Docker hardening. Set `=off` to opt out and run without isolation deliberately.

package/.claude/skills/cowork-harness/references/scenario-schema.md

@@ -1,6 +1,6 @@
 # Scenario & session schema, assertion catalog, web_fetch, full gotchas
 
-Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 0.22.0`
+Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 0.23.0`
 (baseline `desktop-1.18286.0`). If your checkout is newer, prefer the live `docs/scenario.md`,
 `docs/session.md`, and `SPEC.md`.
 
@@ -61,6 +61,12 @@ skills: [report-gen]                # OPTIONAL — scope the cassette-staleness
                                     # `skills/<name>` dir under a mounted plugin-root) + the plugin's shared
                                     # roots. Fail-closed to whole-tree on an unknown name. Omit = whole tree.
 
+requires_capabilities: [ocr]        # OPTIONAL — declare a capability the skill needs (e.g. office_convert,
+                                    # ocr, pdf_tables, opencv). If the running agent image provably omits
+                                    # one, the harness ABORTS before the paid run (exit 3) — unless the
+                                    # scenario also asserts `allow_missing_capability: true`, which downgrades
+                                    # the abort to a notice and proceeds. Live tiers only.
+
 allow_host_writes: true             # OPTIONAL — required to run `hostloop` fidelity with a WRITABLE
                                     # connected folder (session `mode: rw`/`rwd`): with no container
                                     # around hostloop's native file tools, that combination gives the
@@ -80,8 +86,10 @@ session = your setup.**
 ```yaml
 # model & reasoning
 model: claude-opus-4-8           # omit for the agent default
+account_name: my-account         # OPTIONAL — which configured account/credential set to run as
 effort: high                     # low | medium | high | xhigh
 max_thinking_tokens: 31999       # positive int, or per-model map {default, <model>: <n>}; default 31999
+extended_thinking: true          # INERT — not a real Cowork toggle; use max_thinking_tokens instead
 permission_mode: default         # default | acceptEdits | plan | bypassPermissions
 permission_parity: cowork        # cowork (unscripted tool calls allowed) | strict (deny unscripted)
 
@@ -97,8 +105,9 @@ plugins:
   marketplaces: []               # plugin_marketplaces (git URLs or local paths)
   local_marketplaces: []         # local marketplace dirs (each has a marketplace.json)
   enabled: [my-skill@local]      # enabledPlugins (name@marketplace)
-  local_plugins: [./skills/my-skill]   # host plugin dirs → mnt/.local-plugins/marketplaces/<marketplace>/<plugin>
-                                       #   (≥1.14271.0; older baselines use mnt/.local-plugins/cache)
+  local_plugins: [./skills/my-skill]   # host plugin dirs → mnt/.local-plugins/marketplaces/local-desktop-app-uploads/<plugin>
+                                       #   (the marketplace segment is that fixed synthetic name; ≥1.14271.0 —
+                                       #   older baselines use mnt/.local-plugins/cache)
   remote_plugins: []
 skills:
   local: []                      # extra host skill dirs
@@ -234,7 +243,7 @@ passes only if every key passes. Keep one concern per item unless you mean conju
 | `allow_missing_capability: true` | verdict modifier — suppresses the default-fail when the (partial "core") agent image omits a capability the skill used but real Cowork ships (OCR/LibreOffice/markitdown/opencv/PDF-tables). Assert only when the skill's fallback is genuinely equivalent; otherwise rebuild full parity (`--build-arg COWORK_FULL_PARITY=1`). Also opts out of the `requires_capabilities` declared-need check. Live tiers only |
 | `allow_l0_plugin_divergence: true` | verdict modifier — opt into L0/protocol plugin divergence: suppresses the default-fail when a plugin behaves differently at `protocol` (L0) fidelity than under a sandboxed tier. Live tiers only |
 | `allow_stall: true` | verdict modifier — suppresses the `stalled` default-fail when a run ends on a question having done no productive tool work after its last gate (the agent asked for input and stopped — incl. re-asking in plain text after answering an `AskUserQuestion`); assert only when ending on a question is intended, else script the answer (`answer:` / `--answer` / a decider) |
-| `transcript_no_host_path: true` | no host path (`/Users/`, `/opt/cowork/`, `/home/`, `/root/`) leaked into model-visible text — **incompatible with `hostloop`**: its native file tools legitimately expose real host paths, so this fails BY DESIGN there (the harness warns at run start if asserted anyway); use `container`/`microvm` for this check |
+| `transcript_no_host_path: true` | no host path (`/Users/`, `/opt/cowork/`, `/home/`, `/root/`) leaked into model-visible text — **incompatible with `hostloop` AND `protocol`**: hostloop's native file tools legitimately expose real host paths, and protocol (L0) runs the agent's file tools on the real host cwd with no sealed filesystem, so this fails BY DESIGN on both (the harness warns at run start if asserted anyway); use `container`/`microvm` for this check |
 | `egress_denied: <host>` | the host was blocked by the egress proxy |
 | `egress_allowed: <host>` | the host was allowed through |
 | `artifact_json: {artifact, path, …}` | assert a JSON artifact's contents — `equals`/`gt`/`in`/`exists`/`absent`/`is_null` over a dotted `path` (`in` = membership in a list, for a stochastic/LLM value; `absent` ≠ `is_null`; an unresolved intermediate fails loud) |
@@ -372,7 +381,8 @@ at the top of this file.
    the stochastic path flags the run `nonDeterministic`. The LLM decider is one mechanism, two
    spellings: `on_unanswered: llm` (YAML) and `--decider-llm` (CLI). The bare `--on-unanswered llm`
    is rejected (use `--decider-llm`). `agent` is **retired** — `on_unanswered: agent` is rejected by
-   the schema. (`src/types.ts:276`; `src/cli.ts:652`.)
+   the schema. (`src/types.ts:365` — the `on_unanswered` enum; `src/cli.ts:899` — the CLI-side
+   `--on-unanswered` value check.)
 
 4. **`--on-unanswered first` is non-deterministic too** — it picks option 1 and is flagged
    `nonDeterministic`; not a deterministic substitute for scripted answers.

package/.claude/skills/cowork-harness/scripts/scenario.py

@@ -126,8 +126,9 @@ if UNCLASSIFIED_KEYS:
     )
 # Embedded fallback for the top-level scenario keys — kept EQUAL to the generated `topLevelKeys`
 # (test-enforced, like _CLASSIFIED_KEYS for assert keys) so a missing assertion-keys.json can't silently
-# reintroduce key drift. `profile`/`assertions` are NOT here — they are deprecated aliases handled by the
-# special-cases in the unknown-key check below (`k != "assertions" and k != "profile"`).
+# reintroduce key drift. `assertions` is NOT here — it's a hard error handled by its own special-case
+# in the unknown-key check below (`k != "assertions"`). `profile` is retired vocabulary and now falls
+# through to that same unknown-key check like any other typo — no special-case for it.
 _EMBEDDED_TOP_LEVEL_KEYS = {
     "name",
     "baseline",
@@ -260,7 +261,7 @@ def lint_doc(doc, path, raw_lines):
 
     # W: unknown top-level keys (typo or hallucinated schema)
     for k in doc:
-        if k not in TOP_LEVEL_KEYS and k != "assertions" and k != "profile":
+        if k not in TOP_LEVEL_KEYS and k != "assertions":
             findings.append(
                 Finding(
                     "WARN",
@@ -426,19 +427,28 @@ def lint_doc(doc, path, raw_lines):
 _DQ_REGEX_LINE = re.compile(
     r'^\s*-?\s*(' + "|".join(sorted(REGEX_KEYS)) + r')\s*:\s*"([^"]*\\[^"]*)"'
 )
+# A run of an EVEN number of consecutive backslashes in a double-quoted YAML scalar is a properly
+# paired escape (`\\` -> a literal `\`), so e.g. "\\d+ items" decodes to the valid regex `\d+ items` —
+# not a mistake. An ODD run leaves one backslash unpaired, which is the actual footgun (YAML either
+# eats it or errors, depending on what follows). Only flag the odd case.
+_ODD_BACKSLASH_RUN = re.compile(r"\\+")
+
+
+def _has_unpaired_backslash(s):
+    return any(len(m.group(0)) % 2 == 1 for m in _ODD_BACKSLASH_RUN.finditer(s))
 
 
 def _lint_regex_quoting(path, raw_lines):
     out = []
     for i, line in enumerate(raw_lines, start=1):
         m = _DQ_REGEX_LINE.match(line)
-        if m:
+        if m and _has_unpaired_backslash(m.group(2)):
             out.append(
                 Finding(
                     "WARN",
                     "regex-double-quoted",
-                    f"`{m.group(1)}` uses a DOUBLE-quoted regex containing a backslash "
-                    f'("{m.group(2)}") — YAML strips the backslash, so the regex is wrong.',
+                    f"`{m.group(1)}` uses a DOUBLE-quoted regex containing an unescaped backslash "
+                    f'("{m.group(2)}") — YAML strips it, so the regex is wrong.',
                     "Single-quote the regex (e.g. '\\d+') or use a block scalar. Use [\\s\\S] not . to span turns.",
                     path,
                     i,

package/AGENTS.md

@@ -39,8 +39,8 @@ protocol layer or run-loop bookkeeping in the CLI.
   gate-steering silently no-ops (the O7 bug). ELF-verified; a regression test pins it.
 - **"profile" is retired vocabulary.** Synced release ground truth = **`PlatformBaseline`** (`baseline:` /
   `baselines/`); authored setup = **`SessionConfig`** (`session:` / `sessions/`). The `profile:`
-  scenario key is retired vocabulary — still accepted as an alias for `baseline:` with a warning — do not
-  reintroduce the term.
+  scenario key is retired vocabulary — the alias is gone and it is now rejected as an unknown key — do
+  not reintroduce the term.
 - **A new assertion must pick its replay class.** *Content* assertions (read only `ctx.transcript` / the
   record) go in `src/run/cassette.ts` `contentKeys` so they run on the token-free `replay` PR gate;
   *filesystem / egress* assertions do NOT — they are excluded **by omission** from `contentKeys`, so they

package/CHANGELOG.md

@@ -6,13 +6,223 @@ All notable changes to this project are documented here. The format is based on
 
 ## [Unreleased]
 
+## [0.23.0] — 2026-07-04
+
+### Added
+
+- **The baseline `spawn.env` is now binary-derived and drift-alarmed, not hand-transcribed.** `sync`
+  enumerates the Desktop→agent spawn env directly from the `app.asar` construction (three windows +
+  gate/const value resolution) and writes the resolved map into the baseline, guarded by a
+  `checkSpawnContractFacts` sentinel over the scalar options/tools/prompt structure. Additions,
+  removals, and value changes in the spawn contract now surface as loud `sync`-time signals instead of
+  drifting silently. This closed real, already-present drift: seven env keys the production agent
+  receives (`MCP_TOOL_TIMEOUT`, `API_TIMEOUT_MS`, `CLAUDE_CODE_ENABLE_FINE_GRAINED_TOOL_STREAMING`,
+  `DISABLE_AUTOUPDATER`, `CLAUDE_CODE_EMIT_TOOL_USE_SUMMARIES`, `USE_STAGING_OAUTH`, `USE_LOCAL_OAUTH`)
+  were missing from the committed baseline and are now pinned. A hand-transcribed golden fixture
+  cross-checks the generator so a resolver bug can't silently rewrite the contract.
+- **`sync` surfaces stale-allowlist prune hints instead of discarding them.** When a
+  `SPAWN_ENV_ALLOWLIST` entry is no longer constructed anywhere in the asar, `partitionSpawnFlags`
+  routes it into `SyncResult.notes` (distinct from the hard-fail deltas above) and the CLI prints it
+  under a non-blocking `notes (non-blocking):` line — a prune candidate to review, not a drift alarm.
+- **TUI forward-compatibility set** (three items hardening the display seam for future frontends):
+  - **The display-policy seam is now an explicit contract.** `src/run/display-translate.ts`'s header
+    states it is the single policy seam for translating model-visible VM paths for human display
+    (hostloop-only / identity-without-ctx / identity-when-shareable), locked by a 20-row table-driven
+    contract test; `docs/debugging.md` explains why hostloop shows `/Users/…` while other tiers show
+    `/sessions/…`.
+  - **Per-run `mounts.json`.** Every run dir now records the VM-path context (`{v:1, sessionId,
+    effectiveFidelity, outputsHostDir, uploadsHostDir, folders}`) — best-effort, never load-bearing,
+    derived from the same call that feeds the live display translator. `loadVmPathContext` lets any
+    historical-run consumer rebuild the context (null → degrade to identity). First consumer:
+    `trace --translate-paths` (text output only) renders hostloop runs with host paths, threaded into
+    row construction pre-slice. Cassettes structurally cannot carry the file.
+  - **OSC 8 terminal hyperlinks.** On a real TTY (not CI, not `--compact`/`--demo`, opt-out
+    `COWORK_HARNESS_NO_HYPERLINKS=1`), host-shaped `computer://` links in assistant text render as
+    clickable `file://` hyperlinks (`normalizeEncodePath`, decode-then-re-encode; backtick code spans
+    and VM-shaped links pass through; tool lines are excluded — they truncate at ~80 chars and a
+    sliced URL would link to a wrong target). Piped/non-TTY output stays byte-identical.
+
+- **`machine-inventory` cassette privacy scan class.** `verify-cassettes` now flags the sentinel
+  phrases a capability-manifest recording leaks ("applications on this machine", "installed
+  integrations/apps/extensions", …) — prose mentions of an app never trip it — with a scoped
+  `--allow-machine-inventory <regex>` to whitelist provably-synthetic values. The capability-manifest
+  filter line is recognized so the manifest itself doesn't false-trip the other classes. Tightening the
+  privacy gate before the 1.0 contract freezes keeps it from becoming a breaking change to consumers'
+  committed cassettes later.
+- **The 1.0 compatibility contract (SPEC.md §12).** Enumerates the surfaces semver covers from `1.0.0` —
+  CLI commands/flags + exit codes, the scenario/session/baseline/`RunResult`/cassette(v7)/protocol
+  schemas, the documented `COWORK_HARNESS_*` (+ `COWORK_AGENT_BINARY`/`COWORK_AGENT_IMAGE`) env vars, and
+  the packaged Action's inputs/outputs — and states what is explicitly NOT covered (human-readable
+  terminal text, `trace` row shapes, the paraphrased prompt append). Cross-linked from README and
+  RELEASING.md.
+- **First committed `hostloop`-tier replay cassette + live two-tier `computer_links_resolve`
+  coverage.** `examples/replays/hostloop-computer-links.cassette.json` (from a new purpose-built
+  `fidelity: hostloop` scenario) is the first committed cassette at the newest/headline tier — the one
+  the token-free replay lane never exercised — and asserts that a `computer://` link the model shares
+  resolves to its real collected artifact. Verified live at both `container` (VM-shaped link) and
+  `hostloop` (host-shaped link); wired into CI's replay + privacy-scan gates.
+- **Host-platform / workspace-host-paths identity env vars.** The spawn env now emits
+  `CLAUDE_CODE_HOST_PLATFORM` (`process.platform`, on every tier that assembles the Cowork spawn env —
+  container/microvm/hostloop; protocol (L0) spawns with the plain base env) and `CLAUDE_CODE_WORKSPACE_HOST_PATHS`
+  (connected-folder host paths, hostloop only when folders are present) — matching what the real Cowork
+  spawn sets, binary-verified against the in-VM ELF and Desktop asar. The account-identity and `OTEL_*`
+  vars stay unset (they need live Desktop account state the headless harness can't know; documented in
+  `docs/fidelity-gaps.md`).
+- **Reserved exit code `4` on the `run`/`skill` family** for a future "needs input / surfaced question"
+  outcome — documented in SPEC.md so a later addition is additive rather than a renumbering of the
+  burned `0`/`1`/`2`/`3` space.
+
+### Removed
+
+- **The `profile:` scenario-field alias.** The top-level `profile:` key (an earlier name for
+  `baseline:`) is no longer accepted — it was silently remapped with a deprecation warning; it now
+  errors as an unknown key. Use `baseline:`.
+- **The deprecated `Profile` re-export (library API).** The `Profile` const/type in `src/types.ts` was
+  renamed to `PlatformBaseline` with a "remove next minor" promise that never fired; removed now so the
+  1.0 API contract doesn't freeze retired vocabulary in. Import `PlatformBaseline`.
+- **The `scaffold --from-run <id>` flag.** `scaffold` had two spellings for one thing; the canonical
+  positional `scaffold <run-id | run-dir>` stays, and `--from-run` now errors as an unknown flag
+  (exit 2) with the usage string pointing at the positional form.
+- **The `-V` short form for `--verbose`.** `-v` (version, per `node -v`/`npm -v`) and `-V` (verbose)
+  were a shift-key-typo collision that silently flipped meaning. `--verbose` is now long-only on every
+  command that accepts it (`run`/`skill`/`chat`/`decide`/`record`/`replay`/`verify-cassettes`); `-v`
+  still prints the version and `-q` still means `--quiet`.
+- **The dead `forceDisableHostLoop` loop-decision key.** It was never populated by `sync` and its
+  branch could never fire — a config key that silently does nothing is a trap in a 1.0 schema. The
+  field and its branch are removed (re-add with real semantics if `sync` ever derives it).
+
+### Changed
+
+- **CI's boundary job now pulls the published GHCR agent image the packaged Action pins**, retagging it
+  for the sandbox probes so a bad publish surfaces in our own CI instead of only in a consumer's runner
+  (it previously only ever `docker build`t the image locally). A pull failure now hard-fails
+  (`::error::` + `exit 1`) on the canonical repo instead of silently rebuilding; forks and pre-publish
+  runs (no GHCR read access yet) keep the local-build fallback with a warning. Live-verified on the
+  0.23.0 release PR's CI run: `docker pull ghcr.io/yaniv-golan/cowork-agent-base:2` resolved and
+  retagged successfully (image name, `linux/arm64` platform, and the default `GITHUB_TOKEN`'s GHCR
+  read access are all confirmed working, not just implemented).
+
+### Fixed
+
+- **Redaction could destroy a `computer://` link and manufacture a VACUOUS `computer_links_resolve`
+  pass on replay.** The repo's local-path redaction pattern didn't exclude `)` from its character
+  class, so it ate a markdown link's closing paren — replay's extractor then saw an unterminated link,
+  found zero links, and the presence-gated assertion passed while checking nothing (the first committed
+  hostloop cassette shipped exactly this). Three-part fix: the redaction patterns now redact only the
+  machine-specific path prefix (stopping before `/mnt/`, so replay's structural-marker resolution still
+  works) and exclude link delimiters; `record`'s verdict-preservation guard gained a fourth check that
+  compares `computer://` link counts pre/post redaction and refuses to write a cassette whose links
+  redaction destroyed; and the hostloop cassette was re-recorded — its replay now extracts and resolves
+  the link for real.
+- **Scenario-schema violations now surface as category `usage`, not `internal`.** A typo'd or retired
+  key (e.g. `profile:`) threw an uncaught Zod error that the top-level catch labeled `internal` — a
+  user mistake masquerading as a harness bug. `parseScenarioFile` now wraps schema errors in a
+  `UsageError` that names the offending file; exit stays 2.
+- **The `protocol-smoke` example no longer fails by design on a live run.** `protocol` (L0) runs the
+  agent's file tools on the real host cwd with no sealed filesystem — exactly like `hostloop` — so a
+  host path in a tool result is expected there, not a leak. The `host_path_leak` default-fail is now
+  exempted at `protocol` as well as `hostloop` (emitting a notice), so the flagship example passes its
+  own assertions on every advertised lane. The signal stays a hard fail at the sandboxed
+  `container`/`microvm` tiers (where a host path IS a regression), and an explicit
+  `transcript_no_host_path` assertion still enforces cleanliness at any tier.
+- **The LLM decider prompt no longer travels via `argv`.** `claude -p <prompt>` put the gate/skill
+  text in the process's argument vector, world-readable via `ps` on shared hosts. The prompt is now
+  delivered on stdin (the same channel the microvm auth-token uses); argv carries only
+  `-p --model … --output-format json`. Off-brand for a tool that privacy-scans its own cassettes.
+- **Malformed decider env knobs now fail loud instead of silently reverting.**
+  `COWORK_HARNESS_LLM_TIMEOUT_MS` / `COWORK_HARNESS_LLM_MAX_BYTES` went through `Number(…) || default`,
+  so a typo (`5m`) or an explicit `0` silently became the default. Both now route through
+  `envPositiveNumber`, which warns loud on a set-but-unparseable/non-positive value (an unset var still
+  uses the same default).
+- **The bundled `cowork-harness` skill's CI recipe no longer breaks under bash/zsh.** The recommended
+  `npm i -g cowork-harness@>=0.22.0` was unquoted — `>=` is a shell redirection, so the snippet failed
+  as written in bash (GitHub Actions' default `run:` shell) and zsh alike. Now quoted at all sites. Same pass corrected the skill's command inventory (`status` was
+  missing), a wrong `CLAUDE_PLUGIN_ROOT` scaffold path, missing `requires_capabilities` /
+  `extended_thinking` / `account_name` schema docs, stale gotcha citations, a `scenario.py` regex-lint
+  false-positive, and thin eval coverage.
+- **`doctor --tier microvm` now detects an unprovisioned Lima instance.** It previously checked only
+  for `limactl` itself, not whether `vm init` had actually provisioned the instance for the current
+  config — a missing VM image could slip past `doctor` and only surface as first-run VM-boot latency
+  on the next live `microvm` run (which self-provisions). New `vm-instance` check is advisory (`warn`,
+  non-blocking, matching `microvm.ts`'s self-provisioning behavior), skipped when `limactl` itself is
+  already the reported problem. Live-verified against a real, unprovisioned Lima install.
+- **Top-level `--help` printed an invalid combined flag shorthand.** `--allow-domain/-email/-path
+  <regex>` is not something the parser accepts — the three flags are independent and parsed
+  separately (`verify-cassettes`'s own usage string already had this right). Fixed to list the three
+  flags separately, matching the dedicated usage string.
+
+### Documentation
+
+- **Documented the Task-dispatch cap divergence in `docs/fidelity-gaps.md`.** Real Cowork skips agent
+  Task dispatches beyond `{perTask:1, global:3}` (a binary-verified gate); the harness does not cap at
+  runtime, mitigated by the `dispatch_count_max` assertion. The faithful runtime limiter is deferred
+  post-1.0.
+- **Doc-vs-code audit (post-0.22.0) — corrected several doc claims that had drifted from the
+  implementation, found by a systematic docs-and-skill sweep.**
+  - **Baseline pin staleness.** README, DESIGN.md, SPEC.md, the companion skill's `SKILL.md`, and
+    `docs/cowork-spawn-contract-1.12603.1.md` all still pinned `desktop-1.17377.1`/`.2` after the
+    platform baseline had moved on to `desktop-1.18286.0`. Reconciled the plain "current baseline"
+    pins; deliberately left DESIGN.md's point-in-time verification stamps (§ Control protocol /
+    Spawn contract) untouched, since bumping those would assert re-verification work that hasn't
+    actually happened. README's "Status" paragraph had the same unresolved tension one section
+    down (claiming `1.18286.0` is latest two sentences after a `1.17377.1` verification stamp) —
+    added a clarifying parenthetical instead of silently picking one number.
+  - **`docs/chat.md` self-contradiction.** Its `--folder` behavior rows named `protocol`/`container`/
+    `microvm` in two places despite `chat` never accepting `microvm` (already correctly excluded
+    elsewhere in the same file).
+  - **`docs/cassette.md`'s assertion table** was missing six replay-evaluated keys (`skill_triggered`,
+    `no_skill_triggered`, `max_cost_usd`, `max_tokens`, `tool_calls_max`, `max_turns`) despite already
+    documenting all six correctly in `docs/scenario.md`.
+  - **`docs/session.md`** never documented the real, live `account_name` session field.
+  - **`docs/scenario.md`'s `run --matrix` example** pointed `skill_dirs` at a fabricated
+    `../variants/v1/…` path that doesn't exist anywhere in the repo. Repointed the section at the new
+    `examples/matrices/csv-metrics-matrix.yaml` fixture (baselines-only axis — this repo has no second
+    `csv-metrics` variant to matrix against, so the shipped example omits `skill_dirs` rather than
+    inventing fake paths).
+  - **`docs/discovery.md`** left the `<proj-slug>` placeholder in its "find the VM session log" path
+    unexplained. Documented what it is (Claude Code's own project-slug derivation, opaque to this
+    repo) and gave a practical `ls`-based workaround instead of guessing at undocumented CLI internals.
+  - **Doc-index and cross-link gaps.** `docs/README.md`'s guide table and `llms.txt`'s command list
+    were both missing `stats`/`status`/`diff`; the `decide` reference row cited only `decide --help`
+    despite a full worked "dry-running a decider" subsection already existing in `docs/scenario.md`;
+    the README architecture diagram had no `hostloop` representation; `docs/maintenance.md`'s
+    `sync --diff` example (real but the two oldest baseline files in the repo) wasn't flagged as
+    illustrative; and README's `doctor` section read as if bare `doctor` were more general than
+    `--tier container`, when bare `doctor` **is** `--tier container` by default.
+  - **README command-table / flag-reference gaps.** `--compact`/`--demo` (output trimmed for
+    shareable screenshots/GIFs) were undocumented in the `skill`/`run` command-table rows;
+    `record`'s row omitted `--no-redact`/`--allow-failing`/`--dry-run`; the reproducibility-knobs
+    section omitted `COWORK_HARNESS_VERIFY_AGENT_SHA`; the exit-code summary claimed a uniform
+    `0`/`1`/`2`/`3` "on every command" when `diff`/`lint` have documented per-command exceptions
+    (SPEC.md already had the accurate table — README's summary now points at it instead of
+    overstating); and a note was added near the Prerequisites block that the worked
+    `examples/scenarios/...` commands need a source checkout, not a global `npm install -g`.
+  - Added **`examples/matrices/csv-metrics-matrix.yaml`**, a worked example for `run --matrix` (no
+    prior fixture existed) — live-verified: both baseline cells pass.
+
+### Internal
+
+- **`scripts/check-versions.ts`'s version-lockstep guard now also cross-checks the `(baseline
+  desktop-X)` pins** across README/`SKILL.md`/the spawn-contract doc against the newest committed
+  `baselines/*.json`, closing the exact class of drift the doc audit above found so it can't silently
+  recur. Deliberately excludes DESIGN.md's verification-stamp lines (see above).
+  - `alwaysContentKeys`/`questionGateKeys`/`manifestKeys` in `src/run/cassette.ts` are now exported
+    (previously function-local); `test/cassette-docs-sync.test.ts` asserts `docs/cassette.md`'s
+    assertion table stays in sync with their union.
+  - `test/cli-help.test.ts` gained a check that every CLI command appears in README's "Commands at a
+    glance" table, on the same "doc can't silently drift from code" principle.
+- **`test/vm-path-ctx-file.test.ts` gained a structural cassette-privacy regression test.** Asserts
+  the committed `examples/replays/example-pdf-skill.cassette.json`'s top-level key set is closed and
+  contains no `mount`-named field — guards the cassette assembler itself (not just `buildManifest`'s
+  walk scope), so a future edit that adds a mounts-bearing field to the cassette literal is caught
+  without needing a live re-record.
+
 ## [0.22.0] — 2026-07-03
 
 ### Added
 
 - **`computer://` link modeling — the prompt now instructs file links exactly as production does.**
-  Four pieces landed together (design + binary research in
-  `docs/internal/2026-07-03-computer-link-scheme-research-and-plan.md`):
+  Four pieces landed together, grounded in binary research against the Desktop app:
   - `src/vm-paths.ts` — a faithful port of Desktop's display-side VM→host path transform
     (`deepTranslateVMPaths` / `mapVMPathToHostPath` / `encodeComputerUrlsForHostLoop`): markdown-link,
     backtick, bare-token, and prose rewrite positions; per-segment percent-encoding; traversal
@@ -558,7 +768,7 @@ All notable changes to this project are documented here. The format is based on
   sandboxed live tiers (protocol/replay need none); added `python3` to the README requirements
   (the `lint` linter shells out to it); moved the `/plugin` slash-command block off the `bash`
   fence; pinned `cowork-harness@>=0.17.0` in the CI recipe; noted that `chat` excludes
-  `microvm`/`cowork`; and other small corrections (see `docs/internal/2026-06-26-doc-audit-*`).
+  `microvm`/`cowork`; and other small corrections from a full documentation audit.
 - Refreshed all verification/version stamps that still pinned `1.15200.0` / `2.1.181`
   (README, DESIGN, SPEC, the spawn-contract reference, `docs/cassette.md` fingerprint example,
   and the `hostloop-prompt.ts` re-verified comment) to `1.15962.0` / `2.1.187`.
@@ -1418,7 +1628,7 @@ All notable changes to this project are documented here. The format is based on
 
 ### Internal
 
-- The npm tarball no longer ships `docs/internal/` (internal planning docs were being published).
+- The npm tarball no longer ships internal planning notes that were accidentally being published.
 
 ### Added
 

package/DESIGN.md

@@ -1,6 +1,6 @@
 # DESIGN — parity model, deltas, and the maintenance contract
 
-This document is the reference for *how faithful* each tier is, *what we deliberately don't reproduce*, and *why the chosen seams keep parity cheap to maintain*. Everything here is grounded in analysis of the live Claude Desktop `app.asar` (spawn contract and gates first verified at build 1.12603.1; updated through build 1.17377.1 — volatile fields tracked in `baselines/desktop-1.17377.1.json`) and the on-disk runtime state on macOS.
+This document is the reference for *how faithful* each tier is, *what we deliberately don't reproduce*, and *why the chosen seams keep parity cheap to maintain*. Everything here is grounded in analysis of the live Claude Desktop `app.asar` (spawn contract and gates first verified at build 1.12603.1; updated through build 1.18286.0 — volatile fields tracked in `baselines/desktop-1.18286.0.json`) and the on-disk runtime state on macOS.
 
 > **Just want to pick a tier or write a scenario?** This doc is the *why*. For the *how*, start at the
 > [README](./README.md) (tiers, quick start) and [docs/](./docs/README.md) (scenario/session reference).
@@ -187,6 +187,6 @@ The full Desktop→agent spawn contract (cwd `/sessions/<id>`, `CLAUDE_CONFIG_DI
 
 - `fidelity: container | microvm` → **VM-loop** (the whole agent in the sandbox).
 - `fidelity: hostloop` → **host-loop**: the agent LOOP is a **native process spawned directly on the host** (Desktop stages this same native macOS binary alongside the Linux/arm64 ELF the other tiers use), with native Bash/WebFetch disabled (`--disallowedTools`) and the agent's shell routed through the **workspace SDK-MCP server** — declared via `sdkMcpServers:["workspace"]` in the `initialize` handshake, with the driver (`src/agent/session.ts` + `src/hostloop/workspace-handler.ts`) handling `mcp_message` JSON-RPC and executing `bash` via `docker exec` into a VM sidecar container (no agent runs inside it) at `/sessions/<id>/mnt`. `${CLAUDE_PLUGIN_ROOT}` for the native process points at the staged plugin copy directly (a real host path); bash's `docker exec` still gets an intentionally-unresolvable sentinel so it self-heals via `find /sessions/<id>/mnt …`, exactly like production. Connected folders are bind-mounted (never copied) into both the native process's view and the VM sidecar, so the native file tools and bash see the same bytes. With no container around the native file tools, a PreToolUse hook (`src/hostloop/pretooluse-path-hook.ts`, a byte-faithful port of production's own containment check) is the security boundary for real filesystem access — see [docs/boundary.md](./docs/boundary.md) for the full safety posture (writable-folder consent, the runtime tripwire).
-- `fidelity: cowork` → **auto-picks** host-loop vs VM-loop using Cowork's own decision logic (`src/loop-decision.ts`, an exact replica of Desktop's minified `f_()` loop-decision function): `requireFullVmSandbox || forceDisableHostLoop ? vm : (dev override ? host : gate 1143815894)`. With the synced gate forced on, `cowork → hostloop`. (The replicated `f_()` **decision shape** is pinned to asar 1.12603.1 per `src/loop-decision.ts`; the 1.15200.0→1.15962.0 sync re-derives only the **gate value** it reads, not the logic.)
+- `fidelity: cowork` → **auto-picks** host-loop vs VM-loop using Cowork's own decision logic (`src/loop-decision.ts`, an exact replica of Desktop's minified `f_()` loop-decision function): `requireFullVmSandbox ? vm : (dev override ? host : gate 1143815894)`. With the synced gate forced on, `cowork → hostloop`. (The replicated `f_()` **decision shape** is pinned to asar 1.12603.1 per `src/loop-decision.ts`; the 1.15200.0→1.15962.0 sync re-derives only the **gate value** it reads, not the logic.)
 
 The **bash-visible world is identical** in both (`/sessions/<id>/mnt/...`); the agent-loop world differs (`${CLAUDE_PLUGIN_ROOT}` resolution, the shell tool). Use `hostloop` (or `cowork`) for production-faithful skill testing; `container` for fast VM-loop.