cowork-harness 0.28.0 → 0.29.0

package/.claude/skills/cowork-harness/SKILL.md

@@ -3,8 +3,8 @@ name: cowork-harness
 description: Test or debug a Claude Code skill/plugin under Claude Cowork's runtime — sandboxed agent, default-deny egress, the can_use_tool permission/question protocol — using the cowork-harness CLI. Use when validating or regression-testing a skill, authoring or debugging a scenario YAML (prompt + scripted answers + assert:), choosing a fidelity tier, scripting AskUserQuestion / tool-permission answers, or asserting artifacts, egress, or sub-agent dispatch. Especially when a harness run no-ops an assertion, fails on an unanswered gate, false-greens, a steered answer never reaches the model, or a web_fetch is unexpectedly denied or gated. NOT for generic unit testing (pytest/vitest of your own scripts) or non-Cowork CI. Covers the skill / run / chat / record / replay / trace / decide / assertions / scaffold commands and the session-vs-scenario split.
 metadata:
   author: cowork-harness
-  version: 0.28.0
-  tracks-harness: cowork-harness 0.28.0 (baseline desktop-1.19367.0)
+  version: 0.29.0
+  tracks-harness: cowork-harness 0.29.0 (baseline desktop-1.20186.0)
 ---
 
 # cowork-harness
@@ -22,8 +22,8 @@ flagged with a loud `::warning::`, not silent — auto-answer a gate, observe an
 allowlist). This skill exists mostly to keep you out of those traps — the Gotchas section below is
 the highest-value part. Read it.
 
-> **Version note:** the facts and `file:line` pointers here track `cowork-harness 0.28.0` (baseline
-> `desktop-1.19367.0`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
+> **Version note:** the facts and `file:line` pointers here track `cowork-harness 0.29.0` (baseline
+> `desktop-1.20186.0`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
 > `SPEC.md` / `docs/*.md` over this snapshot, and re-run the bundled linter.
 
 ## Preflight — make sure the harness can actually run
@@ -38,7 +38,7 @@ cowork-harness skill ./my-skill "do X"      # run the skill once against the sta
 Before the first command, confirm the CLI is reachable and **fail loud** (never fake a pass) when a tier's dependencies are missing:
 
 - **One-shot check.** Run `cowork-harness doctor [--tier <tier>]` first — a read-only prerequisite check that inspects Docker, the staged agent, the token, and the baseline in one pass. The bullets below explain each thing it checks (and how to fix it).
-- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 0.28.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@>=0.28.0" <cmd>` (Node ≥ 20), or install once with `npm i -g "cowork-harness@>=0.28.0"`. **Pin `@>=0.28.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published. (≥ 0.28.0 is what gates the commands/assertions this skill teaches: `assertions --list`, `scaffold <run-id>`, `trace --view dispatches`, `artifact_json` incl. the `in:` operator (passes when the resolved value deep-equals one of the listed members — value ∈ your list, not the reverse), `verify-cassettes`, batch `record <dir>`/`--rerecord-stale`, `record --concurrency <N>`, record-time redaction, multiSelect/`answer:`, `verify-run` answer-coverage, `record --max-artifact-bytes`, live record-time deciders, `verify-cassettes --allow-domain`/`--allow-email`/`--allow-path`/`--allow-patterns-file` (`path` — local absolute filesystem paths — is the scanner's 4th class, new in 0.21.0; `--allow-patterns-file <path>` is a FILE of patterns, one regex per line — not a path to allow, unlike `--allow <regex>`), scenario `skills:` staleness scoping with `COWORK_HARNESS_AGENT_SCOPE=skill`, `chat --plugin`, `/help` in the REPL, `hostloop`'s native host/VM process split with its `allow_host_writes:` consent field, `computer_links_resolve` (new in 0.22.0), and `semantic_matches` (an LLM judge grades a fixed `rubric` of claims against the run's answer — **live-only**, so it is evidence-unavailable / skipped-loud on replay, never a vacuous pass; new in 0.27.0), and **glob-matched** `tool_called`/`tool_not_called`/`subagent_tool_used`/`subagent_tool_absent` (a pattern like `mcp__workspace__*` matches any tool in the family; exact names match exactly; new in 0.28.0).)
+- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 0.29.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@>=0.29.0" <cmd>` (Node ≥ 20), or install once with `npm i -g "cowork-harness@>=0.29.0"`. **Pin `@>=0.29.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published. (≥ 0.29.0 is what gates the commands/assertions this skill teaches: `assertions --list`, `scaffold <run-id>`, `trace --view dispatches`, `artifact_json` incl. the `in:` operator (passes when the resolved value deep-equals one of the listed members — value ∈ your list, not the reverse), `verify-cassettes`, batch `record <dir>`/`--rerecord-stale`, `record --concurrency <N>`, record-time redaction, multiSelect/`answer:`, `verify-run` answer-coverage, `record --max-artifact-bytes`, live record-time deciders, `verify-cassettes --allow-domain`/`--allow-email`/`--allow-path`/`--allow-patterns-file` (`path` — local absolute filesystem paths — is the scanner's 4th class, new in 0.21.0; `--allow-patterns-file <path>` is a FILE of patterns, one regex per line — not a path to allow, unlike `--allow <regex>`), scenario `skills:` staleness scoping with `COWORK_HARNESS_AGENT_SCOPE=skill`, `chat --plugin`, `/help` in the REPL, `hostloop`'s native host/VM process split with its `allow_host_writes:` consent field, `computer_links_resolve` (new in 0.22.0), and `semantic_matches` (an LLM judge grades a fixed `rubric` of claims against the run's answer — **live-only**, so it is evidence-unavailable / skipped-loud on replay, never a vacuous pass; new in 0.27.0), and **glob-matched** `tool_called`/`tool_not_called`/`subagent_tool_used`/`subagent_tool_absent` (a pattern like `mcp__workspace__*` matches any tool in the family; exact names match exactly; new in 0.28.0).)
 - **Agent binary (sandboxed live tiers — `container`/`microvm`/`hostloop`/`cowork`).** The staged Claude Code agent is **bind-mounted** from a local Claude Desktop install, or point `COWORK_AGENT_BINARY` at a `claude-code-vm/<ver>/claude` ELF. Nothing is bundled. `protocol` (L0) and `replay` need no staged agent; for the sandboxed tiers, no agent → no run; report that, don't skip silently.
 - **Docker / Lima.** Only `--fidelity protocol` (L0) runs without them. `container` / `microvm` / `hostloop` / `cowork` need Docker (Lima for L2). If they're absent, drop to `--fidelity protocol` and **say so** — a green that never exercised the sandbox is not a sandbox pass.
 - **Auth.** `CLAUDE_CODE_OAUTH_TOKEN` (preferred) or `ANTHROPIC_API_KEY`, via env or `.env`. Minting an OAuth token needs the **`claude` CLI** (`npm i -g @anthropic-ai/claude-code`, then `claude setup-token`).
@@ -63,7 +63,7 @@ reproducible regression (Part II), and **debug** a run that misbehaved or greene
   the path, `trace <run-id>` finds it). **Localize the failure post-hoc** from that evidence:
   `cowork-harness trace <run-dir>`'s views + the emitted `result.json` to see what the run actually did,
   then `verify-run` to re-check a suspect assertion — all token-free, no Docker, no re-record. This is
-  the loop 0.28.0's observability is built for; the *Triage* and *Inspecting a run's observability
+  the loop 0.29.0's observability is built for; the *Triage* and *Inspecting a run's observability
   output* sections in **Part III — Debug** are the detail (the fuller human-facing map lives in
   `docs/debugging.md` — repo-only, not shipped with the installed skill).
 - **Multi-turn / interactive reproduction** → `cowork-harness chat` (interactive; gates answered at the
@@ -206,7 +206,7 @@ them by what you're trying to prove:
 | a skill actually **ran** (or must NOT) | `skill_triggered: <regex>`, `no_skill_triggered: <regex>` |
 | a tool ran **inside** a skill's scope | `skill_tool_used: {skill, tool}` |
 | a sub-agent did the work | `subagent_output_contains: {contains}`, `subagent_dispatched: <regex>`, `dispatch_count_max: <N>` |
-| a pre-existing input wasn't mutated | `input_unmodified: [<glob>]` (live/verify-run; not microvm) |
+| a pre-existing input wasn't mutated (incl. `uploads/**`) | `input_unmodified: <glob>` or `[<glob>, …]` (live/verify-run; not microvm) |
 | a resource ceiling held | `max_peak_rss_bytes: <N>` (**live-only**) |
 | a hook blocked / didn't block a tool | `hook_blocked: <regex>`, `no_hook_blocked: true` (replay needs a `controlOut` cassette) |
 | every MCP round-trip succeeded | `no_mcp_error: true` (**live-only**) |
@@ -421,13 +421,23 @@ decide which assertions from *Assertions: two orthogonal axes* are worth adding)
   `tokens`, `cache-tokens`, `model-cost`, `turns`, `pass-rate`.
 - **`result.json` carries the raw fields** the assertions read: `toolDurations`, `models`, `toolErrors`,
   `redundantToolCalls`, `modelUsage`, `thinking`, `skillActivity`, `subagents[]` (prompt/model/output/
-  `attributedSkillId`), `context` (tools/mcpServers/availableSkills), `tasks`, `workspaceFiles`,
-  `presentedFiles`, `hookEvents`, `mcpErrors`, `contextEvents`, `resources`. (Full per-field semantics:
-  the README's "Observability fields" section — repo-only; `schema/run-result.json` is the machine
-  source.)
+  `attributedSkillId`, `outputTruncated`), `context` (tools/mcpServers/availableSkills), `tasks`,
+  `workspaceFiles`, `presentedFiles`, `hookEvents`, `mcpErrors`, `contextEvents`, `resources`
+  (`probeFailures` distinguishes a failed sample from a tier that was never sampleable). Provenance/
+  evidence-health fields: `command` (`run`/`skill`/`record`/`chat`/`replay` — finer than `mode`),
+  `gateProvenance` (per-gate `scripted`/`decided(llm|external)`/`first-option`/`prompt` with a
+  `bySource` histogram), `evidenceErrors` (dropped/malformed telemetry lines per stream, incl.
+  `egressParse`), `fingerprint.frozen` (replay only — marks the shown staleness fingerprint as the
+  cassette's record-time value, not a fresh recompute), and `assertTextTruncated` (companion to
+  `outputTruncated` on a matched tool result). (Full per-field semantics: the README's "Observability
+  fields" section — repo-only; `schema/run-result.json` is the machine source.)
 - **Opaque failure?** A failed run also records **`errorSource`** (where the failure originated) and
   **`stderrLogPath`** (the captured agent stderr) — read those and `trace <run-dir>` *before* re-running;
-  a re-record rarely tells you more than the captured stderr already does.
+  a re-record rarely tells you more than the captured stderr already does. Also check
+  **`resultErrorKind`** (`"transport" | "agent" | "usage_limit"`) before spending another paid run: a
+  `"usage_limit"` failure is a quota exhaustion, not a skill bug — retry after the limit resets rather
+  than debugging; `"transport"`/`"agent"` means something actually broke, worth localizing before
+  re-running.
 - **Attributing cost to sub-agent work.** `subagents[]` gives the dispatch tree — each sub-agent's
   `model`, `toolsUsed`, `prompt`/`output`, and `attributedSkillId` — but **not** its own token/cost;
   aggregate cost is per-**model** in `modelUsage` (and `trace --view usage`), not per-sub-agent. So a

package/.claude/skills/cowork-harness/references/ci-recipe.md

@@ -1,6 +1,6 @@
 # CI recipe — replay vs live lanes
 
-Self-contained reference. Tracks `cowork-harness 0.28.0` (baseline `desktop-1.19367.0`).
+Self-contained reference. Tracks `cowork-harness 0.29.0` (baseline `desktop-1.20186.0`).
 
 **Fastest path: the packaged Action.** One step gets you `replay`/`lint`/`verify-cassettes` plus a PR
 job-summary reporter (verdict table, staleness findings, cost/turns when available):
@@ -54,7 +54,7 @@ sha256-*checked* but not hard-blocking on mismatch — it's advisory for an inte
 GitHub-hosted runners, no token/Docker/agent:
 
 ```yaml
-- run: npm i -g "cowork-harness@>=0.28.0"
+- run: npm i -g "cowork-harness@>=0.29.0"
 - run: cowork-harness lint scenarios/*.yaml          # no silent false-greens
 - run: cowork-harness verify-cassettes cassettes/    # privacy + staleness
 - run: cowork-harness replay cassettes/              # token-free content/structure
@@ -188,7 +188,7 @@ jobs:
         with: { node-version: '20' }
       - uses: actions/setup-python@v5
         with: { python-version: '3.x' }                                       # python3 only — PyYAML is bundled with the linter
-      - run: npm i -g "cowork-harness@>=0.28.0"
+      - run: npm i -g "cowork-harness@>=0.29.0"
       - run: cowork-harness lint scenarios/*.yaml                              # no-silent-false-green (needs python3; PyYAML bundled)
       - run: cowork-harness verify-cassettes cassettes/ --output-format json   # privacy + staleness gate
       - run: cowork-harness replay cassettes/ --output-format json             # token-free content/structure
@@ -217,7 +217,7 @@ jobs:
             echo "live=true" >> "$GITHUB_OUTPUT"
           fi
       - if: steps.guard.outputs.live == 'true'
-        run: npm i -g "cowork-harness@>=0.28.0"
+        run: npm i -g "cowork-harness@>=0.29.0"
       - if: steps.guard.outputs.live == 'true'
         run: cowork-harness run scenarios/ --output-format json
         env:

package/.claude/skills/cowork-harness/references/fidelity-and-answers.md

@@ -1,6 +1,6 @@
 # Fidelity tiers & answer paths
 
-Self-contained reference. Tracks `cowork-harness 0.28.0` (baseline `desktop-1.19367.0`).
+Self-contained reference. Tracks `cowork-harness 0.29.0` (baseline `desktop-1.20186.0`).
 
 ## Fidelity tiers (`fidelity:` in the scenario)
 

package/.claude/skills/cowork-harness/references/scenario-schema.md

@@ -1,7 +1,7 @@
 # Scenario & session schema, assertion catalog, web_fetch, full gotchas
 
-Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 0.28.0`
-(baseline `desktop-1.19367.0`). If your checkout is newer, prefer the live `docs/scenario.md`,
+Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 0.29.0`
+(baseline `desktop-1.20186.0`). If your checkout is newer, prefer the live `docs/scenario.md`,
 `docs/session.md`, and `SPEC.md`.
 
 **Minimal scenario** — `prompt` is the only required field:
@@ -245,18 +245,18 @@ same set live from the schema.
 | `file_exists: <path>` | the path exists under the run's `work/` (anchored at `mnt/`, e.g. `outputs/x.md`). For a user-facing deliverable prefer `user_visible_artifact` — with a connected folder the file lands in `mnt/<folder>` (= `{{workspaceFolder}}`), not `mnt/outputs`, so `file_exists: outputs/x.md` misses it |
 | `user_visible_artifact: <path>` | exists **and** under a user-visible root (`outputs/` + each connected folder's mount name) — the right primitive for a workspace deliverable when a folder is connected |
 | `no_delete_in_outputs: true` | no delete op touched `mnt/outputs` — **only `true` is valid**; `false` is rejected (omit to allow deletes) |
-| `no_unexpected_files: [<glob>, …]` | every **newly created** file under a user-visible root matches ≥1 glob (workRoot-relative paths; `**` = whole path segment for any depth — use `outputs/handoff/**` for per-run subdirs); `[]` = no new files; **new-files-only** — overwriting a pre-existing file in place is invisible (use content-level producer stamping); live/verify-run without a pre-run manifest ⇒ evidence-unavailable hard-fail (live runs capture the baseline only when this key is asserted; recordings always capture); **microvm cannot capture** (use container/hostloop); replay needs `cassette.preRunPaths` (≥0.24 container/hostloop recordings) — cassettes without it **exclude** the key with a loud warning |
-| `input_unmodified: [<glob>, …]` | every **pre-existing** file whose workRoot-relative path matches ≥1 glob keeps an unchanged content hash after the run — the in-place-mutation companion to `no_unexpected_files`'s new-files check (`[]` is rejected by the schema — list at least one glob); a matched file that was deleted counts as a content change (fails); live/verify-run without a pre-run hash manifest ⇒ evidence-unavailable hard-fail; **microvm cannot capture**; replay needs `cassette.preRunHashes` — cassettes without it **exclude** the key with a loud warning; on replay it compares against the manifest's recorded `sha256`, never a re-hash of the materialized tree |
+| `no_unexpected_files: [<glob>, …]` | every **newly created** file under a user-visible root matches ≥1 glob (workRoot-relative paths; `**` = whole path segment for any depth — use `outputs/handoff/**` for per-run subdirs); `[]` = no new files; **new-files-only** — overwriting a pre-existing file in place is invisible (use content-level producer stamping); live/verify-run without a pre-run manifest ⇒ evidence-unavailable hard-fail (live runs capture the baseline only when this key is asserted; recordings always capture); an **incomplete post-run filesystem walk** (an unreadable subtree — a permission/I-O error) also fails evidence-unavailable rather than reporting "no strays" over a partial tree — distinct from the missing-manifest/microvm case, which fails for a different reason; **microvm cannot capture** (use container/hostloop); replay needs `cassette.preRunPaths` (≥0.24 container/hostloop recordings) — cassettes without it **exclude** the key with a loud warning |
+| `input_unmodified: <glob>` or `[<glob>, …]` | a single glob or a list; every **pre-existing** file (incl. uploaded files under `uploads/**`) whose workRoot-relative path matches ≥1 glob keeps an unchanged content hash after the run — the in-place-mutation companion to `no_unexpected_files`'s new-files check (`[]` is rejected by the schema — list at least one glob); a matched file that was deleted counts as a content change (fails); live/verify-run without a pre-run hash manifest ⇒ evidence-unavailable hard-fail; **microvm cannot capture**; replay needs `cassette.preRunHashes` — cassettes without it **exclude** the key with a loud warning; on replay it compares against the manifest's recorded `sha256`, never a re-hash of the materialized tree |
 | `self_heal_ran: <bool>` | a plugin-root self-heal script was (not) invoked |
-| `tool_called: <glob>` | a tool the agent ran matched this **glob** — `*` = any run, `?` = one char, exact when literal, anchored + case-sensitive. Exact name (`Write`) matches only that tool; `mcp__workspace__*` matches any workspace tool. GLOB, not regex (`.` is literal; `.*`/`\|` match nothing → warned) |
-| `tool_not_called: <glob>` | NO tool the agent ran matched this glob (`mcp__*` = "no MCP tool ran"). Same glob semantics as `tool_called` |
+| `tool_called: <glob>` | a tool the agent ran matched this **glob** — `*` = any run, `?` = one char, exact when literal, anchored + case-sensitive. Exact name (`Write`) matches only that tool; `mcp__workspace__*` matches any workspace tool. GLOB, not regex (`.` is literal) — an empty glob, or one containing a regex/brace-expansion metacharacter (`.*`, `.+`, `\|`, `()`, `[]`, `+`, `^`, `$`, `{}`, `\d`/`\w`/`\s`/`\b`), is **rejected at load** (a hard schema error, not a runtime warning) — it would match no real tool name and pass a `_not_`/`_absent` assert vacuously. Applies whether the glob comes from an authored scenario or a recorded cassette's frozen assert. The bundled `scenario.py lint` does NOT perform this check — only the harness enforces it, at actual load (`run`/`skill`/`record`) |
+| `tool_not_called: <glob>` | NO tool the agent ran matched this glob (`mcp__*` = "no MCP tool ran"). Same glob semantics as `tool_called`, including the empty/regex-ish rejection |
 | `tool_result_contains: <str>` | a tool result includes the literal string (content / replay-checkable — substring match) |
 | `tool_result_not_contains: <str>` | no tool result includes the literal string (content / replay-checkable; fails loud when tool results are absent) |
-| `subagent_tool_used: <glob>` | a sub-agent used a tool matching this glob (same `*`/`?`, anchored, case-sensitive semantics as `tool_called`) |
-| `subagent_tool_absent: <glob>` | no sub-agent used a tool matching this glob |
+| `subagent_tool_used: <glob>` | a sub-agent used a tool matching this glob (same `*`/`?`, anchored, case-sensitive semantics as `tool_called`, including the empty/regex-ish rejection) |
+| `subagent_tool_absent: <glob>` | no sub-agent used a tool matching this glob (same rejection) |
 | `subagent_dispatched: <regex>` | a sub-agent whose `agentType` **or dispatch description** matches |
 | `subagent_declared_but_unused: <Tool>` | a sub-agent declared the tool but never used **that** tool (even if it used others) |
-| `subagent_output_contains: {match?, contains}` | a dispatched sub-agent's own output contains the substring `contains` — `match` (optional regex over `agentType`/`description`) narrows to specific dispatch(es); omitted, checks whether ANY dispatch's output contains it (existence check, not "all") |
+| `subagent_output_contains: {match?, contains}` | a dispatched sub-agent's own output contains the substring `contains` — `match` (optional regex over `agentType`/`description`) narrows to specific dispatch(es); omitted, checks whether ANY dispatch's output contains it (existence check, not "all"); a miss against an output that was **truncated at the assert cap** reports evidence-unavailable instead of a proven absence — the substring could lie past the cut |
 | `dispatch_count_max: <N>` | at most N sub-agents dispatched — an author-chosen budget (Cowork imposes no in-conversation Task-dispatch cap; records only, enforces nothing — see gotcha 12) |
 | `skill_triggered: <regex>` | a skill matching the regex (invoked id, e.g. `"plugin:skill"`) was invoked via the `Skill` tool — evidence-unavailable (not a normal fail) if the agent's init tools have no `Skill` tool |
 | `no_skill_triggered: <regex>` | no invoked skill id matched — the negative-control / description-collision catcher; evidence-unavailable (never a vacuous pass) if invocation data is absent or the `Skill` tool is unobservable |
@@ -268,7 +268,7 @@ same set live from the schema.
 `subagent_tool_used`, `subagent_tool_absent` are **glob** (anchored, case-sensitive, `*`/`?`). `tool_available`,
 `skill_triggered`/`no_skill_triggered`, `skill_available`, `connector_available`, `skill_tool_used`,
 `subagent_type` are **regex** (unanchored, case-insensitive). So `tool_called: mcp__workspace__*` (glob) but
-`tool_available: mcp__workspace__.*` (regex) — a `.*` in a `tool_called` glob matches nothing and is warned.
+`tool_available: mcp__workspace__.*` (regex) — a `.*` in a `tool_called` glob is a load-time schema error, not silently-matches-nothing.
 | `skill_tool_used: {skill, tool}` | a tool whose name matches `tool` ran inside a skill-activation window whose `skillId` matches `skill` (`RunResult.skillActivity`) — evidence-unavailable if skill-activity telemetry is absent; heuristic for inline skills (a sticky, sequential window matching the agent's `activeSkill` scope, not an exact per-tool boundary) |
 | `max_cost_usd: <N>` | the run's SDK-reported cost is ≤ N USD — evidence-unavailable if cost telemetry is absent. **Replay asserts the frozen recording's cost, not fresh spend** — a real regression needs a live `run` |
 | `max_tokens: <N>` | `usage.input_tokens + usage.output_tokens` ≤ N (cache tokens excluded) — same replay caveat as `max_cost_usd` |
@@ -281,7 +281,7 @@ same set live from the schema.
 | `compaction_occurred: true` | a context-compaction boundary occurred (a `compact_boundary` system event was recorded) — lives in the stdout stream, so meaningfully replay-checkable; evidence-unavailable if context-event telemetry is absent. **Only `true` is valid** — omit to not require it |
 | `all_tasks_completed: true` | every task in `RunResult.tasks[]` reached status `"completed"` — **requires ≥1 task** (a zero-task run fails; assert `task_count_min` for presence); evidence-unavailable if tasks telemetry is absent |
 | `task_count_min: <N>` | at least N tasks were created (`RunResult.tasks.length >= N`) — the presence companion for task assertions |
-| `task_status: {match, status}` | a task whose `subject` OR `id` matches the regex `match` reached `status` — evidence-unavailable if tasks telemetry is absent |
+| `task_status: {match, status}` | a task whose `subject` OR `id` matches the regex `match` reached `status` — evidence-unavailable if tasks telemetry is absent; also fails **malformed** when a TaskCreate result was unparseable (corrupt task telemetry), mirroring the guard `all_tasks_completed`/`task_count_min` already had |
 | `no_scratchpad_leak: true` | every file presented via `present_files` that was in the scratchpad was successfully promoted to `mnt/outputs` (none left behind) — vacuously passes if nothing was presented (pair with a presence check to require a delivery); content-class: both the `present_files` tool_use and its own tool_result live in the ordinary events stream, so `RunResult.presentedFiles` re-derives identically on replay (meaningfully replay-checkable, same as `skill_triggered`); evidence-unavailable if `presentedFiles` telemetry is absent (an older run predating the feature). **`fidelity: container` only** — `present_files` is not served on hostloop/microvm, so a scratchpad-delivered file is neither promoted to `mnt/outputs` nor detected there (a skill that delivers via write-to-cwd→`present_files` will false-red `user_visible_artifact` on those tiers; use `container`, or write directly to `outputs/`). **Only `true` is valid** |
 | `present_files_called: true` | at least one file was actually delivered via the `present_files` tool (`RunResult.presentedFiles` is non-empty) — the presence companion to `no_scratchpad_leak` (which passes vacuously when nothing was presented). Pair them to require a delivery **and** require it not to leak. Content-class (re-derives identically on replay). **`fidelity: container` only** — `present_files` is not served on hostloop/microvm. **Only `true` is valid** |
 | `question_asked: <regex>` | the agent asked an AskUserQuestion whose text matches |
@@ -300,7 +300,7 @@ same set live from the schema.
 | `egress_allowed: <host>` | the host was allowed through |
 | `no_mcp_error: true` | no MCP round-trip failed (`RunResult.mcpErrors` is empty — no unhandled server, no handler throw) — live-only: MCP round-trips are harness-computed, not in the SDK stdout stream, so evidence-unavailable on replay (never a vacuous pass). **Only `true` is valid** |
 | `max_peak_rss_bytes: <N>` | peak sampled RSS of the agent sandbox ≤ N bytes (`RunResult.resources.peakRssBytes`) — live-only: replay never spawns a sandbox to sample, so evidence-unavailable on replay/protocol (never a vacuous pass); also evidence-unavailable when sampling captured no RSS value |
-| `semantic_matches: {rubric: [...], min_pass?, judge_model?}` | a pinned LLM judge grades each fixed `rubric` claim against the run's answer — the **union of the agent's final result text (`RunResult.finalMessage`), the transcript, and the final on-disk content of any files the agent authored during the run** — so a claim about content the skill led the agent to *write to a file* grades as reliably as one about inlined prose (authored-file evidence is unavailable on the **microvm** tier — no pre-run manifest to diff against, so no files are captured; `container`/`hostloop` do capture them). The assert passes iff ≥ `min_pass` claims pass (default: all — avoid for a gating scenario). Results align by claim index and are recorded per-claim in `RunResult.assertions[].semanticClaims` (`[{index, claim, pass}]`, so a consumer can diff the per-claim profile across runs); a rep whose grade can't be parsed (after one retry) is marked `RunResult.assertions[].judgeInvalid` and **never silently dropped** — it is excluded from the pass denominator, and the guard against a misleading score from that exclusion is the gate's minimum-valid-rep floor (`MIN_VALID` ≥ 4) plus this visibility, not a claim that denominator-shrinking inflation is impossible. Within a rep, a grade that's still unparseable after the retry **fails that assert outright** (evidence-unavailable, not a vacuous pass) — a persistently-flaky judge reds the run rather than silently passing. `judge_model` pins the grader (a dated id keeps a before/after comparison reproducible). Live-only: the judge is a live model call, so evidence-unavailable / skipped-loud on replay (never a vacuous pass) |
+| `semantic_matches: {rubric: [...], min_pass?, judge_model?}` | a pinned LLM judge grades each fixed `rubric` claim against the run's answer — the **union of the agent's final result text (`RunResult.finalMessage`), the transcript, and the final on-disk content of any files the agent authored during the run** — so a claim about content the skill led the agent to *write to a file* grades as reliably as one about inlined prose (authored-file evidence is unavailable on the **microvm** tier — no pre-run manifest to diff against, so no files are captured; `container`/`hostloop` do capture them). Beyond the microvm case, when the authored-file evidence backing the judged document is **incomplete** — a file dropped at the capture-size cap, unreadable at read-back, or (on `--resume`) the scratchpad walk skipped — the assert fails evidence-unavailable rather than trusting a judge grade over a partial document; this is separate from the malformed-grade `judgeInvalid` path below. The assert passes iff ≥ `min_pass` claims pass (default: all — avoid for a gating scenario). Results align by claim index and are recorded per-claim in `RunResult.assertions[].semanticClaims` (`[{index, claim, pass}]`, so a consumer can diff the per-claim profile across runs); a rep whose grade can't be parsed (after one retry) is marked `RunResult.assertions[].judgeInvalid` and **never silently dropped** — it is excluded from the pass denominator, and the guard against a misleading score from that exclusion is the gate's minimum-valid-rep floor (`MIN_VALID` ≥ 4) plus this visibility, not a claim that denominator-shrinking inflation is impossible. Within a rep, a grade that's still unparseable after the retry **fails that assert outright** (evidence-unavailable, not a vacuous pass) — a persistently-flaky judge reds the run rather than silently passing. `judge_model` pins the grader (a dated id keeps a before/after comparison reproducible). Live-only: the judge is a live model call, so evidence-unavailable / skipped-loud on replay (never a vacuous pass) |
 | `artifact_json: {artifact, path, …}` | assert a JSON artifact's contents — `equals`/`gt`/`in`/`exists`/`absent`/`is_null` over a dotted `path` (`in` = membership in a list, for a stochastic/LLM value; `absent` ≠ `is_null`; an unresolved intermediate fails loud) |
 | `computer_links_resolve: true` | every `computer://` link in the model-visible transcript resolves to an artifact that exists in the run's collected outputs/mounts — a dangling link fails, naming which target was checked (a live host path, the collected work tree, or the replay manifest). **Requires ≥1 link** (zero links fails — use `computer_links_resolve_if_present` for the presence-free variant). **Only `true` is valid** (`false` is rejected by the schema) |
 | `computer_links_resolve_if_present: true` | like `computer_links_resolve` but passes vacuously when the transcript has zero `computer://` links — the presence-free variant. **Only `true` is valid** |
@@ -326,6 +326,7 @@ codes (`VerdictSignal["code"]` in `src/run/verdict.ts`):
 |---|---|---|
 | `assertion` | fail | An authored `assert:` item failed |
 | `result_error` | fail | The run's SDK result was `"error"` |
+| `usage_limit` | fail | Usage/quota limit hit (not a skill failure) — retry after the limit resets. Emitted when `RunResult.resultErrorKind === "usage_limit"` |
 | `transport_error` | fail | The connection dropped mid/after-run |
 | `permissive_auto_allow` | fail | A cowork-parity auto-allow real Cowork would block (opt out: `allow_permissive_auto_allow`) |
 | `outputs_delete` | fail | An unauthorized delete touched `mnt/outputs` (opt out: author `no_delete_in_outputs`) |
@@ -344,7 +345,7 @@ overall run verdict and exit code — `assert result: success` alone won't catch
 ## Replay class
 
 A cassette (`record`/`replay`) has **no filesystem and no network**. `replay` re-evaluates only the
-**content** assertions. The authoritative list is `contentKeys` in `src/run/cassette.ts`.
+**content** assertions. The authoritative list is `ALWAYS_CONTENT_KEYS`/`QUESTION_GATE_KEYS`/`MANIFEST_KEYS` (composed) in `src/run/cassette.ts`.
 
 **Assertion source — frozen by default, on-disk by opt-in.** A plain `replay` evaluates the `assert:` block
 **frozen in the cassette** (byte-deterministic, ignores the working tree); editing `scenarios/<name>.yaml` does
@@ -458,7 +459,7 @@ reference omits). Neither list is a strict superset of the other — reach for t
    are replay-checkable **when the cassette carries an `artifacts` manifest**; without one they are
    skipped too.) *Partial skip:* a mixed `{result, egress_denied}` greens on `result` while
    `egress_denied` is dropped. Both now warn loudly. → put egress/live-only checks on a live gate; one
-   concern per item; run the linter. (`contentKeys` in `src/run/cassette.ts`.)
+   concern per item; run the linter. (`LIVE_ONLY_KEYS`/`MANIFEST_KEYS` in `src/run/cassette.ts`.)
 
 2. **Gate keys need a `controlOut` cassette.** `question_asked`, `questions_count_max`,
    `gate_answers_delivered`, `gate_answer_count_min`, `hook_blocked`, `no_hook_blocked` only evaluate on
@@ -468,7 +469,7 @@ reference omits). Neither list is a strict superset of the other — reach for t
    vacuously when zero gates fired**; use `gate_answer_count_min: 1` to also require a gate to have
    fired. A **header-only gate** (empty `question`, only `header`) can never be keyed and is rejected
    loudly — every gate needs a non-empty `question`.
-   (`contentKeys` in `src/run/cassette.ts`; `src/assert.ts`.)
+   (`QUESTION_GATE_KEYS` in `src/run/cassette.ts`; `src/assert.ts`.)
 
 3. **The LLM-decider's two spellings.** Scripted answers + `on_unanswered: fail` is deterministic;
    the stochastic path flags the run `nonDeterministic`. The LLM decider is one mechanism, two

package/.claude/skills/cowork-harness/references/task-recipes.md

@@ -2,7 +2,7 @@
 
 Each recipe composes facts that live scattered across SKILL.md and the other references into one
 decision path. Every one answers a question a real fleet owner had to work out the hard way. Facts track the harness version in SKILL.md's
-front-matter (currently 0.28.0). Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
+front-matter (currently 0.29.0). Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
 Recipe 3's `init-redact` shipped in 0.24.0 and are part of the current feature set — no version gate
 needed if your CLI meets SKILL.md's version floor.
 

package/.claude/skills/cowork-harness/scripts/scenario.py

@@ -45,7 +45,7 @@ import sys
 from pathlib import Path
 
 # --- the replay-class taxonomy ---
-# NB: this is NOT a 1:1 mirror of `contentKeys` in src/run/cassette.ts. cassette.ts keeps the verdict
+# NB: this is NOT a 1:1 mirror of the ALWAYS_CONTENT_KEYS/QUESTION_GATE_KEYS/MANIFEST_KEYS buckets in src/run/cassette.ts. cassette.ts keeps the verdict
 # modifiers (VERDICT_MODIFIER_KEYS) in its content set so they replay as no-op passes; the linter
 # deliberately keeps them OUT of CONTENT_KEYS so a modifier-only scenario still trips the `replay-noop`
 # warning below (a no-op pass verifies nothing real — exactly what that warning is for).
@@ -688,6 +688,12 @@ def cmd_lint(args):
 # v1 declines to do.
 
 _PLUGIN_ROOT_TOKEN = re.compile(r"\$\{?CLAUDE_PLUGIN_ROOT\}?")
+# A runtime SELF-HEAL for a dead ${CLAUDE_PLUGIN_ROOT}: discovering the real mount under /sessions at run
+# time (the prescribed pattern — e.g. `[ -d "$X" ] || X=$(find /sessions ... -name ...)`, or an inline
+# `|| python3 "$(find /sessions ...)"`). When a bash block that uses the token ALSO contains a `find` over
+# /sessions, the token is dead but the block rescues it → downgrade the WARN to INFO (Item 4). Conservative:
+# we do NOT verify the find pattern actually matches the plugin's layout (hence the INFO's "not validated").
+_SELF_HEAL = re.compile(r"\bfind\b[^\n]*/sessions")
 # Opening/closing fence: ``` or ~~~ (>=3), optional info string (language).
 _FENCE = re.compile(r"^\s*(`{3,}|~{3,})\s*([A-Za-z0-9_+-]*)\s*$")
 # A hooks-config command string: `"command": "<value>"` (value may contain escaped quotes).
@@ -717,6 +723,19 @@ def _finding_plugin_root(path, line, ctx_label):
     )
 
 
+def _finding_plugin_root_guarded(path, line, ctx_label):
+    return Finding(
+        "INFO",
+        "plugin-root-guarded",
+        f"`${{CLAUDE_PLUGIN_ROOT}}` used in an in-VM bash context ({ctx_label}), but the same block "
+        "self-heals it (a runtime `find` under /sessions) — the dead token is harmless here.",
+        "Guard not validated: the linter does not check the `find` pattern actually matches the plugin's "
+        "layout. Prefer resolving the mount from the script's own location over a find-fallback.",
+        path,
+        line,
+    )
+
+
 def _finding_hook_host_write(path, line, what):
     return Finding(
         "WARN",
@@ -748,6 +767,24 @@ def _lint_skill_text(path, raw_lines, force_json=False):
     fence_char = ""
     fence_len = 0
     fence_lang = ""
+    # Per-bash-fence buffer (Item 4): plugin-root token hit line numbers + the whole block's text, so a
+    # ${CLAUDE_PLUGIN_ROOT} use that is self-healed elsewhere IN THE SAME BLOCK downgrades WARN -> INFO.
+    # Emission is deferred to fence close (or EOF) but original 1-based line numbers are preserved.
+    bash_token_lines = []
+    bash_block_text = []
+
+    def flush_bash():
+        if bash_token_lines:
+            healed = _SELF_HEAL.search("\n".join(bash_block_text)) is not None
+            for ln in bash_token_lines:
+                findings.append(
+                    _finding_plugin_root_guarded(path, ln, "```bash block")
+                    if healed
+                    else _finding_plugin_root(path, ln, "```bash block")
+                )
+        bash_token_lines.clear()
+        bash_block_text.clear()
+
     for i, line in enumerate(raw_lines, start=1):
         m = _FENCE.match(line)
         if m:
@@ -757,6 +794,8 @@ def _lint_skill_text(path, raw_lines, force_json=False):
                 continue
             # A closing fence uses the same char, is at least as long, and carries no language.
             if marker[0] == fence_char and len(marker) >= fence_len and not lang:
+                if fence_lang in _BASH_FENCE_LANGS:
+                    flush_bash()  # decide WARN vs INFO now that the whole block is known
                 in_fence = fence_char = ""
                 fence_len = 0
                 fence_lang = ""
@@ -775,8 +814,9 @@ def _lint_skill_text(path, raw_lines, force_json=False):
             ctx = "prose"
 
         if ctx == "bash":
+            bash_block_text.append(line)  # buffer the block; token hits emit on flush (self-heal aware)
             if _PLUGIN_ROOT_TOKEN.search(line):
-                findings.append(_finding_plugin_root(path, i, "```bash block"))
+                bash_token_lines.append(i)
         elif ctx == "json":
             for cm in _HOOK_CMD.finditer(line):
                 _check_hook_command(path, i, cm.group(1), findings)
@@ -786,6 +826,10 @@ def _lint_skill_text(path, raw_lines, force_json=False):
             for bm in _BASH_DIRECTIVE.finditer(line):
                 if _PLUGIN_ROOT_TOKEN.search(bm.group(1)):
                     findings.append(_finding_plugin_root(path, i, "Bash() directive"))
+    # A bash fence left unclosed at EOF still has buffered token hits — flush them (else a real WARN/INFO
+    # would be silently dropped).
+    if in_fence and fence_lang in _BASH_FENCE_LANGS:
+        flush_bash()
     return findings
 
 

package/AGENTS.md

@@ -42,10 +42,11 @@ protocol layer or run-loop bookkeeping in the CLI.
   scenario key is retired vocabulary — the alias is gone and it is now rejected as an unknown key — do
   not reintroduce the term.
 - **A new assertion must pick its replay class.** *Content* assertions (read only `ctx.transcript` / the
-  record) go in `src/run/cassette.ts` `contentKeys` so they run on the token-free `replay` PR gate;
-  *filesystem / egress* assertions do NOT — they are excluded **by omission** from `contentKeys`, so they
-  only run on live (non-replay) gates. `contentKeys` is the single source of truth; the README's "what
-  replay checks" prose just describes it. The wrong choice is a **silent no-op in CI**.
+  record) go in one of `src/run/cassette.ts`'s exported buckets — `ALWAYS_CONTENT_KEYS`, `QUESTION_GATE_KEYS`,
+  or `MANIFEST_KEYS` — so they run on the token-free `replay` PR gate; *filesystem / egress* assertions go
+  in `LIVE_ONLY_KEYS` instead, so they only run on live (non-replay) gates. These four exported constants
+  are the single source of truth; the README's "what replay checks" prose just describes them. The wrong
+  bucket is a **silent no-op in CI**.
 - **`replay` consumes `controlOut` and re-serializes via `serializeDecision` to guard the AskUserQuestion
   answer shape (O7) on the token-free lane. A new decision *kind* must extend BOTH `serializeDecision`
   AND `deserializeDecision` (declared inverses in `src/agent/session.ts`) — they must not drift.**

package/CHANGELOG.md

@@ -6,6 +6,144 @@ All notable changes to this project are documented here. The format is based on
 
 ## [Unreleased]
 
+## [0.29.0] — 2026-07-11
+
+### Added
+
+- **Parity baseline for Claude Desktop 1.20186.0.** `baseline: latest` now resolves to `desktop-1.20186.0`
+  (VM agent ELF 2.1.202 unchanged; native host app 2.1.205). The 1.20186.0 asar was a minifier re-anchor —
+  the value-resolved spawn contract is byte/behaviourally identical; the sync extractor's structural anchors
+  were re-anchored to the new bundle shapes (hoisted helpers became namespace-method calls; const spreads
+  became export aliases). Verified live across the `protocol`, `container`, and `hostloop` tiers.
+- **`sync` now guards Cowork system-prompt drift.** Each sync fingerprints the prompt (a minifier-independent
+  content hash plus a `{{placeholder}}` / `<section>` inventory) and **refuses to write** when the content
+  drifts from the committed fingerprint until a new fingerprint entry is added, and **hard-fails** on a
+  `{{placeholder}}` the renderer neither substitutes nor explicitly allowlists. This closes a gap where a
+  prompt change (e.g. the deployment-gated `{{modelIdentity}}` placeholder added in 1.20186.0, which is
+  stripped on first-party so the rendered prompt is unchanged) could slip past the coarse `asarFingerprint`.
+- **Usage/quota-limit runs are now classified as `resultErrorKind: "usage_limit"`.** A session/weekly/model/
+  spend/org quota-exhaustion arrives as an `is_error` result with the SDK's misleading `subtype: "success"`
+  and HTTP 429 — previously an undifferentiated error, indistinguishable from a real skill regression.
+  Detection is conjunctive (`api_error_status === 429` **and** a terminal usage-limit message; a bare 429 is
+  a transient overload and is not reclassified). `resultSubtype` is kept verbatim (faithful SDK passthrough).
+  Surfaced on `RunResult`, `status.json`, and a distinct verdict signal ("retry after reset") so a batch can
+  halt-fast; the `claude -p` decider transport fails fast (non-retryable) on a usage limit instead of
+  retrying into a spent quota.
+- **`input_unmodified` can now guard uploaded files (`uploads/**`).** Uploads are captured as a read-only
+  input root (hash-only in cassettes — a private upload is never inlined), so a scenario can assert the agent
+  didn't mutate an uploaded file; a mutation is attributed to the agent (not excused as an external edit).
+  Previously only connected-folder inputs were guardable.
+- **`RunResult.command`** records the exact command that produced a result (`run`/`skill`/`record`/`chat`/
+  `replay`) — finer than `mode` (which only distinguishes run vs. chat, so a `skill`/`record` run was
+  indistinguishable from a plain `run`). `reindex` now prefers this field, so a rebuilt run index no longer
+  relabels a `skill`/`record` run as `run`; it falls back to a prior index row, then to `mode`, on older
+  results that predate the field.
+- **`RunResult.evidenceErrors.egressParse`** counts proxy-log lines the egress sidecar dropped as malformed
+  (bad JSON, missing host, unknown decision) — previously filtered out silently. Observability only (egress
+  assertions are positive, so a dropped line already fails loud), but now visible.
+- **`subagents[].outputTruncated` and `toolResults[].assertTextTruncated`** flag when a captured value was cut
+  at the 10 KB assertion cap, so `subagent_output_contains` (and the equivalent substring checks) report
+  "evidence unavailable" instead of a false "not found" when the searched text could lie past the cut.
+- **`fingerprint.frozen`** marks, on the replay lane, that the staleness fingerprint is the cassette's
+  record-time snapshot rather than a fresh recompute, so a consumer can't mistake one for the other.
+- **Replay results now populate `prompt` and `toolResults`** (the scenario prompt that drove the re-drive and
+  the tool-result records already built for evaluation) — both were previously always `undefined` on replay.
+- **`ResourceSummary.probeFailures`** counts resource-sampling probes that actually failed (nonzero exit,
+  timeout, parse error), distinct from a tier that was never sampleable (protocol/replay) — "sampling broke"
+  is now told apart from "sampling wasn't attempted."
+- **`chat` now samples real resources on the `container`/`hostloop` tiers.** Previously no `ResourceSampler`
+  was ever started for a chat session on either tier, so `resources.jsonl` was always empty despite
+  `chat-result.ts`'s doc-comment claiming resource parity with `run`; a protocol-tier chat legitimately has
+  none (no container/process id to probe against the host `claude` binary).
+
+### Changed
+
+- **`input_unmodified` accepts a single glob string** as well as an array (`input_unmodified: 'uploads/**'`
+  no longer errors "expected array").
+- **`sessionFingerprintDrift` keeps an unresolvable session fingerprint non-failing (informational)** and
+  downgrades a mismatch to a non-failing note when the cassette's session was only resolved via a
+  name-lookup fallback (the SAME low-confidence signal `scenarioContentDrift` already downgrades on) —
+  a relocated cassette whose relative-offset resolution lands on an unrelated same-named session file no
+  longer reads as a false "session shape drifted."
+- **`artifact_json`'s replay remedy names an uploaded input distinctly** — a body-less target that was
+  captured hash-only because it's an *upload* now says so directly, instead of the prior combined
+  readonly-or-over-cap wording that didn't cover the uploads case.
+- **`scenario.py lint-skill`** downgrades a `${CLAUDE_PLUGIN_ROOT}`-in-VM-bash use to a `plugin-root-guarded`
+  **INFO** (from WARN) when the same bash block self-heals it at runtime (`[ -d ] || find /sessions …`), so a
+  correctly-guarded block no longer shares the alarming WARN class with a genuinely-unguarded use.
+- **`no_unexpected_files` now requires a complete post-run filesystem walk.** An unreadable subtree
+  (permission error, race) previously collapsed to "no files found there" and could vacuously pass; the check
+  now fails "evidence unavailable" when any part of the tree couldn't be observed.
+- **`semantic_matches` refuses to grade over incomplete authored-file evidence.** When a file the run authored
+  was dropped at the capture-size budget or was unreadable at read-back (or, on `--resume`, the scratchpad was
+  skipped to avoid misattributing a prior turn's files), the assertion fails "evidence unavailable" rather than
+  trusting a judge grade made without that content. The judged document is also size-capped now (per-section
+  and total, with an explicit truncation marker) so a long run can't overflow the judge's context; secret
+  scrubbing runs before the cap, so a secret can never be exposed by falling on a truncation boundary.
+- **`task_status` now honors corrupt task telemetry** — when a `TaskCreate` result was unparseable it fails
+  "malformed" instead of matching against the surviving subset, consistent with `all_tasks_completed` /
+  `task_count_min`.
+- **Empty or regex/brace-expansion tool globs are rejected at load.** `tool_called` / `tool_not_called` /
+  `subagent_tool_used` / `subagent_tool_absent` values that are empty or contain regex/brace metacharacters
+  (`.*`, `|`, `[]`, `{}`, …) match no real tool name and used to pass a `_not_`/`_absent` assertion vacuously;
+  they are now a hard schema error for authored scenarios and recorded cassettes alike.
+- **`readRunStatus` validates the shape of `status.json`**, not just that it parses — a truncated or otherwise
+  structurally-invalid write (e.g. `{}`) is reported malformed instead of being trusted as a valid status; a
+  `--follow` loop resolves only after observing a genuinely valid status.
+- **Answered gates reconcile against actual delivery.** A control-response that was optimistically reported
+  delivered (queued) but whose write later failed before reaching the agent is corrected once the run
+  completes, so delivery telemetry and `trace --view questions` read the true outcome.
+- **A `TaskCreate` / `WebSearch` / `present_files` call whose result never arrived before the stream ended now
+  counts as incomplete evidence** (`evidenceErrors.*`) instead of silently vanishing from the resolved set, so
+  the dependent assertion fails "cannot verify" rather than grading a truncated subset as complete.
+- **Bounded hashing/reads.** `classifyWorkspaceFiles` caps per-file hashing (50 MiB, matching the pre-run
+  manifest) and reports `hashError: "over-cap"` instead of reading a huge file whole; authored-file capture
+  reads only the bytes it retains.
+
+### Fixed
+
+- **`sync` no longer derives a phantom `nativeStagedPath`.** The native macOS agent app (`claude-code/`) and
+  the container/microvm Linux ELF (`claude-code-vm/`) version on independent cadences; `sync` derived the
+  native (hostloop) path from the VM `.sdk-version`, producing a path that did not exist whenever the two had
+  drifted — and freezing that phantom into the written baseline. It now resolves the native path from the
+  newest app actually staged under `claude-code/`, falling back to the version-derived convention only when no
+  native app is staged at all.
+- **Two anonymous sub-agent dispatches in different assistant turns could collide on the same synthesized id**
+  (the fallback id was derived only from the block's position within its own message). It now derives from the
+  message id plus block index — unique across the run and stable across record→replay — fixing dispatch nesting
+  in `trace --view dispatches` for skills that dispatch multiple unnamed sub-agents.
+- **The semantic judge's recorded model could name the wrong one.** `assertions[].judgeModel` was stamped from
+  the requested alias (e.g. `opus`) before the call; the transport resolves an alias to a concrete model per
+  call, so the resolved model is now recorded after the call completes.
+- **`matrix --repeat`'s per-cell pass/fail glyph didn't honor `--allow-budget-stop`**, though the aggregate
+  "N/M cells passed" count did — a cell that passed under a permitted budget stop could print as failed next to
+  its own row while counting as a pass in the summary.
+- **The resource sampler could miss a short run's only sample.** `stop()` now waits (bounded) for an in-flight
+  probe before returning, so a run shorter than one sampling interval reliably records its first sample instead
+  of racing teardown.
+- **A corrupt `timeline.jsonl` header was indistinguishable from an absent timeline** — both read as "no
+  timeline," so a corrupt read could be baked into a recorded cassette as a clean empty timeline. A corrupt
+  header now reads as a distinct "present but corrupt" state, kept out of both live results and cassettes.
+- **A malformed `system/init` frame** (a non-array `tools`/`mcp_servers`/`skills`, or a non-object content
+  block) could crash with an uncaught `TypeError`; it is now rejected as a typed protocol error at parse time,
+  and the `trace` reconstruction lane skips it instead of aborting.
+- **`verify-cassettes` no longer aborts the whole batch on a nameless cassette.** A lenient cassette with
+  no `scenario.name` (and no `scenarioSource`) threw inside the per-file verification, which aborted the
+  entire run (`results: []` — a false-green by abort) instead of reporting that one file's error and
+  continuing. Each file's verification is now wrapped so a per-file crash becomes that file's error row
+  (mirrors `replay`'s existing per-file catch).
+
+### Internal
+
+- **Eval-gate hardening** (`scripts/eval-gate.ts`, maintainer instrument — not shipped with the skill): a
+  missing/edited scenario or discriminating claim now fails the gate (opt-out `--allow-unmatched`); a mixed-model
+  capture, a null candidate model against a concrete baseline, and a malformed profile/fraction are refused
+  instead of silently collapsing; child runs are bounded by a timeout, output cap, and process-group kill.
+- **Skill-critique hardening** (`scripts/skill-critique.ts`, `src/critique/*`): the reflection turn's exit,
+  envelope, and session/output continuity are validated before evaluation; a corrupt or missing turn archive is
+  reported rather than substituting turn-2 data; the untrusted self-report is fenced as inert data before the
+  evaluator prompt; child turns are bounded and orphaned process groups are killed on interrupt.
+
 ## [0.28.0] — 2026-07-10
 
 ### Added

package/DESIGN.md

@@ -165,7 +165,7 @@ The policy that produces those `allow`/`deny` responses is the **Decider** seam
 
 > **Machine-readable form:** the five shapes below are schema'd as `schema/protocol.v1.json`, with a golden vector pack at `fixtures/protocol/v1/` — see [docs/protocol.md](./docs/protocol.md) for scope, versioning, and how to conformance-test against them.
 
-### Control protocol — VERIFIED end-to-end against the live host CLI (macOS build 2.1.177+; the staged in-VM agent that L1/L2 run is **2.1.202**, baseline **`desktop-1.19367.0`** — a fresh live end-to-end pass across the `protocol`, `container`, and `hostloop` tiers was run against this baseline on 2026-07-10, superseding the prior `1.17377.1` pin; the intervening `1.17377.1`→`1.19367.0` bumps were byte/behaviourally-identical asar analysis, now confirmed live)
+### Control protocol — VERIFIED end-to-end against the live host CLI (macOS build 2.1.177+; the staged in-VM agent that L1/L2 run is **2.1.202**, the native host app that `hostloop` runs is **2.1.205**, baseline **`desktop-1.20186.0`** — a fresh live end-to-end pass across the `protocol`, `container`, and `hostloop` tiers was run against this baseline on 2026-07-11, superseding the prior `1.19367.0` pin; the intervening `1.19367.0`→`1.20186.0` bump was a minifier re-anchor with a byte/behaviourally-identical value-resolved spawn contract, now confirmed live)
 
 > The staged agent ELF is unchanged (2.1.181) across the 1.14271.0→1.15200.0 asar bump, and 2.1.187 across the 1.15200.0→1.15962.0 bump. The live scenario suite (`protocol` + `container` tiers) was re-run against the 1.15200.0 baseline; the 1.15962.0 bump was verified via asar analysis (content byte-identical: host-loop generator, system prompt, identity string, gates, and egress domains all unchanged) plus a full local test suite pass. The 1.15962.1→1.17377.1 bump moved the staged agent to **2.1.197** and added `api.claude.ai` to the egress allowlist; re-verified via `sync` (no unknown deltas) plus a manual asar spot-check of the reconstructed prompt content (substantively unchanged — see the Parity entry in CHANGELOG.md) and a full live scenario-suite pass (`protocol` + `container` tiers).
 
@@ -179,7 +179,7 @@ The handshake and shapes below were confirmed empirically with an end-to-end run
 
 > **Cowork mode is enabled by env, not a flag.** In the staged agent (2.1.197) `--cowork` is a *plugin-scope* flag ("can only be used with user scope") and is rejected by the agent invocation; cowork mode is entered via **`CLAUDE_CODE_IS_COWORK=1`**. (Do **not** also set `CLAUDE_CODE_USE_COWORK_PLUGINS` — Desktop doesn't, and it flips the agent's userSettings filename to `cowork_settings.json` and plugin cache to `cowork_plugins/` via `TSO()` — the minified Desktop helper that derives the cowork settings/cache paths; plugins are delivered via `--plugin-dir`.) The host CLI is a different (macOS) build, so L0 runs plain (control-loop validation only); L1/L2 run the staged **Linux/arm64** binary — bind-mounted from the user's own install.
 
-### Spawn contract + host-loop vs VM-loop (binary-verified through asar 1.17377.1; asar analysis since carried through 1.19367.0 — the full spawn contract is byte-identical across the 1.18286.0→1.18286.2 bump, and behaviorally identical across the 1.18286.2→1.19367.0 Vite code-split/re-minify: the value-resolved contract is unchanged and only minified symbol names + bundle layout moved, re-verified via the structural anchors and the live-asar spawn-contract tests — the live end-to-end pass remains pinned to 1.17377.1)
+### Spawn contract + host-loop vs VM-loop (binary-verified through asar 1.17377.1; asar analysis since carried through 1.20186.0 — the full spawn contract is byte-identical across the 1.18286.0→1.18286.2 bump, and behaviorally identical across the 1.18286.2→1.19367.0→1.20186.0 re-minifications: the value-resolved contract is unchanged and only minified symbol names + bundle layout moved (in 1.20186.0, hoisted helpers became namespace-method calls and const spreads became export aliases), re-verified via the structural anchors and the live-asar spawn-contract tests plus a 1.20186.0-shaped drift-guard fixture — the live end-to-end pass now covers `1.20186.0` too (see the "Control protocol" note above), superseding the prior `1.19367.0` pin)
 
 The full Desktop→agent spawn contract (cwd `/sessions/<id>`, `CLAUDE_CONFIG_DIR=mnt/.claude`, the env object, `--tools`/`--allowedTools`/`--plugin-dir`/`--effort`/`--setting-sources`, permission layers, prompt templates) is documented in [docs/cowork-spawn-contract-1.12603.1.md](./docs/cowork-spawn-contract-1.12603.1.md) and encoded in `baseline.spawn`.