cowork-harness 0.29.0 → 0.30.0

package/.claude/skills/cowork-harness/SKILL.md

@@ -3,8 +3,8 @@ name: cowork-harness
 description: Test or debug a Claude Code skill/plugin under Claude Cowork's runtime — sandboxed agent, default-deny egress, the can_use_tool permission/question protocol — using the cowork-harness CLI. Use when validating or regression-testing a skill, authoring or debugging a scenario YAML (prompt + scripted answers + assert:), choosing a fidelity tier, scripting AskUserQuestion / tool-permission answers, or asserting artifacts, egress, or sub-agent dispatch. Especially when a harness run no-ops an assertion, fails on an unanswered gate, false-greens, a steered answer never reaches the model, or a web_fetch is unexpectedly denied or gated. NOT for generic unit testing (pytest/vitest of your own scripts) or non-Cowork CI. Covers the skill / run / chat / record / replay / trace / decide / assertions / scaffold commands and the session-vs-scenario split.
 metadata:
   author: cowork-harness
-  version: 0.29.0
-  tracks-harness: cowork-harness 0.29.0 (baseline desktop-1.20186.0)
+  version: 0.30.0
+  tracks-harness: cowork-harness 0.30.0 (baseline desktop-1.20186.1)
 ---
 
 # cowork-harness
@@ -22,7 +22,7 @@ flagged with a loud `::warning::`, not silent — auto-answer a gate, observe an
 allowlist). This skill exists mostly to keep you out of those traps — the Gotchas section below is
 the highest-value part. Read it.
 
-> **Version note:** the facts and `file:line` pointers here track `cowork-harness 0.29.0` (baseline
+> **Version note:** the facts and `file:line` pointers here track `cowork-harness 0.30.0` (baseline
 > `desktop-1.20186.0`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
 > `SPEC.md` / `docs/*.md` over this snapshot, and re-run the bundled linter.
 
@@ -38,7 +38,7 @@ cowork-harness skill ./my-skill "do X"      # run the skill once against the sta
 Before the first command, confirm the CLI is reachable and **fail loud** (never fake a pass) when a tier's dependencies are missing:
 
 - **One-shot check.** Run `cowork-harness doctor [--tier <tier>]` first — a read-only prerequisite check that inspects Docker, the staged agent, the token, and the baseline in one pass. The bullets below explain each thing it checks (and how to fix it).
-- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 0.29.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@>=0.29.0" <cmd>` (Node ≥ 20), or install once with `npm i -g "cowork-harness@>=0.29.0"`. **Pin `@>=0.29.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published. (≥ 0.29.0 is what gates the commands/assertions this skill teaches: `assertions --list`, `scaffold <run-id>`, `trace --view dispatches`, `artifact_json` incl. the `in:` operator (passes when the resolved value deep-equals one of the listed members — value ∈ your list, not the reverse), `verify-cassettes`, batch `record <dir>`/`--rerecord-stale`, `record --concurrency <N>`, record-time redaction, multiSelect/`answer:`, `verify-run` answer-coverage, `record --max-artifact-bytes`, live record-time deciders, `verify-cassettes --allow-domain`/`--allow-email`/`--allow-path`/`--allow-patterns-file` (`path` — local absolute filesystem paths — is the scanner's 4th class, new in 0.21.0; `--allow-patterns-file <path>` is a FILE of patterns, one regex per line — not a path to allow, unlike `--allow <regex>`), scenario `skills:` staleness scoping with `COWORK_HARNESS_AGENT_SCOPE=skill`, `chat --plugin`, `/help` in the REPL, `hostloop`'s native host/VM process split with its `allow_host_writes:` consent field, `computer_links_resolve` (new in 0.22.0), and `semantic_matches` (an LLM judge grades a fixed `rubric` of claims against the run's answer — **live-only**, so it is evidence-unavailable / skipped-loud on replay, never a vacuous pass; new in 0.27.0), and **glob-matched** `tool_called`/`tool_not_called`/`subagent_tool_used`/`subagent_tool_absent` (a pattern like `mcp__workspace__*` matches any tool in the family; exact names match exactly; new in 0.28.0).)
+- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 0.30.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@>=0.30.0" <cmd>` (Node ≥ 20), or install once with `npm i -g "cowork-harness@>=0.30.0"`. **Pin `@>=0.30.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published. (≥ 0.30.0 is what gates the commands/assertions this skill teaches: `assertions --list`, `scaffold <run-id>`, `trace --view dispatches`, `artifact_json` incl. the `in:` operator (passes when the resolved value deep-equals one of the listed members — value ∈ your list, not the reverse), `verify-cassettes`, batch `record <dir>`/`--rerecord-stale`, `record --concurrency <N>`, record-time redaction, multiSelect/`answer:`, `verify-run` answer-coverage, `record --max-artifact-bytes`, live record-time deciders, `verify-cassettes --allow-domain`/`--allow-email`/`--allow-path`/`--allow-patterns-file` (`path` — local absolute filesystem paths — is the scanner's 4th class, new in 0.21.0; `--allow-patterns-file <path>` is a FILE of patterns, one regex per line — not a path to allow, unlike `--allow <regex>`), scenario `skills:` staleness scoping with `COWORK_HARNESS_AGENT_SCOPE=skill`, `chat --plugin`, `/help` in the REPL, `hostloop`'s native host/VM process split with its `allow_host_writes:` consent field, `computer_links_resolve` (new in 0.22.0), `semantic_matches` (an LLM judge grades a fixed `rubric` of claims against the run's answer — **live-only**, so it is evidence-unavailable / skipped-loud on replay, never a vacuous pass; new in 0.27.0), **glob-matched** `tool_called`/`tool_not_called`/`subagent_tool_used`/`subagent_tool_absent` (a pattern like `mcp__workspace__*` matches any tool in the family; exact names match exactly; new in 0.28.0), the five path-gate assertion keys `no_vm_path_file_op`/`vm_path_denied`/`path_denied`/`no_path_denied`/`subagent_file_write`, the session-level `agent_env` knob, and resolved sub-agent identity on dispatch records (`resolvedAgentType`/`resolvedModel`; new in 0.30.0).)
 - **Agent binary (sandboxed live tiers — `container`/`microvm`/`hostloop`/`cowork`).** The staged Claude Code agent is **bind-mounted** from a local Claude Desktop install, or point `COWORK_AGENT_BINARY` at a `claude-code-vm/<ver>/claude` ELF. Nothing is bundled. `protocol` (L0) and `replay` need no staged agent; for the sandboxed tiers, no agent → no run; report that, don't skip silently.
 - **Docker / Lima.** Only `--fidelity protocol` (L0) runs without them. `container` / `microvm` / `hostloop` / `cowork` need Docker (Lima for L2). If they're absent, drop to `--fidelity protocol` and **say so** — a green that never exercised the sandbox is not a sandbox pass.
 - **Auth.** `CLAUDE_CODE_OAUTH_TOKEN` (preferred) or `ANTHROPIC_API_KEY`, via env or `.env`. Minting an OAuth token needs the **`claude` CLI** (`npm i -g @anthropic-ai/claude-code`, then `claude setup-token`).
@@ -63,7 +63,7 @@ reproducible regression (Part II), and **debug** a run that misbehaved or greene
   the path, `trace <run-id>` finds it). **Localize the failure post-hoc** from that evidence:
   `cowork-harness trace <run-dir>`'s views + the emitted `result.json` to see what the run actually did,
   then `verify-run` to re-check a suspect assertion — all token-free, no Docker, no re-record. This is
-  the loop 0.29.0's observability is built for; the *Triage* and *Inspecting a run's observability
+  the loop 0.30.0's observability is built for; the *Triage* and *Inspecting a run's observability
   output* sections in **Part III — Debug** are the detail (the fuller human-facing map lives in
   `docs/debugging.md` — repo-only, not shipped with the installed skill).
 - **Multi-turn / interactive reproduction** → `cowork-harness chat` (interactive; gates answered at the
@@ -292,7 +292,9 @@ scenario's gates or their labels: `--keep` ONE run, then `cowork-harness trace <
 your `answers:` against that kept run, then record once. **But the kept run is a snapshot:** if you change the
 skill's gate phrasing afterward, re-`--keep` — verify-run's answer-coverage *refuses* (exit 2, "predates the
 current skill") rather than vouch against stale labels, but the trace/inspect path can't warn you, so re-keep
-deliberately. (A token-free probe of "which gates fire" isn't possible — gates are model-decided per run.)
+deliberately. (Same fail-closed family: corrupt gate evidence — unparseable `events.jsonl` lines, or fewer
+gates than `trace.json` recorded questions — and a structurally invalid `result.json` also refuse rather
+than certify.) (A token-free probe of "which gates fire" isn't possible — gates are model-decided per run.)
 
 Run artifacts are written to `~/.cowork-harness/runs/…` by default — **outside any working tree**, so a run
 launched from a repo root never drops sensitive skill inputs/outputs into it. Pass `--run-dir <path>` (or set
@@ -420,8 +422,8 @@ decide which assertions from *Assertions: two orthogonal axes* are worth adding)
 - **`cowork-harness stats [--metric <m>]`** — aggregate across the run index: `cost`, `duration`,
   `tokens`, `cache-tokens`, `model-cost`, `turns`, `pass-rate`.
 - **`result.json` carries the raw fields** the assertions read: `toolDurations`, `models`, `toolErrors`,
-  `redundantToolCalls`, `modelUsage`, `thinking`, `skillActivity`, `subagents[]` (prompt/model/output/
-  `attributedSkillId`, `outputTruncated`), `context` (tools/mcpServers/availableSkills), `tasks`,
+  `redundantToolCalls`, `modelUsage`, `thinking`, `skillActivity`, `subagents[]` (prompt/`dispatchModel`/
+  `resolvedModel`/output/`attributedSkillId`, `outputTruncated`), `context` (tools/mcpServers/availableSkills), `tasks`,
   `workspaceFiles`, `presentedFiles`, `hookEvents`, `mcpErrors`, `contextEvents`, `resources`
   (`probeFailures` distinguishes a failed sample from a tier that was never sampleable). Provenance/
   evidence-health fields: `command` (`run`/`skill`/`record`/`chat`/`replay` — finer than `mode`),
@@ -439,7 +441,7 @@ decide which assertions from *Assertions: two orthogonal axes* are worth adding)
   than debugging; `"transport"`/`"agent"` means something actually broke, worth localizing before
   re-running.
 - **Attributing cost to sub-agent work.** `subagents[]` gives the dispatch tree — each sub-agent's
-  `model`, `toolsUsed`, `prompt`/`output`, and `attributedSkillId` — but **not** its own token/cost;
+  `dispatchModel`/`resolvedModel`, `toolsUsed`, `prompt`/`output`, and `attributedSkillId` — but **not** its own token/cost;
   aggregate cost is per-**model** in `modelUsage` (and `trace --view usage`), not per-sub-agent. So a
   cost spike from fan-out reads as `trace --view dispatches` (how many, which agent) against that model's
   per-model usage — the harness doesn't line-item each sub-agent's tokens.
@@ -514,8 +516,20 @@ repeats the assertion/replay-relevant ones alongside the schema (a scoped subset
    to prove an attempt; it proves the tool actually ran.
 
 5. **`subagent_declared_but_unused` fires on declared-but-didn't-use-THAT-tool**, even if the
-   sub-agent used other tools. And `subagent_dispatched` matches by dispatch **description** too —
-   skills often dispatch with no `subagent_type` (`agentType:"unknown"`), so match the description.
+   sub-agent used other tools. `subagent_dispatched` / `subagent_output_contains` match on dispatch
+   type (`dispatchAgentType`), the binary-*resolved* type (`resolvedAgentType`), *or* the dispatch
+   **description** — so a type-less dispatch that resolved to e.g. `general-purpose` is still
+   selectable, by either the resolved type or the description. A `Task` dispatch that carries NO
+   `subagent_type` at all falls back to the built-in `general-purpose` agent with a **wildcard tool
+   surface** (`tools:["*"]`, including workspace bash) — faithful production behavior, and it fires
+   routinely. The harness warns loudly on this fallback and records `subagents[].dispatchTypeOmitted`;
+   an *explicit* `subagent_type: "general-purpose"` is a deliberate author choice and does not warn.
+   Implication: `subagent_tool_absent` on a type-less dispatch is weaker evidence (wildcard surface) —
+   pin `subagent_type` explicitly when you need a tight tool-absence guarantee.
+
+   **Cross-tier "no shell" caveat.** On `hostloop`, native `Bash` calls route through the
+   `mcp__workspace__bash` alias, so a "sub-agent used no shell" check must glob **both** `Bash` and
+   `mcp__workspace__*` to hold across every tier.
 
 6. **`dispatch_count_max` is an author-chosen budget, not a production cap.** It's a post-hoc count
    assertion: passing means "happened to dispatch ≤N this run," nothing more. Cowork imposes **no**

package/.claude/skills/cowork-harness/references/ci-recipe.md

@@ -1,6 +1,6 @@
 # CI recipe — replay vs live lanes
 
-Self-contained reference. Tracks `cowork-harness 0.29.0` (baseline `desktop-1.20186.0`).
+Self-contained reference. Tracks `cowork-harness 0.30.0` (baseline `desktop-1.20186.0`).
 
 **Fastest path: the packaged Action.** One step gets you `replay`/`lint`/`verify-cassettes` plus a PR
 job-summary reporter (verdict table, staleness findings, cost/turns when available):
@@ -54,7 +54,7 @@ sha256-*checked* but not hard-blocking on mismatch — it's advisory for an inte
 GitHub-hosted runners, no token/Docker/agent:
 
 ```yaml
-- run: npm i -g "cowork-harness@>=0.29.0"
+- run: npm i -g "cowork-harness@>=0.30.0"
 - run: cowork-harness lint scenarios/*.yaml          # no silent false-greens
 - run: cowork-harness verify-cassettes cassettes/    # privacy + staleness
 - run: cowork-harness replay cassettes/              # token-free content/structure
@@ -188,7 +188,7 @@ jobs:
         with: { node-version: '20' }
       - uses: actions/setup-python@v5
         with: { python-version: '3.x' }                                       # python3 only — PyYAML is bundled with the linter
-      - run: npm i -g "cowork-harness@>=0.29.0"
+      - run: npm i -g "cowork-harness@>=0.30.0"
       - run: cowork-harness lint scenarios/*.yaml                              # no-silent-false-green (needs python3; PyYAML bundled)
       - run: cowork-harness verify-cassettes cassettes/ --output-format json   # privacy + staleness gate
       - run: cowork-harness replay cassettes/ --output-format json             # token-free content/structure
@@ -217,7 +217,7 @@ jobs:
             echo "live=true" >> "$GITHUB_OUTPUT"
           fi
       - if: steps.guard.outputs.live == 'true'
-        run: npm i -g "cowork-harness@>=0.29.0"
+        run: npm i -g "cowork-harness@>=0.30.0"
       - if: steps.guard.outputs.live == 'true'
         run: cowork-harness run scenarios/ --output-format json
         env:

package/.claude/skills/cowork-harness/references/fidelity-and-answers.md

@@ -1,6 +1,6 @@
 # Fidelity tiers & answer paths
 
-Self-contained reference. Tracks `cowork-harness 0.29.0` (baseline `desktop-1.20186.0`).
+Self-contained reference. Tracks `cowork-harness 0.30.0` (baseline `desktop-1.20186.0`).
 
 ## Fidelity tiers (`fidelity:` in the scenario)
 

package/.claude/skills/cowork-harness/references/scenario-schema.md

@@ -1,6 +1,6 @@
 # Scenario & session schema, assertion catalog, web_fetch, full gotchas
 
-Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 0.29.0`
+Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 0.30.0`
 (baseline `desktop-1.20186.0`). If your checkout is newer, prefer the live `docs/scenario.md`,
 `docs/session.md`, and `SPEC.md`.
 
@@ -105,6 +105,12 @@ agent_max_turns: 500              # optional turn ceiling -> agent --max-turns;
 permission_mode: default         # default | acceptEdits | plan | bypassPermissions
 permission_parity: cowork        # cowork (unscripted tool calls allowed) | strict (deny unscripted)
 
+# sub-agent / tool-search env knob (tier-uniform; maps to agent env vars)
+agent_env:
+  subagent_model: claude-opus-4-8   # -> CLAUDE_CODE_SUBAGENT_MODEL
+  tool_search: auto                 # auto | off -> ENABLE_TOOL_SEARCH; omit = binary default (ToolSearch ON)
+  disable_experimental_betas: false # true -> CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS=1 (also disables ToolSearch)
+
 # fenced debug escape hatch (NOT reachable via Cowork's UI)
 debug:
   max_thinking_tokens: 50000     # overrides --max-thinking-tokens directly; bypasses extended_thinking's
@@ -254,9 +260,11 @@ same set live from the schema.
 | `tool_result_not_contains: <str>` | no tool result includes the literal string (content / replay-checkable; fails loud when tool results are absent) |
 | `subagent_tool_used: <glob>` | a sub-agent used a tool matching this glob (same `*`/`?`, anchored, case-sensitive semantics as `tool_called`, including the empty/regex-ish rejection) |
 | `subagent_tool_absent: <glob>` | no sub-agent used a tool matching this glob (same rejection) |
-| `subagent_dispatched: <regex>` | a sub-agent whose `agentType` **or dispatch description** matches |
+| `no_vm_path_file_op: true` | **`fidelity: hostloop` only** — NO gated file tool attempted a `/sessions`(-prefixed) path (`RunResult.fileToolAttempts`) — content-class, replay-checkable without `controlOut`; any other tier FAILS "cannot verify" (`/sessions/...` is valid there). **Only `true` is valid** |
+| `subagent_file_write: {path?, path_suffix?, tool?}` | a sub-agent-origin write attempt whose raw path equals `path` (exact) or ends with `path_suffix` has a paired non-error tool_result — the causal half of a delivery probe; requires one of `path`/`path_suffix`; `tool` defaults to Write/Edit/MultiEdit; content-class; tier-agnostic |
+| `subagent_dispatched: <regex>` | a sub-agent whose `dispatchAgentType`, binary-*resolved* `resolvedAgentType`, **or dispatch description** matches |
 | `subagent_declared_but_unused: <Tool>` | a sub-agent declared the tool but never used **that** tool (even if it used others) |
-| `subagent_output_contains: {match?, contains}` | a dispatched sub-agent's own output contains the substring `contains` — `match` (optional regex over `agentType`/`description`) narrows to specific dispatch(es); omitted, checks whether ANY dispatch's output contains it (existence check, not "all"); a miss against an output that was **truncated at the assert cap** reports evidence-unavailable instead of a proven absence — the substring could lie past the cut |
+| `subagent_output_contains: {match?, contains}` | a dispatched sub-agent's own output contains the substring `contains` — `match` (optional regex over `dispatchAgentType`/`resolvedAgentType`/`description`) narrows to specific dispatch(es); omitted, checks whether ANY dispatch's output contains it (existence check, not "all"); a miss against an output that was **truncated at the assert cap** reports evidence-unavailable instead of a proven absence — the substring could lie past the cut |
 | `dispatch_count_max: <N>` | at most N sub-agents dispatched — an author-chosen budget (Cowork imposes no in-conversation Task-dispatch cap; records only, enforces nothing — see gotcha 12) |
 | `skill_triggered: <regex>` | a skill matching the regex (invoked id, e.g. `"plugin:skill"`) was invoked via the `Skill` tool — evidence-unavailable (not a normal fail) if the agent's init tools have no `Skill` tool |
 | `no_skill_triggered: <regex>` | no invoked skill id matched — the negative-control / description-collision catcher; evidence-unavailable (never a vacuous pass) if invocation data is absent or the `Skill` tool is unobservable |
@@ -291,6 +299,9 @@ same set live from the schema.
 | `gate_answer_count_min: <N>` | at least N AskUserQuestion gates fired AND were delivered non-error — presence companion to `gate_answers_delivered`'s vacuous-pass |
 | `hook_blocked: <regex>` | a PreToolUse hook blocked a tool whose name matches the regex (`RunResult.hookEvents`) — evidence-unavailable if hook telemetry is absent. Replay: needs a `controlOut` cassette (a custom hook's decision lives only there, not the recorded stream) |
 | `no_hook_blocked: true` | no tool was hook-blocked during the run (distinguishes a real tool crash from an intentional hook block) — evidence-unavailable if hook telemetry is absent. Replay: needs a `controlOut` cassette. **Only `true` is valid** |
+| `vm_path_denied: true` | **`fidelity: hostloop` only** — at least one recorded path denial (`RunResult.pathDenials`, any source) targeted a `/sessions` VM path — evidence-unavailable if path-denial telemetry is absent. Replay: needs a `controlOut` cassette. Any other tier FAILS "cannot verify". **Only `true` is valid** |
+| `path_denied: {tool?, path_matches?, source?, agent_scope?}` | **`fidelity: hostloop` only** — a path denial matching ALL given matchers (`tool` glob, `path_matches` regex, `source` ∈ pretooluse/can_use_tool/permission_denied, `agent_scope` ∈ main/subagent/any) was recorded. Replay: needs a `controlOut` cassette. Any other tier FAILS "cannot verify" |
+| `no_path_denied: true` | **`fidelity: hostloop` only** — NO path denial was recorded at all (the channel is already path-scoped, unlike `no_hook_blocked`'s indiscriminate reject). Replay: needs a `controlOut` cassette. Any other tier FAILS "cannot verify". **Only `true` is valid** |
 | `allow_permissive_auto_allow: true` | verdict modifier — suppresses the default-fail when the run recorded a cowork-parity permissive auto-allow; for tests that deliberately assert Cowork's permissive behavior |
 | `allow_missing_capability: true` | verdict modifier — suppresses the default-fail when the (partial "core") agent image omits a capability the skill used but real Cowork ships (OCR/LibreOffice/markitdown/opencv/PDF-tables). Assert only when the skill's fallback is genuinely equivalent; otherwise rebuild full parity (`--build-arg COWORK_FULL_PARITY=1`). Also opts out of the `requires_capabilities` declared-need check. Live tiers only |
 | `allow_l0_plugin_divergence: true` | verdict modifier — opt into L0/protocol plugin divergence: suppresses the default-fail when a plugin behaves differently at `protocol` (L0) fidelity than under a sandboxed tier. Live tiers only |
@@ -319,7 +330,7 @@ dotted path.
 
 **VerdictSignals in `result.signals`:** `computeVerdict` pushes signals into `result.signals`; most
 are **fail**-severity (they flip the run's pass/exit code even though `result.result` itself stays
-`"success"`) and only two are **warn**-severity (informational, never flip pass/fail). Current signal
+`"success"`) and only three are **warn**-severity (informational, never flip pass/fail). Current signal
 codes (`VerdictSignal["code"]` in `src/run/verdict.ts`):
 
 | Code | Severity | Meaning |
@@ -337,10 +348,11 @@ codes (`VerdictSignal["code"]` in `src/run/verdict.ts`):
 | `stalled` | fail | The run ended on an unanswered question (opt out: `allow_stall`) |
 | `non_deterministic` | warn | The run was LLM/external/human-decided — not reproducible |
 | `prompt_asset_missing` | warn | The run proceeded with a missing prompt asset (`COWORK_HARNESS_ALLOW_MISSING_PROMPT=1`); fidelity is degraded |
+| `scan_unavailable` | warn | Post-run scan evidence unavailable (`RunResult.scan` undefined) — the host-path and outputs-delete guards did not run this run |
 
 A **fail**-severity signal does not change `result.result` (still `"success"`), but it DOES fail the
 overall run verdict and exit code — `assert result: success` alone won't catch it; check
-`result.signals[].severity` or the run's exit code. Only the two **warn** codes are truly benign.
+`result.signals[].severity` or the run's exit code. Only the three **warn** codes are truly benign.
 
 ## Replay class
 
@@ -356,7 +368,8 @@ on recording-shaping drift (`prompt`/`answers`/`baseline`/`skills`) or skill-con
 sourcing ≠ evaluation (replay warns when you edit one). `verify-run` is the on-disk-`assert:` path for a kept
 *run dir*; `--assert-from` is the equivalent for a *cassette*.
 
-**Evaluated on replay (content):** `transcript_*`, `tool_*`, `subagent_*`, `dispatch_count_max`,
+**Evaluated on replay (content):** `transcript_*`, `tool_*`, `subagent_*`, `subagent_file_write`,
+`no_vm_path_file_op`, `dispatch_count_max`,
 `skill_triggered`, `no_skill_triggered`, `skill_available`, `connector_available`, `tool_available`,
 `skill_tool_used`, `max_cost_usd`, `max_tokens`, `tool_calls_max`, `tool_no_error`,
 `max_tool_errors`, `max_redundant_tool_calls`, `max_turns`, `compaction_occurred`, `all_tasks_completed`, `task_status`, `task_count_min`, `no_scratchpad_leak`, `present_files_called`, `result`
@@ -365,7 +378,9 @@ modifiers `allow_permissive_auto_allow` / `allow_missing_capability` / `allow_l0
 `allow_stall` are also kept on replay, evaluated as no-op passes.
 
 **Gate keys — replay only with a `controlOut` cassette:** `question_asked`, `questions_count_max`,
-`gate_answers_delivered`, `gate_answer_count_min`, `hook_blocked`, `no_hook_blocked`. With `controlOut` present they evaluate; on an old
+`gate_answers_delivered`, `gate_answer_count_min`, `hook_blocked`, `no_hook_blocked`, `vm_path_denied`,
+`path_denied`, `no_path_denied` (the latter three are also `fidelity: hostloop`-only — see the assertion
+table). With `controlOut` present they evaluate; on an old
 cassette without it, a **loud warning** fires and they are **excluded** (not vacuously passed). Re-record to enable them.
 `questions_count_max` counts sub-questions, not gates/tool-calls — see the catalog row above and
 `trace --view questions`. `hook_blocked`/`no_hook_blocked` need `controlOut` for a different reason than
@@ -498,8 +513,13 @@ reference omits). Neither list is a strict superset of the other — reach for t
    `artifact_json` (dotted `path` + operator); use the pytest lane (`assert_artifact_json` with a real
    predicate) only for checks too complex for a dotted path. Find field paths via `--keep`.
 
-10. **`subagent_dispatched` matches by `description` too** — skills often dispatch with no
-    `subagent_type` (`agentType:"unknown"`), so match the dispatch description.
+10. **`subagent_dispatched` matches by `resolvedAgentType` or `description` too** — a `Task` dispatch
+    with no `subagent_type` at all falls back to the built-in `general-purpose` agent (a WILDCARD tool
+    surface, `tools:["*"]`, incl. workspace bash) rather than leaving the type unresolved; the harness
+    warns loudly on this fallback and records `subagents[].dispatchTypeOmitted`, so match on the
+    resolved type or the dispatch description. `subagent_tool_absent` on a type-less dispatch is
+    correspondingly weaker evidence (wildcard surface) — pin `subagent_type` explicitly when you need a
+    tight guarantee.
 
 11. **`subagent_declared_but_unused` fires on declared-but-didn't-use-THAT-tool**, even if the
     sub-agent used other tools.

package/.claude/skills/cowork-harness/references/task-recipes.md

@@ -64,8 +64,8 @@ Top-level fields of a `*.cassette.json` (schema `schema/cassette.v10.json`):
 | `preRunHashes` | Pre-run per-path sha256 baseline for `input_unmodified` (added 0.27.0, no cassetteVersion bump); a `null` value marks a path whose recorded artifact body was secret-scrubbed (evidence-unavailable, never a false "modified") |
 | `scenarioSource` | Relative path to the authored YAML this was recorded from |
 | `authoring` | Present iff a live decider answered ≥1 gate during recording (`nonDeterministic: true`) |
-| `sessionFingerprint` | v9+: hash of the session's content-relevant SHAPE (folders/plugins/skills/mcp/egress). Checked ONLY by `verify-cassettes`, never the default replay verdict; absent on a pre-v9 cassette → not checked |
-| `folderPrefixMap` | v9+: the record-time connected-folder host-path → mount-name map. Replay's `computer_links_resolve` uses THIS (never the current session file) for a v9+ cassette; a pre-v9 cassette keeps reconstructing from the current session |
+| `sessionFingerprint` | Optional even on v9+ (the minimum readable version): hash of the session's content-relevant SHAPE (folders/plugins/skills/mcp/egress). Checked ONLY by `verify-cassettes`, never the default replay verdict; absent → not checked |
+| `folderPrefixMap` | Optional even on v9+: the record-time connected-folder host-path → mount-name map. Replay's `computer_links_resolve` uses THIS (never the current session file); absent → the link is treated as evidence-unavailable, never reconstructed from the current session |
 | `timeline`, `timelineHeader` | The recorded per-event timeline (harness-observation timestamps for tool_use/tool_result/subagent_dispatch/thinking/decision/result, in total order) plus its header (`startedAtWall`/`startedAtMono` anchors); informational only — never affects the replay verdict. Absent on a cassette recorded before this field existed |
 | `environment` | Recording provenance: `location` (`"local"` on every cassette this harness produces), plus the resolved `tier` and `agentBinaryFormat` |
 

package/.claude/skills/cowork-harness/scripts/assertion-keys.json

@@ -28,9 +28,12 @@
     "no_delete_in_outputs",
     "no_hook_blocked",
     "no_mcp_error",
+    "no_path_denied",
     "no_scratchpad_leak",
     "no_skill_triggered",
     "no_unexpected_files",
+    "no_vm_path_file_op",
+    "path_denied",
     "present_files_called",
     "question_asked",
     "questions_count_max",
@@ -43,6 +46,7 @@
     "skill_triggered",
     "subagent_declared_but_unused",
     "subagent_dispatched",
+    "subagent_file_write",
     "subagent_output_contains",
     "subagent_tool_absent",
     "subagent_tool_used",
@@ -61,7 +65,8 @@
     "transcript_no_host_path",
     "transcript_not_contains",
     "transcript_not_matches",
-    "user_visible_artifact"
+    "user_visible_artifact",
+    "vm_path_denied"
   ],
   "topLevelKeys": [
     "allow_host_writes",

package/.claude/skills/cowork-harness/scripts/scenario.py

@@ -64,6 +64,8 @@ CONTENT_KEYS = {
     "subagent_dispatched",
     "subagent_declared_but_unused",
     "subagent_output_contains",
+    "no_vm_path_file_op",
+    "subagent_file_write",
     "dispatch_count_max",
     "skill_triggered",
     "no_skill_triggered",
@@ -94,6 +96,9 @@ GATE_KEYS = {
     "gate_answer_count_min",
     "hook_blocked",
     "no_hook_blocked",
+    "vm_path_denied",
+    "path_denied",
+    "no_path_denied",
 }
 # manifest-backed: replay-checkable when the cassette carries an `artifacts` manifest (record snapshots one);
 # a manifest-less cassette skips them. Since the 0.3.0 artifact-manifest these are NOT always live-only.

package/CHANGELOG.md

@@ -6,6 +6,175 @@ All notable changes to this project are documented here. The format is based on
 
 ## [Unreleased]
 
+## [0.30.0] — 2026-07-12
+
+> **Upgrade notes.**
+> - **Breaking (pre-1.0): `subagents[].agentType` renamed to `dispatchAgentType`, and
+>   `subagents[].model` renamed to `dispatchModel`.** A consumer reading either old field name off
+>   `result.json` now gets `undefined`. Both keep their original (dispatch-input) meaning — the
+>   resolved counterparts (`resolvedAgentType`/`resolvedModel`, below) are new, separate fields.
+
+### Added
+
+- **Parity baseline for Claude Desktop 1.20186.1.** `baseline: latest` now resolves to `desktop-1.20186.1`
+  — a patch-only Desktop release (egress allowlist, spawn config, and the Cowork system-prompt
+  fingerprint are unchanged from 1.20186.0). The pinned VM agent ELF was re-synced from 2.1.202 to
+  2.1.205 after a live Desktop self-update within the same Desktop build, restoring agreement between
+  the pinned agent version and what's staged on disk so the host-loop live lane resolves its binary.
+- **Cassette prompt-asset fingerprint.** Prompt identity was previously keyed on `appVersion` alone, so
+  editing a committed prompt-asset file (`spawn.promptTemplate` / `subagentAppend` /
+  `subagentAppendHostLoop`) under the *same* app version silently replayed old-prompt behavior. A cassette
+  now records a hash over the referenced asset files (`fingerprint.promptAssetsHash`); a mismatch is a new
+  warn-by-default staleness finding (`prompt-assets`, fails under `--strict`), an unhashable pointer is a
+  distinct can't-verify finding (`unverifiable-prompt-assets`), and a cassette recorded before this field
+  existed surfaces a non-failing informational note instead of either.
+- **Host-loop sub-agent tool aliasing and gated `web_fetch`.** The host-loop initialize request now
+  carries production's `Bash → mcp__workspace__bash` / `WebFetch → mcp__workspace__web_fetch` aliases
+  (single-hop; an alias never grants a tool a sub-agent's frontmatter didn't already bind).
+- **Five new assertion keys for sub-agent path fidelity.** `no_vm_path_file_op: true` (hostloop-only —
+  no gated file tool attempted a `/sessions`-exact-or-prefixed path); `vm_path_denied: true`
+  (hostloop-only — at least one recorded denial targeted a `/sessions` path; needs `controlOut` on
+  replay); `path_denied: {tool?, path_matches?, source?, agent_scope?}` (hostloop-only — a denial
+  matching all given matchers, `source` ∈ `pretooluse`/`can_use_tool`/`permission_denied`); `no_path_denied:
+  true` (hostloop-only — no path denial recorded at all); and `subagent_file_write: {path?, path_suffix?,
+  tool?}` (**tier-agnostic** — a sub-agent-origin write/edit attempt at the given path, exact or suffix,
+  with a paired non-error tool result — the causal half of a delivery probe, pairs with `artifact_json` for
+  content). The four hostloop-only keys fail "cannot verify" (never vacuous-pass) on any other tier, since
+  `/sessions/...` is a valid path there.
+- **`RunResult.fileToolAttempts`** — attempt-level telemetry (raw `file_path`/`path` as sent, the
+  first-match gate path, and `origin: main|subagent|unknown`) for every gated file-tool call
+  (Read/Write/Edit/Glob/Grep/MultiEdit), re-derivable on replay from the frozen tool_use stream.
+- **`RunResult.pathDenials`** — decision-level path-denial telemetry merged from all three producers that
+  can deny a gated file-tool call on path grounds: the PreToolUse path gate's own callback, a denied
+  `can_use_tool` ask on a gated file tool with a path, and a pre-ask `permission_denied` correlated to a
+  recorded attempt. The `can_use_tool` source is reconstructible on replay only when the cassette carries
+  `controlOut`; without it the field is undefined (evidence-unavailable), never a vacuous `[]`.
+- **`RunResult.subagents[].resolvedAgentType` / `.resolvedModel`.** The agent stream states the
+  binary-*resolved* child type (via `task_started`) and the resolved child model (via the dispatch's own
+  `tool_use_result` envelope) — previously discarded. Both are joined strictly by `toolUseId` and
+  corroborate each other without overwriting stronger evidence. `subagent_dispatched` and
+  `subagent_output_contains` now match on dispatch type, resolved type, *or* description, so a type-less
+  dispatch that resolved to e.g. `general-purpose` is selectable by either assertion.
+- **A loud warning on type-omitted sub-agent dispatches.** A `Task` dispatch that carries no
+  `subagent_type` at all falls back to the built-in `general-purpose` agent (`tools:["*"]` — the wildcard
+  surface, including workspace bash) — faithful production behavior, and one that fires routinely, not
+  just at the edges. The harness now warns loudly when this fallback is observed (an *explicit*
+  `subagent_type: "general-purpose"` is a deliberate author choice and does not warn) and records the
+  omission on the run (`subagents[].dispatchTypeOmitted`), so it's visible in the run's own record, not
+  only in a live terminal warning.
+- **`agent_env` session config knob** (`subagent_model`, `tool_search: "auto"|"off"`,
+  `disable_experimental_betas`) applies `CLAUDE_CODE_SUBAGENT_MODEL` / `ENABLE_TOOL_SEARCH` /
+  `CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS` **uniformly across all four fidelity tiers**. Previously an
+  operator-exported value of any of these three leaked into hostloop/protocol (which spawn over the full
+  operator shell env) but never into container/microvm (a constructed allowlist) — the same session
+  behaved differently depending only on which tier it ran at. The three keys are now also scrubbed from
+  the operator layer on the two inheriting tiers before any baseline/knob overlay, so a stray shell value
+  can never leak through on some tiers and not others; setting any `agent_env` field moves the session
+  fingerprint so `verify-cassettes` surfaces the drift on an older cassette.
+- **`sync` now guards sub-agent prompt and path-gate fidelity.** Two new structural sentinels pin the
+  two-branch (`subagent_env_hl`/`subagent_env_vm`) sub-agent append — the branch-selection ternary,
+  the per-branch content fingerprint, and the substitution map's keys *and* values (a host/VM cwd swap
+  fails) — and the host-loop path gate's module-bounded shape (gated/excluded tool sets, every deny text,
+  the read-only-guard-before-containment order). A separate pinned gate hard-stops the sync (not just
+  warns) if production flips on a server-delivered override of the sub-agent append text, since that flip
+  is invisible to the content sentinel and the harness has no captured override text to fall back to.
+- **`docs/subagents.md`** — the sub-agent capability/path reference: the tier-qualified outputs-addressing
+  contract (host-loop's cwd-relative `artifacts/...` vs. the VM loop's `mnt/outputs/artifacts/...` —
+  there is no single cross-tier literal form), a full capability/path matrix, the sub-agent tool-composition
+  rules (frontmatter allowlists, the `"*"` wildcard, `disallowedTools`, tool aliases, never-subagent
+  tools), the type-less dispatch trap, model-resolution precedence, and lifecycle notes (no resume, a
+  depth cap of 5 with no fan-out cap, fork-dispatch environment-append exclusion).
+
+### Changed
+
+- **Cassette v9 read floor.** `readCassette` now refuses cassettes recorded below v9
+  (`MIN_SUPPORTED_CASSETTE_VERSION`) with a clear re-record error instead of silently tolerating
+  legacy formats; the pre-v9 reconstruction branches (`contentSigAlgoOf`, `buildFolderPrefixMap`'s
+  session-fallback, `cmdRehash`'s pre-v3/pre-v6 checks) are deleted as unreachable, and SPEC.md's
+  stability contract states the floor. The superseded `schema/cassette.v2`–`v8.json` files are
+  removed (v9/v10 remain).
+- **`verify-run` fails closed on degraded evidence.** A `result.json` that parses but is
+  structurally invalid (no `"success" | "error"` result field) refuses instead of being certified
+  as success; an `events.jsonl` with unparseable lines, or one yielding fewer gates than
+  `trace.json` recorded questions, refuses instead of passing answer coverage at a hollow 0/0.
+- **Verdict honesty for missing scan evidence.** When post-run scan evidence is unavailable, the
+  `host-path` / `outputs-delete` guards report `?` (unverified) instead of a false ✓, and a new
+  warn-severity `scan_unavailable` signal surfaces in the verdict JSON.
+- **Release gates hardened.** The CI scenario suite hard-fails on the canonical repo when
+  `ANTHROPIC_API_KEY` is missing on non-PR events (fork and Dependabot PRs keep the warn+skip);
+  image publishing now waits on ci.yml success for the tagged commit and verifies tag↔package
+  lockstep via a composite action shared with the npm release gate (`workflow_dispatch` remains
+  the documented manual-republish escape hatch). An admin can deliberately skip the live scenario
+  suite for a single release by setting a `SKIP_LIVE_SCENARIOS` repo variable to that exact commit
+  SHA — an explicit, auditable, per-commit override (a later commit can't inherit it), not a silent
+  skip; see [RELEASING.md](./RELEASING.md).
+- `ResourceSummary.probeFailures` (shipped at runtime in 0.29.0) is now declared on the RunResult
+  type and JSON Schema; assertion-side consumption remains deferred.
+- **Breaking (pre-1.0): `subagents[].agentType` renamed to `dispatchAgentType`, and `subagents[].model`
+  renamed to `dispatchModel`.** Both keep their original (dispatch-input) meaning — the rename exists only
+  because a *resolved* type/model now lands beside each (`resolvedAgentType`/`resolvedModel`, above) and
+  the old names would have been ambiguous between "what the dispatch asked for" and "what the binary
+  actually ran." No deprecation window; a consumer reading the old field names gets `undefined`.
+- **The host-loop `PreToolUse` path gate is re-ported to Desktop 1.20186.1 semantics.** Plugin/skill
+  content loses its blanket path exemption and becomes a read-only category instead (a mutating tool
+  targeting it is now denied, with its own message, rather than silently passing through); the read-only
+  guard gains the two other production categories — an uploads hardlink write-block and spooled tool
+  results (`projects`) — each with per-session-type deny text; the spool dir joins the readable roots. The
+  harness's own `mode: r` connected-folder extension and the `/sessions` MultiEdit message-selection
+  nuance are preserved across the re-port.
+
+### Fixed
+
+- **Host-loop sub-agent dispatches now receive the correct environment description.** The harness always
+  sent sub-agents the VM-branch environment text, telling them their files exist only in a sandbox while
+  their file tools actually reach the real host filesystem — one of two prompt bugs that could seed
+  `/sessions/...` paths into a host-loop sub-agent's dispatch. A new host-loop-specific append
+  (`subagent_env_hl`) is now selected whenever `effectiveFidelity === "hostloop"` (container/microvm keep
+  the existing VM-branch text; `protocol` sends neither, a documented divergence), delivered on **both**
+  the `run`/`skill` and `chat` lanes (previously `chat` sent no sub-agent append at all).
+- **The host-loop "Shell access" prompt's outputs bullet no longer teaches VM paths to native file tools.**
+  Its file-tool side substituted the VM session root where production substitutes the host outputs
+  directory — the other of the two prompt bugs behind stray `/sessions/...` sub-agent paths.
+- **`web_fetch` on host-loop is now gated through a single `can_use_tool` decision, matching production**,
+  instead of being pre-approved directly by the workspace handler. Bash stays pre-approved for the whole
+  session; a fetch now emits a real permission ask, answered once by the shared provenance/domain
+  decision (which marks provenance on allow) — closing the prior two-decision, self-approving shape.
+- **Raw run logs are scrubbed on every exit path.** Previously only the success and
+  unanswered-gate paths scrubbed `events.jsonl`/`control-out.jsonl`, and `agent.stderr.log` was
+  never scrubbed — a mid-run fault kept raw (potentially secret-bearing) logs on disk. An
+  outermost finally now scrubs all three on success, salvage, and every rethrown fault, in the
+  run and chat lanes alike; leak/capability scanners still read the raw stream first.
+- A truncated `present_files` result (fewer returned paths than inputs, or extras) now counts as
+  malformed evidence, so `no_scratchpad_leak` fails "cannot verify" instead of green-lighting
+  only the pairs that came back.
+- Baseline pins caught up to `desktop-1.20186.1` (the parity sync landed the baseline file
+  without bumping them, leaving `check:versions` red).
+- `docker/Dockerfile.agent` preinstalls `pyyaml==6.0.3`, matching real rootfs provisioning (the
+  container tier no longer exercises the vendored-YAML fallback the real environment never needs).
+
+### Removed
+
+- The subagent-grant canary (`src/canary/`, its fixture, test, and empty snapshot) — never wired
+  to `sync`, and its drift snapshot could never fail.
+- `scripts/boot-rootfs-vz.ts` — the tested-infeasible generic-VZ boot attempt; its finding is
+  preserved in `docs/fidelity-gaps.md`.
+- From the npm tarball: the 1.5 MB README banner and the compiled critique evaluator (relocated
+  to `scripts/lib/critique/`, dev-only) — the package drops from 2.57 MB to ~1.05 MB compressed.
+
+### Docs
+
+- README's `## Status` section collapsed to the baseline-pin sentence (the perishable
+  verification narrative lives in this changelog; the feature catalogue lives in the sections
+  above it).
+- `docs/cowork-spawn-contract-1.12603.1.md` is frozen as historical research and no longer a
+  release version-pin; `check:versions` gates on the SKILL.md and README pins only.
+- Dropped the stale first-run egress-race gotcha (proxy startup has been synchronous for a
+  while); documented `verify-run`'s fail-closed refusal family in `docs/scenario.md` and the
+  companion skill.
+- `docs/subagents.md` (new — see Added) is cross-linked from `docs/boundary.md` and `docs/scenario.md`;
+  `docs/plugin-root.md`'s tier table is corrected — `CLAUDE_PLUGIN_ROOT` is absent from a Bash-tool
+  subprocess's env on **every** tier, not host-loop only, as the table previously implied.
+
 ## [0.29.0] — 2026-07-11
 
 ### Added

package/CONTRIBUTING.md

@@ -51,7 +51,7 @@ test/                 vitest unit tests
 baselines/             committed platform baselines (one per Desktop release)
 examples/             user-facing worked examples (CI-verified): scenarios/ sessions/ skills/ data/
 e2e/                  the harness's own fidelity self-tests: scenarios/ sessions/
-fixtures/             harness runtime fixtures (e.g. subagent-grants.json)
+fixtures/             harness runtime fixtures (protocol/ golden control-response vectors)
 docs/                 guides + references
 ```
 

package/README.md

@@ -91,7 +91,7 @@ node dist/cli.js replay examples/replays/example-pdf-skill.cassette.json
 
 > **Installed globally instead?** Once linked/installed, the same command is `cowork-harness replay
 > <cassette>` — but the relative path above only resolves from a source checkout's `examples/replays/`.
-> From a global install (`npm i -g "cowork-harness@>=0.29.0"`), point at the package root instead:
+> From a global install (`npm i -g "cowork-harness@>=0.30.0"`), point at the package root instead:
 > `cowork-harness replay "$(npm root -g)/cowork-harness/examples/replays/example-pdf-skill.cassette.json"`
 > (or copy the cassette into your own project and pass that path).
 
@@ -101,7 +101,7 @@ Live `run`/`skill` need the prerequisites in the next section — note the `prot
 > - **Replay only (zero setup):** `cowork-harness replay <cassette>` — no token, no Docker, no agent. The command above.
 > - **`protocol` (real model, no Docker):** needs only the auth token (item 3 below).
 > - **Live `container` / `microvm` / `hostloop` / `cowork`:** needs Docker (or Lima for `microvm`), a staged agent, and the token — run `cowork-harness doctor` first.
-> - **Invocation:** from a source checkout, `node dist/cli.js <cmd>` (or `npm link` to get the `cowork-harness` command); from a global install, `cowork-harness <cmd>`; the companion skill falls back to `npx "cowork-harness@>=0.29.0"`.
+> - **Invocation:** from a source checkout, `node dist/cli.js <cmd>` (or `npm link` to get the `cowork-harness` command); from a global install, `cowork-harness <cmd>`; the companion skill falls back to `npx "cowork-harness@>=0.30.0"`.
 
 Two more worked examples worth knowing about: `examples/scenarios/protocol-smoke.yaml` (zero-Docker smoke
 test) and `examples/scenarios/skill-loads.yaml` (container-tier acceptance check) — see
@@ -126,7 +126,7 @@ claude plugin marketplace add yaniv-golan/cowork-harness
 claude plugin install cowork-harness@cowork-harness
 ```
 
-The skill **self-bootstraps the CLI**: if `cowork-harness` isn't on your PATH it falls back to `npx "cowork-harness@>=0.29.0"` (a version floor that fails loud rather than silently fetching a too-old CLI; Node ≥ 20). Tiers above `protocol` still need Docker/Lima and a Claude Desktop agent binary — see the prerequisites below.
+The skill **self-bootstraps the CLI**: if `cowork-harness` isn't on your PATH it falls back to `npx "cowork-harness@>=0.30.0"` (a version floor that fails loud rather than silently fetching a too-old CLI; Node ≥ 20). Tiers above `protocol` still need Docker/Lima and a Claude Desktop agent binary — see the prerequisites below.
 
 It also follows the open [Agent Skills](https://agentskills.io) spec, so it installs cross-editor (Cursor, Codex, OpenCode, …) via [`npx skills`](https://github.com/vercel-labs/skills) (Vercel Labs' CLI implementation of that spec):
 
@@ -147,7 +147,7 @@ A global install is enough for CI `lint`, reading the teaching skill, and replay
 To `run` the worked examples live or copy them as a starting point, use a source checkout. (The marketplace
 skill install itself only pulls `.claude/skills/cowork-harness/` — SKILL.md + `references/` + `scenario.py`/
 assertion keys, per `.claude-plugin/marketplace.json`'s `source` — not the rest of this table; the full set
-above becomes available once the skill's first command self-bootstraps `npx "cowork-harness@>=0.29.0"` — see
+above becomes available once the skill's first command self-bootstraps `npx "cowork-harness@>=0.30.0"` — see
 [above](#drive-it-from-claude-code-companion-skill) — which pulls the same npm package as the global-install row.)
 
 ### Prerequisites for anything above `protocol` fidelity
@@ -225,8 +225,8 @@ cowork-harness lint examples/scenarios/*.yaml
 >
 > | When | Assertions |
 > |---|---|
-> | Always | `transcript_*`, `tool_*`, `subagent_*`, `dispatch_count_max`, `skill_triggered`/`no_skill_triggered`, `max_cost_usd`/`max_tokens`/`tool_calls_max`/`max_turns` (against the *frozen recording's* spend, not fresh spend — a live `run` catches a real budget regression), `max_tool_errors`, `max_redundant_tool_calls`, `skill_available`, `connector_available`, `skill_tool_used`, `compaction_occurred`, `all_tasks_completed`, `task_count_min`, `task_status`, `no_scratchpad_leak`, `present_files_called`, `result`, the verdict modifiers |
-> | Only if the cassette carries `controlOut` | `question_asked`, `questions_count_max`, `gate_answers_delivered`, `gate_answer_count_min`, `hook_blocked`, `no_hook_blocked` |
+> | Always | `transcript_*`, `tool_*`, `subagent_*`, `no_vm_path_file_op`, `dispatch_count_max`, `skill_triggered`/`no_skill_triggered`, `max_cost_usd`/`max_tokens`/`tool_calls_max`/`max_turns` (against the *frozen recording's* spend, not fresh spend — a live `run` catches a real budget regression), `max_tool_errors`, `max_redundant_tool_calls`, `skill_available`, `connector_available`, `skill_tool_used`, `compaction_occurred`, `all_tasks_completed`, `task_count_min`, `task_status`, `no_scratchpad_leak`, `present_files_called`, `result`, the verdict modifiers |
+> | Only if the cassette carries `controlOut` | `question_asked`, `questions_count_max`, `gate_answers_delivered`, `gate_answer_count_min`, `hook_blocked`, `no_hook_blocked`, `vm_path_denied`, `path_denied`, `no_path_denied` |
 > | Only if the cassette carries an `artifacts` manifest | `file_exists`, `user_visible_artifact`, `artifact_json`, `computer_links_resolve`, `computer_links_resolve_if_present`, `no_unexpected_files`, `input_unmodified` |
 > | Always skipped (live-only) | `egress_*`, `expect_denied`, `no_delete_in_outputs`, `self_heal_ran`, `transcript_no_host_path`, `no_mcp_error`, `max_peak_rss_bytes`, `semantic_matches` — keep these in a periodic live `run` |
 >
@@ -766,6 +766,7 @@ a global install has them locally too, not just on GitHub.
 | [docs/boundary.md](./docs/boundary.md) | The limitations model — sealed FS, default-deny egress, MCP-only crossing; how each tier enforces it; how to verify. |
 | [docs/session.md](./docs/session.md) | Every `sessions/*.yaml` field and its Cowork mapping. |
 | [docs/scenario.md](./docs/scenario.md) | `scenarios/*.yaml` — prompt, scripted answers, assertions. |
+| [docs/subagents.md](./docs/subagents.md) | The sub-agent capability/path model — tier-qualified outputs contract, tool-composition rules, the type-less dispatch trap. |
 | [docs/chat.md](./docs/chat.md) | The interactive `chat` REPL — multi-turn debugging, flags, attaching files/folders. |
 | [docs/debugging.md](./docs/debugging.md) | Debugging a run — `inspect`/`trace`/`chat`/`verify-run` for a misbehaving skill; the false-green hunt for a green you don't trust. |
 | [docs/cassette.md](./docs/cassette.md) | `record`/`replay` cassettes — what replay checks, which assertions are skipped. |
@@ -798,25 +799,7 @@ inputs/outputs. Human-readable terminal text is explicitly **not** part of the c
 
 ## Status
 
-**Verified end-to-end against the live staged agent (VM ELF 2.1.202 / native host app 2.1.205 / asar 1.20186.0).** Host-side parity (egress/gates/mount/web_fetch facts) re-derived via `sync` — no unknown deltas; `asarFingerprint` moved (a 1.19367.0→1.20186.0 minifier re-anchor: hoisted helpers became namespace-method calls, spreads became export aliases — value-resolved contract unchanged, extractor re-anchored in `src/sync/cowork-sync.ts`), and `nativeStagedPath` moved to the natively-staged `2.1.205` (the native macOS app and the VM ELF version on independent cadences). The reconstructed prompt appends were re-checked against the new asar: the system-prompt source added a trailing `{{modelIdentity}}` placeholder, but it is deployment-gated and stripped on the first-party Cowork emulated here, so the rendered prompt is byte-identical — the load-bearing "is NOT Claude Code" correction, the host-loop `## Shell access` generator, and the web_fetch/mount facts all still hold. The live scenario suite (`protocol` + `container` + `hostloop` tiers) passes against this baseline (fresh live re-run 2026-07-11; 5/6 scenarios, `example-pdf-skill` needs the full-parity image). The latest shipped baseline — what `baseline: latest` resolves to (`cowork-harness list`) — is **`desktop-1.20186.0`** (the committed baseline file and version-lockstep checks track it; it additionally carries the synced per-model effort config, and there are no known spawn-contract deltas — the `1.20186.0` bundle's anchor drift was benign and is resolved in `src/sync/cowork-sync.ts`).
-
-- ✅ **Three isolation tiers (L0/L1/L2) + two loop-mode overlays** — see [Fidelity tiers](#fidelity-tiers-pick-per-scenario--per-ci-job) for the full decision guide; in short:
-  - `protocol` (L0, control loop only), `container` (L1, sandboxed arm64 + per-run default-deny egress sidecar), `microvm` (L2, real Apple-VZ Linux microVM + guest firewall).
-  - `hostloop` (production split-execution: native host agent process, file tools routed host-side via the workspace SDK-MCP server into a Docker VM sidecar) and `cowork` (auto-picks `hostloop` vs `container` the way Cowork does, via gate `1143815894`).
-  - Egress enforced at `container`/`microvm`/`hostloop`; `boundary-check` reports **ALL CONSTRAINTS ENFORCED**.
-- ✅ **Three-seam driver** — `AgentSession` (control protocol) → `Decider` (scripted + `on_unanswered` policy, no silent false-greens) → `Run` (turn loop, sub-agent dispatch tree, `RunRecord`). Multi-turn `chat`, deterministic cassette `record`/`replay` (no token), `run.jsonl`/`trace.json` logging with secret-scrub.
-- ✅ **Answering live questions, every way you'd need** — four independent channels, all incapable of silently picking option 1 (an unhandled question always fails loud):
-  - `--decider-llm --intent "<one line>"` — a model picks per question, steered by your test intent (the ergonomic default); defaults to **Sonnet** (a weaker model prose-declines ambiguous judgment gates → fail-loud); override with `--decider-model <id>` to pin a cheaper or stronger model. It replies with the option **number** (mapped to the exact label, so it can't whiff by parroting label text); an out-of-set reply fails loud, and non-determinism is flagged so a green isn't mistaken for a scripted pass. ⚠️ A *decided* gate whose answer feeds a **semantic** assertion can still false-green — script those instead.
-  - `--answer-policy <yaml>` / `--answer "rx=c"` — declarative regex→label, deterministic for CI (accepts a **stable partial anchor** for skills whose labels drift run-to-run).
-  - `--decider-cmd '<helper>'` — custom logic via the Python `serve_decider(fn)` adapter, which pre-builds the wire loop so the helper writes only the decision.
-  - `--decider-dir <dir>` — the *driving agent* answers each gate **in-band** with full context: it arms a Monitor on `cowork-harness gates <dir> --follow` and replies with `cowork-harness answer <dir> --gate <N> --choose <label>`; the session-under-test stays live, no resume/re-worded question (binary-verified).
-  - **multiSelect gates** are answerable on every channel — repeat `--choose` (or, for `--decider-llm`, a comma-list of option numbers; or a JSON-array reply from a `--decider-cmd` helper / hand-written `resp-N.json`); all deliver the binary-verified `", "`-joined wire shape. Every channel keeps stdout free, so all compose with `--output-format json`. Validate any decider in ~2s with `cowork-harness decide`.
-- ✅ **Sub-agent aggregation + `trace`** — recognizes the real `Agent` dispatch tool (binary-verified; `Task` is its alias) so `subagent_dispatched`/`dispatch_count_max` fire under `--fidelity cowork`, excluding the `TaskCreate` todo list; `cowork-harness trace <id> --view tools` digests `events.jsonl` (each tool row now shows its **result status** `ok`/`error`), and `trace <id> --view questions` shows the gate lifecycle (**question → injected answer → delivered result**); `result.json`/`--keep` surface the deep `mnt/outputs` deliverable path.
-- ✅ **Answer delivery is verified, not assumed** — an AskUserQuestion answer is injected as the binary's full tool input (`{questions, answers}`, ELF-verified), so the answer actually reaches the model; `RunResult.gateDeliveries[]` + the `gate_answers_delivered` assertion catch any delivery failure, and `RunResult.toolCounts` gives the **truthful** per-tool call count (host-routed `WebSearch` shows here, not the always-0 `usage.server_tool_use`).
-- ✅ **Binary-grounded fidelity** — cwd `/sessions/<id>`, the three-channel MCP model (`--mcp-config` honored in plain cowork mode; host/API-routed `web_fetch`; SDK-server delivery), host-loop tool partition, auth-env token-only drop, and production GrowthBook gates pinned per release.
-- ✅ The agent binary is **bind-mounted from your own install** at run time — nothing Anthropic-owned is in any image or distributed.
-- ✅ **File provision & session resume** — `--upload <file>` / `--folder <dir>` attach files & connect folders (`mnt/uploads`, `mnt/<folder-name>`); `--session-id <id>` + `--resume` persist and continue a session via the agent's *native* resume (binary-verified), so checkpoint-and-resume gated skills are testable. Demonstrated end-to-end in the live-contract suite (`test/live-contract.test.ts`: codeword established → resumed → recalled).
-- ✅ **The full unit suite + the live-contract suite green**; a `cowork` pytest lane (`python/`) for skill authors.
-- ℹ️ **Auth:** a `claude setup-token` OAuth token (or `ANTHROPIC_API_KEY`), provided via the env, `--dotenv <path>`, `./.env`, or the install's own `.env` (gitignored; keep it out of mounted folders). It's passed into the sandbox **off the process argv** (Docker: `-e KEY` inherit-by-name; microVM: a stdin prologue) so the token isn't visible via `ps`/`/proc`, scrubbed from logs, never persisted in a runtime path; the token-only path mirrors the desktop. A fresh `CLAUDE_CONFIG_DIR` alone breaks local OAuth.
-
-See [SPEC.md](./SPEC.md) (the testable contract), [DESIGN.md](./DESIGN.md) (architecture + parity), and [CHANGELOG.md](./CHANGELOG.md).
+The latest shipped baseline — what `baseline: latest` resolves to (`cowork-harness list`) — is
+**`desktop-1.20186.1`**. Release-by-release verification notes (what was re-verified against
+which live agent/asar) are recorded in [CHANGELOG.md](./CHANGELOG.md); the feature catalogue
+this section used to duplicate lives in the sections above.