cowork-harness 0.4.3 → 0.6.0

package/.claude/skills/cowork-harness/scripts/assertion-keys.json

@@ -1,6 +1,7 @@
 {
   "$comment": "GENERATED from the Zod Assertion schema (src/types.ts) by scripts/gen-schema.ts — do not edit; run `npm run schema`.",
   "keys": [
+    "allow_l0_plugin_divergence",
     "allow_permissive_auto_allow",
     "artifact_json",
     "dispatch_count_max",

package/.claude/skills/cowork-harness/scripts/scenario.py

@@ -68,7 +68,7 @@ LIVE_ONLY_KEYS = {
 }
 EGRESS_KEYS = {"egress_denied", "egress_allowed"}
 # verdict modifiers — don't verify anything themselves (e.g. suppress a default-fail)
-VERDICT_MODIFIER_KEYS = {"allow_permissive_auto_allow"}
+VERDICT_MODIFIER_KEYS = {"allow_permissive_auto_allow", "allow_l0_plugin_divergence"}
 
 # Every key the replay-class logic knows how to handle. `replay_protocol_fidelity` is valid-but-not-authorable
 # (errored separately below). This is also the embedded fallback for ASSERT_KEYS — kept EQUAL to the generated
@@ -115,6 +115,7 @@ TOP_LEVEL_KEYS = {
     "answers",
     "expect_denied",
     "assert",
+    "skills",  # F-6: opt-in skill-staleness hash scope
 }
 REGEX_KEYS = {
     "transcript_matches",

package/CHANGELOG.md

@@ -6,6 +6,142 @@ All notable changes to this project are documented here. The format is based on
 
 ## [Unreleased]
 
+## [0.6.0] — 2026-06-19
+
+### Breaking changes
+
+- **Exit code 3 for boundary/integrity violations.** Commands that previously exited `2` for a
+  boundary constraint (e.g. `skill` hitting the egress sandbox, `run` with a `boundary`-category
+  failure) now exit `3`. Exit `2` is narrowed to usage errors, unknown flags, and runtime errors.
+  Scripts that check `$? -eq 2` to detect boundary failures must be updated to `$? -eq 3`.
+- **`verify-cassettes --staleness-only` / `--privacy-only` removed.** Replaced by
+  `--skip-staleness` (run privacy scan only) and `--skip-privacy` (run staleness scan only). The
+  old flags are not aliased — they now exit `2` as unknown flags.
+- **`decide` with no configuration exits `2` instead of `1`.** Previously, calling `decide` with no
+  `--decider-*`, `--answer`, or `--answer-policy` would fall through to a `ScriptedDecider([])` and
+  exit `1` ("no rule matched"). It now fails early with exit `2` ("no decider configured") and a
+  clear message.
+
+### Added
+
+- **`chat` — full flag parity for interactive debugging:**
+  - `[prompt]` — optional seed prompt sent as the first turn before the REPL opens.
+  - `--upload <file>` (repeatable) — attach a file at `mnt/uploads/<basename>`; live at session start.
+  - `--folder <dir>` (repeatable) — connect a project folder at `mnt/.projects/<basename>` as a live bind mount.
+  - `--verbose` / `-V` — show thinking blocks, tool inputs, and the sub-agent tree (previously hardcoded off).
+  - `--fidelity protocol` — no-Docker fastest tier; accepted alongside `container` and `hostloop`.
+  - `--model` in `--raw` mode — previously silently dropped; now passed as `--model <id>` to the docker argv.
+  - Idle heartbeat wired in all three fidelity branches (protocol / hostloop / container).
+  - Run ID printed at session start (before first turn) so a mid-session crash still tells you where the transcript is.
+- **`assertions` command** — canonical rename of `assert`; `assert` is kept as a deprecated alias
+  that prints a migration notice. `assertions --list` is the new canonical form.
+- **`scaffold <run-id>` positional** — canonical form; `--from-run <id>` is kept as a deprecated
+  alias that prints a migration notice.
+- **`trace --view tools|questions|dispatches`** — replaces the three separate `--tools` / `--gates`
+  / `--dispatches` flags with a single `--view` enum. Legacy flags are kept as backward-compat
+  aliases (`--gates` maps to `--view questions`).
+- **Env-var defaults for all live commands:**
+  - `COWORK_HARNESS_FIDELITY` — default fidelity tier for `skill` and `chat` (validated; exits 2 on an invalid value).
+  - `COWORK_HARNESS_MODEL` — default model override for `skill` and `chat`.
+  - `COWORK_HARNESS_OUTPUT_FORMAT` — default `--output-format` for all commands (`text` or `json`).
+- **`decide` no-decider guard** — calling `decide` with no configuration fails immediately with a
+  clear message and exit `2` instead of falling through to a vacuous "no rule matched" exit `1`.
+- **`vm` per-subcommand `--help`** — `vm <sub> --help` prints the subcommand usage and exits `0`.
+- **`--quiet` / `-q` accepted in `decide`** — no-op flag for flag-surface consistency with `skill` / `run`.
+
+### Fixed
+
+- **`--rerecord-stale` now prefers on-disk scenario over embedded snapshot (G-1).** When a
+  `scenarios/<name>.yaml` exists alongside the cassette dir, `--rerecord-stale` re-records from it
+  instead of the embedded copy. Edits to the scenario (e.g. adding `skills:` for staleness scoping)
+  now take effect. Falls back to the embedded snapshot when no on-disk file is found, with a clear
+  warning.
+- **Staleness message distinguishes format-version bump from real content change (G-2).** After a
+  harness upgrade that changes the hash algorithm, `verify-cassettes` now reports
+  `recorded under an older hash format (vN → vM)` instead of the misleading
+  `local skill/plugin dir contents changed`.
+- **`.cowork-hashignore` leading-slash patterns now correctly anchor to the mount root (G-3).**
+  `/tests` previously compiled to a regex that never matched (no leading slash in relative paths);
+  it now matches only the top-level `tests/` dir, as expected.
+- **Scoped staleness findings now name the changed bucket (G-4).** When a cassette was recorded with
+  `skills: [<name>]` scoping, `verify-cassettes` now reports `skills/<name> changed` or
+  `shared root changed` rather than the generic `local skill/plugin dir contents changed`.
+- **Unknown flags in `chat` now exit `2`.** Previously ignored silently; any unrecognised flag now
+  exits `2` with a clear message.
+- **`chat --model` bounds-checked.** If `--model` is the last argument (no value following), the
+  command now exits `2` with a clear message instead of silently using `undefined`.
+- **`cmdSync` platform guard fires before argument parsing.** On non-macOS platforms the guard now
+  exits before `parseArgs`, so `sync --help` on Linux no longer crashes on a missing flag.
+- **`record` conflict check.** Passing both a positional and `--cassette` now exits `2` immediately
+  instead of silently preferring one.
+- **L0 plugin divergence signal.** `spawnProtocol` now reports whether the skill resolved at L0
+  (no container) vs. L1, so callers can surface the divergence accurately.
+- **System-prompt threading.** `systemPromptAppend` is now passed through all runtime paths that
+  previously dropped it.
+- **Strict agent binary resolution.** When the exact staged binary path is missing, the harness now
+  fails with a clear message pointing to `COWORK_HARNESS_ALLOW_AGENT_FALLBACK=1` instead of
+  silently falling back to an arbitrary sibling version.
+- **Path traversal guard on plugin sources.** Plugin source paths are now validated to be
+  directories (not files or traversal strings) before mounting.
+- **Cassette correctness (batch):** privacy/staleness coverage tracking, redaction verdict
+  preservation across re-records, base64-encoded artifact body scanning, and exhaustiveness
+  checks on the replay assertion set.
+
+## [0.5.0] — 2026-06-18
+
+### Added
+
+- **`verify-run <run-dir> <scenario.yaml>`** — re-evaluate a scenario's `assert:` block against an
+  already-kept run dir with **no live agent** (no tokens, no Docker). Fixing a wrong assertion was a full live
+  re-record (~17 min); this turns it into ~1s. Reconstructs the assert context from the run's `result.json` +
+  the `run.jsonl`/`trace.json` sidecars and routes the verdict through the same path as a real record. Refuses
+  (rather than false-passing) when a filesystem assertion needs a work dir that's already torn down.
+- **`record --max-artifact-bytes <n>` / `COWORK_HARNESS_MAX_ARTIFACT_BYTES`** — override the 64 KiB
+  inline-body cap so a large structured deliverable can be inlined instead of stored hash-only. Paired with a
+  **record-time guard**: if an `artifact_json` asserts an artifact that had to be truncated, record now fails
+  (or warns under `--allow-failing`) at the cause, instead of producing a green record that goes red at replay
+  (no committed body to parse).
+- **`verify-cassettes --allow-domain` / `--allow-email` / `--allow-file`** — class-scoped privacy allows, plus
+  a version-controlled allow file (one regex per line, `#` comments).
+- **Scoped cassette-staleness fingerprint** — scenario **`skills: [<name>]`** narrows the staleness hash to the
+  named skills' dirs plus the plugin's shared roots (fail-closed to whole-tree on an unknown name); session
+  **`staleness.hash_ignore`** globs and a plugin-local **`.cowork-hashignore`** file (composed) drop
+  non-runtime paths (`tests/`, `docs/`). Default behavior is unchanged (whole-tree, byte-identical). Cassette
+  format bumped to **v2** (an older reader warns rather than mis-flagging a scoped cassette as stale).
+- **Per-subcommand `--help`** — subcommands now print a usage line and exit 0 instead of answering `--help`
+  with `unknown flag` (exit 2).
+- **Cowork identity in the system-prompt append** — the emulated agent now self-identifies as "Claude, the
+  Cowork assistant" and is told it is **not** Claude Code (verified against the installed Claude Desktop app;
+  reconstructed, not bundled).
+
+### Fixed
+
+- **Privacy allows are whole-token + class-scoped.** A bare `--allow <regex>` previously substring-matched, so a
+  domain allow (`example\.com`) silently cleared an email finding (`alice@example.com`) whose domain it matched.
+  Allows are now anchored to the whole finding token, and `--allow-domain`/`--allow-email` can't bleed across
+  classes — the email tripwire stays live.
+- **Staleness hash no longer over-fires.** A pure `plugin.json` `version` bump (and, with the new scoping knobs,
+  unrelated skills/tests/docs) no longer re-stales every cassette in a multi-skill plugin. *Upgrade note:*
+  because the hash now ignores the `plugin.json` `version` field, cassettes recorded before this release
+  recompute to a new digest and are flagged **stale once** after upgrading — re-record them
+  (`record --rerecord-stale`). The cassette format is also bumped to **v2**.
+- **`chat` is pipe/script-safe.** A piped/non-interactive stdin reaching EOF mid-turn crashed the REPL with
+  `ERR_USE_AFTER_CLOSE`; it now exits cleanly.
+- **Outputs-delete findings show the `rm` itself.** A long `VAR=…` assignment prefix used to push the operative
+  delete past the truncation; the finding now isolates and variable-resolves the delete target.
+- **Clearer record/run messaging.** The record freeze-refusal separates the run *result* from the *verdict* and
+  names the failing signal; the run log states the unscripted-question *policy* instead of reading as a failure
+  on clean runs.
+- **`sync` warns when a synced baseline lacks its host-loop prompt asset** — previously host-loop records
+  silently ran with an empty shell-access section.
+
+### Internal
+
+- Corrected the system-prompt fidelity note in `docs/boundary.md` (Cowork appends onto the `claude_code` preset
+  by default rather than replacing it).
+- Assertion docs steer content checks to `artifact_json` / stable lexical markers (not paraphrasable prose).
+- `vitest` excludes `runs/` from test discovery (ephemeral live output could crash the walk with EACCES).
+
 ## [0.4.3] — 2026-06-18
 
 ### Fixed

package/README.md

@@ -15,6 +15,11 @@ Scriptable, CI-friendly test harness that reproduces **Claude Cowork's observabl
 
 **Contents:** [Why it works](#why-this-works-for-skill-testing) · [Fidelity tiers](#fidelity-tiers-pick-per-scenario--per-ci-job) · [Quick start](#quick-start) · [Session + scenario](#two-files-session--scenario) · [Boundary](#sandboxing-container-vs-the-real-vm) · [Discovery](#discovery-marketplaces-plugins-skills-mcp) · [Testing & CI/CD](#testing--cicd) · [Maintenance](#maintenance-parity-between-releases) · [Docs](#documentation)
 
+> **Requirements at a glance**
+> - **Free demo (`replay`):** Node ≥ 20 — nothing else (no Docker, token, or Claude Desktop).
+> - **Live tiers** (`container` default / `microvm` / `hostloop`): **Docker (arm64)** · **Claude Desktop opened once** (stages the agent — nothing is bundled) · a **Claude token** (real per-run cost; runs take minutes). The `protocol` tier skips Docker + the staged agent but still calls a real model, so it needs the token.
+> - **Platform:** best on **macOS Apple Silicon**; **Windows is not supported** for the live tiers (use the token-free `replay`); `sync` and `microvm` are **macOS-arm64 only**. Full detail in [Quick start → prerequisites](#quick-start).
+
 > **New here?** Read [docs/boundary.md](./docs/boundary.md) (the limitations model) and [docs/session.md](./docs/session.md) (the file you'll author).
 
 > **What this is and isn't.** This is an *emulator of the contract*, not the Desktop runtime. Cowork's real session control plane lives behind the Desktop renderer's IPC (per-build UUID + `senderFrame` origin checks) and the app ships with remote debugging disabled (verified: `--remote-debugging-port` opens no listener; Electron `EnableNodeCliInspectArguments` fuse is OFF). So you **cannot** drive the real Apple Virtualization.framework microVM from a script. What you *can* faithfully reproduce is everything that actually changes how a **skill** behaves: the same agent binary in **cowork mode** (`CLAUDE_CODE_IS_COWORK=1` — there is no `--cowork` flag), the same mount layout, the same egress allowlist, and the same permission/question protocol. That's what this project does.
@@ -73,16 +78,20 @@ Skill testing is the headline use, but the tool is a general harness over the Co
 |---|---|---|
 | `skill <folder> "<prompt>"` | Run a local skill/plugin folder once against the staged agent | ad-hoc "is the skill alive / does it do X?" — the fast inner loop |
 | `run <scenario.yaml \| dir/>` | Run authored scenarios with `assert:` + a CI-ready exit code | you want a repeatable, **asserted regression test** |
-| `chat <folder>` | Interactive multi-turn REPL against a skill (TTY) | debugging a multi-turn flow by hand |
-| `record` / `replay` | `record` saves a control-protocol cassette (one scenario, or batch a `dir/`; `--rerecord-stale` refreshes only drifted ones); `replay` runs a cassette **file or a `dir/` of `*.cassette.json`** deterministically (`<file\|dir>`, `--cassette <file>` for the explicit single form; `--strict` fails on a stale one; exits on the worst verdict) | **token-free, Docker-free CI** from a once-recorded run |
-| `verify-cassettes <file\|dir>` | Token-free CI gate over committed cassettes: a privacy scan (email/currency/domain → exit 1) + a staleness check (`--staleness-only`). A dir argument scans `*.cassette.json` in that dir only (**non-recursive**) | gating **committed cassettes** against PII leaks + "edited the skill, forgot to re-record" |
-| `trace <run-id>` | Digest a run's `events.jsonl` (`--tools`, `--gates`, `--dispatches` for the sub-agent dispatch tree + total) | "how many sub-agents *actually* dispatched, and which?" |
-| `scaffold --from-run <id>` | Turn a kept run into a starter scenario YAML (gates→answers, artifacts→`file_exists`) | authoring a scenario from a real run instead of guessing |
-| `assert --list` | List the available scenario assertions (generated from the schema) | "what can I assert?" without grepping the source |
+| `chat <folder> [prompt]` | Interactive multi-turn REPL against a skill (TTY); optional seed prompt is sent as the first turn. `--upload <file>` / `--folder <dir>` (repeatable) attach files/project folders; `--verbose` / `-V` shows thinking blocks + tool inputs; `--fidelity protocol\|container\|hostloop` | debugging a multi-turn flow by hand |
+| `record` / `replay` | `record` saves a control-protocol cassette (one scenario, or batch a `dir/`; `--rerecord-stale` refreshes only drifted ones; `--max-artifact-bytes` raises the 64 KiB inline-body cap); `replay` runs a cassette **file or a `dir/` of `*.cassette.json`** deterministically (`<file\|dir>`, `--cassette <file>` for the explicit single form; `--strict` fails on a stale one; exits on the worst verdict) | **token-free, Docker-free CI** from a once-recorded run |
+| `verify-cassettes <file\|dir>` | Token-free CI gate over committed cassettes: a privacy scan (email/currency/domain → exit 1; whole-token allows via `--allow` / class-scoped `--allow-domain` / `--allow-email` / `--allow-file`) + a staleness check (`--skip-privacy` or `--skip-staleness` to run only one half). A dir argument scans `*.cassette.json` in that dir only (**non-recursive**) | gating **committed cassettes** against PII leaks + "edited the skill, forgot to re-record" |
+| `verify-run <run-dir> <scenario.yaml>` | Re-evaluate a scenario's `assert:` against an already-kept run dir — **no live agent, no tokens, no Docker** (~1s) | iterating on a wrong assertion without a full live re-record |
+| `trace <run-id>` | Digest a run's `events.jsonl` (`--view tools\|questions\|dispatches`; legacy `--tools` / `--gates` / `--dispatches` aliases still accepted) | "how many sub-agents *actually* dispatched, and which?" |
+| `scaffold <run-id>` | Turn a kept run into a starter scenario YAML (gates→answers, artifacts→`file_exists`); `--from-run <id>` is a deprecated alias for the positional | authoring a scenario from a real run instead of guessing |
+| `python3 …/scenario.py scaffold --name <name> --skill <dir>` | Generate a starter scenario skeleton from scratch (the `…` is `.claude/skills/cowork-harness/scripts/`; `cowork-harness lint --help` shows the resolved path) | starting a new scenario when you have no prior run |
+| `lint <scenario.yaml>…` | Check scenarios for silent false-greens — assertions placed on the wrong CI lane, mixed content/live keys, missing `controlOut`-required keys (bundled `scenario.py`; needs python3 + PyYAML) | before committing a new scenario or after changing assertions |
+| `assertions --list` | List the available scenario assertions (generated from the schema); `assert` is a deprecated alias | "what can I assert?" without grepping the source |
 | `decide` | Validate a decider against a sample question in ~2 s (no run) | sanity-check a `--decider-*` / `--answer` wiring before a long run |
 | `gates` / `answer` | Stream / answer in-band gates for `--decider-dir` | a **driving agent** answers live questions via a Monitor |
-| `boundary-check [baseline]` | Prove the sandbox enforces Cowork's limitations | verifying the harness's own fidelity |
+| `boundary-check [baseline] [--session <file>]` | Prove the sandbox enforces Cowork's limitations; `--session` folds a session's `egress.extra_allow` into the probe allowlist | verifying the harness's own fidelity |
 | `sync` / `list` | Derive/refresh & list platform baselines from the Desktop install | after Claude Desktop updates (baselines ship, so it's optional otherwise) |
+| `doctor [--tier <t>]` | Read-only prerequisite check (Docker, staged agent, token, baseline); prints the exact `docker build` line if the agent image is missing | "can I run the live tiers — what's missing?" before a first live run |
 | `vm <init\|status\|delete\|prune>` | Manage the L2 Apple-VZ / Lima microVM (`prune` removes orphaned VMs left by config/agent-version changes) | running `--fidelity microvm` |
 
 There's also a **Python `cowork` pytest lane** (`python/`) for driving any of this from `pytest` beside your normal tests — see [`python/README.md`](./python/README.md).
@@ -111,7 +120,7 @@ cowork-harness skill ~/my-plugin 'review this deck' --upload deck.pdf      # att
 cowork-harness skill ~/my-plugin "..." --session-id s1                     # pin a session…
 cowork-harness skill ~/my-plugin '<next turn>' --session-id s1 --resume    # …then resume it (gated/checkpoint skills)
 cowork-harness skill ~/my-plugin "..." --keep                            # then: trace the run
-cowork-harness trace <run-id> --tools                                     # tool calls + sub-agent dispatches from events.jsonl
+cowork-harness trace <run-id> --view tools                                # tool calls + sub-agent dispatches from events.jsonl
 cowork-harness skill --help                                               # full per-command flag reference
 
 cowork-harness chat ~/my-plugin                  # interactive multi-turn REPL (full harness: egress sandbox + control protocol)
@@ -124,8 +133,8 @@ cowork-harness chat ~/my-plugin                  # interactive multi-turn REPL (
 `run`/CI), `prompt` (ask at the TTY — the default for `skill` when interactive), or `first` (pick
 option 1, loudly warn). Pick with `--on-unanswered`; left unset, `skill` is **adaptive** (`prompt` on
 a TTY, `fail` when piped/CI) and `run` is always `fail`. Exit codes: `0`
-pass · `1` assertion/agent failure · `2` usage /
-unanswered-under-`fail` / boundary / runtime. After a run, the footer **echoes every auto-answered
+pass · `1` assertion/agent failure · `2` usage / unanswered-under-`fail` / runtime · `3` boundary/integrity.
+After a run, the footer **echoes every auto-answered
 question as a copy-pasteable `--answer "<q>=<choice>"` line** — run once exploratorily, then paste them
 back to lock in a deterministic re-run.
 
@@ -182,13 +191,15 @@ This repo ships a **companion skill** (`.claude/skills/cowork-harness/`) that te
 /plugin install cowork-harness@cowork-harness
 ```
 
-The skill **self-bootstraps the CLI**: if `cowork-harness` isn't on your PATH it falls back to `npx cowork-harness@>=0.3.0` (a version floor that fails loud rather than silently fetching a too-old CLI; Node ≥ 20). Tiers above `protocol` still need Docker/Lima and a Claude Desktop agent binary — see the prerequisites below.
+The skill **self-bootstraps the CLI**: if `cowork-harness` isn't on your PATH it falls back to `npx cowork-harness@>=0.5.0` (a version floor that fails loud rather than silently fetching a too-old CLI; Node ≥ 20). Tiers above `protocol` still need Docker/Lima and a Claude Desktop agent binary — see the prerequisites below.
 
 It also follows the open [Agent Skills](https://github.com/vercel-labs/skills) spec, so it installs cross-editor (Cursor, Codex, OpenCode, …) by pointing the `npx skills` CLI at `.claude/skills/cowork-harness` in this repo. (Working *inside* this repo, the skill auto-loads as a project skill — no install needed.)
 
+> Note: `npm install -g cowork-harness` ships `scenario.py` and assertion keys (enough for `lint` in CI) but not the full SKILL.md teaching document; install via the marketplace command above to get the teaching skill.
+
 **Prerequisites for anything above `protocol` fidelity** (the `protocol` tier skips items 1–2 — no Docker, no staged agent — but still calls a real model via the host `claude`, so it needs item 3, the auth token; only a committed-cassette `replay` needs nothing at all):
 1. **Claude Desktop, opened once.** The Cowork agent binary is **bind-mounted from your own install** at run time — nothing Anthropic-owned is bundled. Open Cowork once so the agent ELF is staged (`…/claude-code-vm/<ver>/claude`); the harness auto-detects it, or set `COWORK_AGENT_BINARY=<path>` to point at it. Without a staged agent, container/cowork runs fail with "Open Cowork once to stage it…".
-2. **Docker (arm64)** + the agent image: `docker build --platform linux/arm64 -t cowork-agent-base:1 -f docker/Dockerfile.agent .` (override the tag with `COWORK_AGENT_IMAGE`). The `-f docker/Dockerfile.agent .` paths are **repo-relative** — run it from a source checkout, not a global `npm install -g` (where the Dockerfile lives under the package dir).
+2. **Docker (arm64)** + the agent image: `docker build --platform linux/arm64 -t cowork-agent-base:1 -f docker/Dockerfile.agent .` (override the tag with `COWORK_AGENT_IMAGE`). The `-f docker/Dockerfile.agent .` paths are **repo-relative** — run it from a source checkout, not a global `npm install -g` (where the Dockerfile lives under the package dir). (Global install? Run `cowork-harness doctor --tier container` — it prints the exact `docker build` command with the correct package-local Dockerfile path.)
 3. **An auth token** — either `export CLAUDE_CODE_OAUTH_TOKEN=$(claude setup-token)` or a **`.env`** file (copy `.env.example` → `.env`; gitignored). The token resolves in priority order: exported env > `--dotenv <path>` > `./.env` (cwd) > `<install>/.env` (the package root), so a `npm link`ed install works from any directory. Keep `.env` at a working-dir or install root, never inside a mounted skill/project folder. (Use `--dotenv`, not `--env-file` — Node reserves the latter.)
 
 > `sync` (below) is **optional for a first run** — the repo ships `baselines/desktop-*.json`, so `baseline: latest` already resolves. Run `sync` only to refresh the platform baseline after Claude Desktop updates. (`sync` is **macOS-only** today; on Linux/Windows use the committed baselines — they work cross-platform.)
@@ -209,14 +220,12 @@ cowork-harness run examples/scenarios/ --output-format json
 
 # 4. Record a cassette once, then replay it deterministically (no token, no Docker)
 #    (without --out, the cassette is named after the scenario — its `name:`, or the filename)
-cowork-harness record examples/scenarios/example-pdf-skill.yaml --out cassettes/example-pdf-skill.cassette.json
-cowork-harness replay --cassette cassettes/example-pdf-skill.cassette.json
-
-# A committed synthetic fixture is ready to replay on a fresh clone (no record step needed):
+#    Commit cassettes under examples/replays/ (this repo) or cassettes/ (conventional skill-repo name).
+cowork-harness record examples/scenarios/example-pdf-skill.yaml --out examples/replays/example-pdf-skill.cassette.json
 cowork-harness replay --cassette examples/replays/example-pdf-skill.cassette.json
 
 # Cassettes are COMMITTED fixtures — record against synthetic data, and gate them in CI:
-cowork-harness verify-cassettes cassettes/   # privacy scan (email/currency/domain) + staleness; exit 1 on a finding
+cowork-harness verify-cassettes examples/replays/   # privacy scan (email/currency/domain) + staleness; exit 1 on a finding
 ```
 
 > **Privacy:** a cassette snapshots the transcript and the `outputs/` JSON bodies, so it's committed PII
@@ -230,7 +239,8 @@ cowork-harness verify-cassettes cassettes/   # privacy scan (email/currency/doma
 > orchestration from both, re-evaluates the **content** assertions, and re-exercises
 > `serializeDecision` as a token-free O7 guard (the AskUserQuestion `{questions,answers}` answer-shape
 > invariant). Evaluated on replay: `transcript_*`, `tool_*`, `subagent_*`, `dispatch_count_max`,
-> `result`. **`question_asked`, `questions_count_max`, and `gate_answers_delivered` are also evaluated —
+> `result`, `allow_permissive_auto_allow` (always-on Cowork-parity scan). **`question_asked`,
+> `questions_count_max`, and `gate_answers_delivered` are also evaluated —
 > but only when the cassette carries `controlOut` (full-fidelity)**; old cassettes without it get a
 > loud warning and those three keys are excluded (not vacuously passed). **Filesystem assertions
 > (`file_exists`, `user_visible_artifact`, `artifact_json`) are evaluated when the cassette carries an
@@ -287,7 +297,7 @@ assert:
 ```
 
 ```yaml
-# sessions/default.yaml  (abridged — see the file for every field)
+# examples/sessions/default.yaml  (abridged — see the file for every field)
 # Relative paths below resolve from THIS file's dir (absolute and ~ are used as-is).
 model: claude-opus-4-8
 effort: high
@@ -403,11 +413,11 @@ Author scenarios in your own `scenarios/` dir, run the lot, get a non-zero exit
 cowork-harness run scenarios/            # your repo's scenarios; runs every *.yaml, CI-ready exit code
 ```
 
-The provided [GitHub Actions workflow](.github/workflows/ci.yml) runs a **four-stage pipeline** you can copy into your skill repo:
+The provided [GitHub Actions workflow](.github/workflows/ci.yml) runs a **four-stage pipeline**. The **unit** stage is the token-free gate you can copy into your skill repo; the `boundary`, `scenarios`, and `parity-drift` stages are this repo's own fidelity self-tests and are not directly portable (they build the harness's Docker image and run harness-specific e2e scenarios — see [`ci-recipe.md`](./.claude/skills/cowork-harness/references/ci-recipe.md) for the skill-repo template):
 
 | Stage | Runs | Needs | Gates |
 |---|---|---|---|
-| **unit** | format check · typecheck · unit tests · build · CLI smoke · token-free `replay` + `verify-cassettes` gates | nothing | every push/PR |
+| **unit** | format check · typecheck · unit tests · build · CLI smoke · token-free `replay` · `verify-cassettes` · `lint` | nothing | every push/PR |
 | **boundary** | builds the pinned agent image, brings up the default-deny network, runs `boundary-check` | Docker, arm64 runner | proves the sandbox enforces Cowork's limits — **no API key** |
 | **scenarios** | the live scenario suite at `container` fidelity, uploads transcripts/egress logs as artifacts | `ANTHROPIC_API_KEY` (or `CLAUDE_CODE_OAUTH_TOKEN`) | fork PRs: the whole job is skipped (`if:` guard); same-repo without a key: warns and exits 0 |
 | **parity-drift** | reminder to re-`sync` when Desktop updates | nothing | informational, never blocks |
@@ -433,7 +443,7 @@ Unit tests cover the scripted-answer logic, the egress allowlist matcher, the se
 - `COWORK_AGENT_IMAGE=<tag>` — override the agent image name (default `cowork-agent-base:1`); `COWORK_AGENT_BINARY=<path>` — override the auto-detected staged agent ELF.
 - `COWORK_HARNESS_DECIDER_DIR_POLL_MS` / `_TIMEOUT_MS` — tune the `--decider-dir` rendezvous poll/backstop; `COWORK_HARNESS_DECIDER_CMD_TIMEOUT_MS` / `COWORK_HARNESS_LLM_TIMEOUT_MS` — backstop a hung `--decider-cmd` helper / `--decider-llm` model call (default 600 s, fail loud); `COWORK_HARNESS_DIALOG_TIMEOUT_MS` — override the 6 s dialog auto-cancel.
 - `COWORK_HARNESS_RUNS_DIR` — relocate the `runs/` output root (so `trace` resolves runs from any directory).
-- **Networking / loop:** `COWORK_EGRESS_PROXY` overrides the egress-proxy URL injected into the sandbox; `COWORK_DOCKER_NETWORK` pins the Docker network the agent container joins; `CLAUDE_FORCE_HOST_LOOP=1` forces the host-loop path regardless of the baseline's loop decision (the `cowork` tier's auto-pick). `COWORK_LIMACTL` overrides the `limactl` binary path (default `/opt/homebrew/bin/limactl`).
+- **Networking / loop:** `COWORK_EGRESS_PROXY` overrides the egress-proxy URL injected into the sandbox; `COWORK_PROXY_IMAGE` overrides the egress proxy Docker image name (default `cowork-egress-proxy:1`); `COWORK_DOCKER_NETWORK` pins the Docker network the agent container joins; `CLAUDE_FORCE_HOST_LOOP=1` forces the host-loop path regardless of the baseline's loop decision (the `cowork` tier's auto-pick). `COWORK_LIMACTL` overrides the `limactl` binary path (default `/opt/homebrew/bin/limactl`).
 - **Strictness escape hatches** (the harness fails loud by default): `COWORK_HARNESS_SOFT_MISSING=1` downgrades a missing mount source from a hard error to warn-and-exclude; `COWORK_HARNESS_ALLOW_CONFIG_DIR_WRITE=1` permits writing into an existing pinned `plugins.config_dir` (otherwise refused, to avoid clobbering a real Claude config).
 - **Secret scrubbing:** `COWORK_HARNESS_SCRUB_KEYS=<KEY1,KEY2>` adds extra env-var names whose values are redacted from logs (beyond the known auth tokens + `ANTHROPIC_CUSTOM_HEADERS`); `COWORK_HARNESS_SCRUB_VALUES=<v1,v2>` redacts literal values regardless of env. **Committed-cassette redaction:** `COWORK_HARNESS_REDACT_PATTERNS=<rx1,rx2>` / `COWORK_HARNESS_REDACT_KEYS=<k1,k2>` extend the privacy layer that scrubs recorded `controlOut` before a cassette is written for commit.
 - L2 microVM: `COWORK_VM_GATEWAY` overrides the Lima host-proxy gateway IP (default `192.168.5.2`); `COWORK_VM_PROXY_PORT` the proxy port. The Lima instance is named `cowork-vm-<config-hash>` (a config change → a fresh VM); `COWORK_LIMA_INSTANCE` pins a fixed name, and `vm prune` removes orphaned ones.
@@ -508,12 +518,12 @@ This repo is built to be driven by agents, not just read by humans:
 
 ## Status
 
-**Verified end-to-end against the live staged agent (2.1.170 / asar 1.12603.1).**
+**Verified end-to-end against the live staged agent (2.1.177 / asar 1.13576.1).**
 
 - ✅ **Three isolation tiers (L0/L1/L2) + two loop-mode overlays** — `protocol` (L0 control loop), `container` (L1 sandboxed arm64 + per-run default-deny egress sidecar), `microvm` (L2 real Apple-VZ Linux microVM + guest firewall); plus the loop-mode overlays `hostloop` (production split-execution: agent loop on host, shell/web via the workspace SDK-MCP server) and `cowork` (auto-picks host-loop vs container the way Cowork does — gate `1143815894`). Egress enforced at container/microvm/hostloop; `boundary-check` reports **ALL CONSTRAINTS ENFORCED**.
 - ✅ **Three-seam driver** — `AgentSession` (control protocol) → `Decider` (scripted + `on_unanswered` policy, no silent false-greens) → `Run` (turn loop, sub-agent dispatch tree, `RunRecord`). Multi-turn `chat`, deterministic cassette `record`/`replay` (no token), `run.jsonl`/`trace.json` logging with secret-scrub.
 - ✅ **Answering live questions, every way you'd need** — `--decider-llm --intent "<one line>"` (a small model picks per question, steered by your test intent — the ergonomic default; non-determinism is flagged so a green isn't mistaken for a scripted pass), `--answer-policy <yaml>`/`--answer "rx=c"` (declarative regex→label, deterministic CI), `--decider-cmd '<helper>'` (custom logic — the Python `serve_decider(fn)` adapter pre-builds the wire loop so the helper writes only the decision), and **`--decider-dir <dir>`** (the *driving agent* answers each gate **in-band** with full context — it arms a Monitor on `cowork-harness gates <dir> --follow` and replies with `cowork-harness answer <dir> --gate <N> --choose <label>`; the session-under-test stays live, no resume/re-worded question — binary-verified). Every channel keeps stdout free, so all compose with `--output-format json`. A question is **never silently answered with option 1** — unhandled fails loud. Validate any decider in ~2s with `cowork-harness decide`.
-- ✅ **Sub-agent aggregation + `trace`** — recognizes the real `Agent` dispatch tool (binary-verified; `Task` is its alias) so `subagent_dispatched`/`dispatch_count_max` fire under `--fidelity cowork`, excluding the `TaskCreate` todo list; `cowork-harness trace <id> --tools` digests `events.jsonl` (each tool row now shows its **result status** `ok`/`error`), and `trace <id> --gates` shows the gate lifecycle (**question → injected answer → delivered result**); `result.json`/`--keep` surface the deep `mnt/outputs` deliverable path.
+- ✅ **Sub-agent aggregation + `trace`** — recognizes the real `Agent` dispatch tool (binary-verified; `Task` is its alias) so `subagent_dispatched`/`dispatch_count_max` fire under `--fidelity cowork`, excluding the `TaskCreate` todo list; `cowork-harness trace <id> --view tools` digests `events.jsonl` (each tool row now shows its **result status** `ok`/`error`), and `trace <id> --view questions` shows the gate lifecycle (**question → injected answer → delivered result**); `result.json`/`--keep` surface the deep `mnt/outputs` deliverable path.
 - ✅ **Answer delivery is verified, not assumed** — an AskUserQuestion answer is injected as the binary's full tool input (`{questions, answers}`, ELF-verified), so the answer actually reaches the model; `RunResult.gateDeliveries[]` + the `gate_answers_delivered` assertion catch any delivery failure, and `RunResult.toolCounts` gives the **truthful** per-tool call count (host-routed `WebSearch` shows here, not the always-0 `usage.server_tool_use`).
 - ✅ **Binary-grounded fidelity** — cwd `/sessions/<id>`, the three-channel MCP model (`--mcp-config` honored in plain cowork mode; host/API-routed `web_fetch`; SDK-server delivery), host-loop tool partition, auth-env token-only drop, and production GrowthBook gates pinned per release.
 - ✅ The agent binary is **bind-mounted from your own install** at run time — nothing Anthropic-owned is in any image or distributed.

package/baselines/prompts/desktop-1.12603.1/system-prompt-append.md

@@ -6,6 +6,18 @@
      `initialize` (appendSubagentSystemPrompt). Tokens substituted by src/prompt.ts
      mirroring the Desktop builder `y8r`. -->
 
+<!-- <application_details> reconstructed from the real Cowork prompt. Binary-confirmed in
+     Claude.app app.asar 1.13576.1 at byte offset ~6,971,088 as a STATIC module constant —
+     the default cowork prompt body, NOT gated behind a server-pushed spVariant — and
+     cross-checked against behavioral capture (2026-06-18). Real Cowork = claude_code preset
+     + this append; the base preset alone makes the agent say "I'm Claude Code", so the
+     identity correction must live in the append (layered after the preset via
+     --append-system-prompt). Paraphrased, NOT copied verbatim, per the repo's no-bundling
+     rule; model name comes from the <env> block, not hardcoded here. -->
+<application_details>
+You are Claude, an AI assistant made by Anthropic. You are powering Cowork mode, a feature of the Claude desktop app that is currently a research preview. You are implemented on top of Claude Code and the Claude Agent SDK, but you are not Claude Code and should not refer to yourself as such — refer to yourself as Claude. Do not mention implementation details like this (including Claude Code or the Claude Agent SDK) unless it is relevant to the user's request.
+</application_details>
+
 <high_level_computer_use_explanation>
 Claude runs in a lightweight Linux VM (Ubuntu 22) on the user's computer. This VM provides a secure sandbox for executing code while allowing controlled access to user files. The working directory is {{cwd}}; user-attached folders are mounted under {{cwd}}/mnt/.
 </high_level_computer_use_explanation>

package/baselines/prompts/desktop-1.13576.1/host-loop-append.md

@@ -0,0 +1,11 @@
+<!-- host-loop "Shell access" section. Carried forward from desktop-1.12603.1 (the shell-access
+     semantics — independent bash calls, {{vmMnt}} path translation, unmounted ${CLAUDE_PLUGIN_ROOT}
+     self-heal — are version-stable across this Desktop range). Re-verify against the desktop-1.13576.1
+     asar (D8r host branch) when an asar copy is available. Appended to the system prompt only in
+     host-loop. {{vmMnt}} substituted. -->
+
+## Shell access
+
+Shell commands use `mcp__workspace__bash` and run in an isolated Linux environment. Each call is independent — no cwd or env carryover between calls. Use absolute paths.
+
+Paths in bash differ from what file tools (Read/Write/Edit) see. Your connected folders are mounted in bash under {{vmMnt}}/. A file you Read at a host path is reached in bash under {{vmMnt}}/ — translate host paths to their {{vmMnt}} equivalent before using them in bash. In particular, `${CLAUDE_PLUGIN_ROOT}` is a host path; to run a plugin's scripts in bash, locate them under {{vmMnt}} (e.g. `find {{vmMnt}} -path '*/skills/*/scripts'`) rather than using the host path directly.

package/dist/agent/session.js

@@ -361,8 +361,19 @@ export class LiveAgentSession {
         // (If large control frames ever become legitimate, switch to a drain-aware queue, making writes async.)
         if (line.length > 256 * 1024)
             throw new Error(`control frame is ${line.length} bytes (> 256 KiB safe limit) — refusing to write to avoid partial stdin buffering; this indicates an unexpectedly large control payload`);
+        // Bug 34: check stream writability before writing — a closed/destroyed stdin after a child crash
+        // loses decision frames silently. Throw immediately so callers surface the failure rather than
+        // hanging or silently dropping frames.
+        if (this.proc.stdin.destroyed || !this.proc.stdin.writable)
+            throw new Error("control-protocol write failed: child stdin is no longer writable (process may have crashed)");
         this.controlOut.write(line + "\n");
-        this.proc.stdin.write(line + "\n");
+        // Attach a one-shot error handler on the write so stream errors surface via rejectError rather
+        // than as unhandled 'error' events (the permanent 'error' handler on constructor covers stdin
+        // errors that fire outside a write, e.g. EPIPE after a crash).
+        this.proc.stdin.write(line + "\n", (err) => {
+            if (err && this.rejectError)
+                this.rejectError(err instanceof Error ? err : new Error(String(err)));
+        });
     }
 }
 /** Pure translation of one parsed stream-json message → AgentEvents (no side-effects). Shared by
@@ -447,15 +458,22 @@ export function parseMessage(msg) {
     }
     return ev;
 }
-/** Flatten a tool_result `content` (a string, or an array of `{type:"text",text}` blocks), capped at
+/** Flatten a tool_result `content` (a string, or an array of content blocks), capped at
  *  `max` chars. The 500-char DISPLAY value (toolResultText) keeps the recorder/trace compact; the larger
- *  PROVENANCE value (toolResultRaw) is what seeds web_fetch provenance, so a URL past char 500 isn't lost. */
+ *  PROVENANCE value (toolResultRaw) is what seeds web_fetch provenance, so a URL past char 500 isn't lost.
+ *  Bug 35: preserve all content block types — text blocks use their text value; all other block types
+ *  (json, resource, link, unknown shapes) are JSON-stringified so no content is silently dropped. */
 function flattenToolResult(content, max) {
     if (typeof content === "string")
         return content.slice(0, max);
     if (Array.isArray(content))
         return content
-            .map((b) => (b && typeof b === "object" && "text" in b ? String(b.text) : ""))
+            .map((b) => {
+            if (b && typeof b === "object" && "text" in b)
+                return String(b.text);
+            // Non-text blocks (json, resource, link, unknown): JSON-stringify to preserve all content.
+            return JSON.stringify(b);
+        })
             .join(" ")
             .slice(0, max);
     return "";

package/dist/assert.js

@@ -1,4 +1,4 @@
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, statSync } from "node:fs";
 import { resolve, relative, isAbsolute, sep } from "node:path";
 import { compileUserRegex } from "./regex.js";
 /** Resolve a user-authored assertion path under `workRoot`, rejecting absolute paths and any `..` that
@@ -209,6 +209,9 @@ function check(a, ctx) {
         // evidence the assertion requires, so it fails loud ("no silent false-greens"). `delivered:
         // false` is a real errored tool_result; `null` is "no tool_result observed for this gate".
         if (a.gate_answers_delivered) {
+            if (ctx.gateDeliveries.length === 0) {
+                results.push(fail("gate_answers_delivered: no gates were recorded during this run — either no gate fired, or gate delivery tracking is not wired. Expected at least one delivered gate."));
+            }
             const bad = ctx.gateDeliveries.filter((g) => g.delivered !== true);
             results.push(bad.length === 0
                 ? ok()
@@ -236,8 +239,15 @@ function check(a, ctx) {
         else {
             let doc;
             let parsed = true;
+            const fileSizeLimit = 10 * 1024 * 1024;
+            const fileSize = statSync(file).size;
+            if (fileSize > fileSizeLimit) {
+                results.push(fail(`artifact_json: file too large to parse as JSON (${fileSize} bytes, limit 10 MiB)`));
+                parsed = false;
+            }
             try {
-                doc = JSON.parse(readFileSync(file, "utf8"));
+                if (parsed)
+                    doc = JSON.parse(readFileSync(file, "utf8"));
             }
             catch (e) {
                 parsed = false;

package/dist/baseline.js

@@ -15,13 +15,20 @@ export function resolveAgentBinary(baseline) {
     const staged = (baseline.agentBinary?.stagedPath ?? "").replace(/^~(?=$|\/)/, homedir());
     if (staged && existsSync(staged))
         return resolve(staged);
-    // The baseline's exact version dir is gone (e.g. Claude Desktop updated). Fall back to the
-    // newest sibling binary under the same claude-code-vm/ root before giving up.
+    // The baseline's exact version dir is gone (e.g. Claude Desktop updated).
+    // By default this is a hard failure — a different agent version can silently change behavior.
+    // Set COWORK_HARNESS_ALLOW_AGENT_FALLBACK=1 to opt in to using the newest sibling binary.
+    const exactPath = staged || "(unknown)";
     const fallback = staged ? newestStagedBinary(staged) : undefined;
-    if (fallback) {
+    if (fallback && process.env.COWORK_HARNESS_ALLOW_AGENT_FALLBACK === "1") {
         process.stderr.write(`cowork-harness: staged agent binary "${staged}" not found; ` + `falling back to newest sibling "${fallback}".\n`);
         return fallback;
     }
+    if (fallback) {
+        // A fallback exists but the opt-in env is not set — fail explicitly rather than silently using a
+        // different agent version that could make the run appear green while running the wrong binary.
+        throw new Error(`cowork-harness: baseline agent binary not found: ${exactPath}. Set COWORK_HARNESS_ALLOW_AGENT_FALLBACK=1 to use the newest available.`);
+    }
     throw new Error(`Staged agent binary not found at "${staged}". It is extracted from your Claude Desktop install ` +
         `(claude-code-vm/<ver>/claude). Open Cowork once to stage it, or set COWORK_AGENT_BINARY to its path.`);
 }