cowork-harness 0.7.1 → 0.9.0

package/.claude/skills/cowork-harness/scripts/assertion-keys.json

@@ -2,6 +2,7 @@
   "$comment": "GENERATED from the Zod Assertion schema (src/types.ts) by scripts/gen-schema.ts — do not edit; run `npm run schema`.",
   "keys": [
     "allow_l0_plugin_divergence",
+    "allow_missing_capability",
     "allow_permissive_auto_allow",
     "artifact_json",
     "dispatch_count_max",
@@ -29,5 +30,10 @@
     "transcript_not_contains",
     "transcript_not_matches",
     "user_visible_artifact"
+  ],
+  "verdictModifierKeys": [
+    "allow_l0_plugin_divergence",
+    "allow_missing_capability",
+    "allow_permissive_auto_allow"
   ]
 }

package/.claude/skills/cowork-harness/scripts/scenario.py

@@ -38,7 +38,11 @@ import re
 import sys
 from pathlib import Path
 
-# --- the replay-class taxonomy (mirrors `contentKeys` in src/run/cassette.ts) ---
+# --- the replay-class taxonomy ---
+# NB: this is NOT a 1:1 mirror of `contentKeys` in src/run/cassette.ts. cassette.ts keeps the verdict
+# modifiers (VERDICT_MODIFIER_KEYS) in its content set so they replay as no-op passes; the linter
+# deliberately keeps them OUT of CONTENT_KEYS so a modifier-only scenario still trips the `replay-noop`
+# warning below (a no-op pass verifies nothing real — exactly what that warning is for).
 CONTENT_KEYS = {
     "result",
     "transcript_contains",
@@ -70,7 +74,11 @@ LIVE_ONLY_KEYS = {
 }
 EGRESS_KEYS = {"egress_denied", "egress_allowed"}
 # verdict modifiers — don't verify anything themselves (e.g. suppress a default-fail)
-VERDICT_MODIFIER_KEYS = {"allow_permissive_auto_allow", "allow_l0_plugin_divergence"}
+VERDICT_MODIFIER_KEYS = {
+    "allow_permissive_auto_allow",
+    "allow_l0_plugin_divergence",
+    "allow_missing_capability",
+}
 
 # Every key the replay-class logic knows how to handle. `replay_protocol_fidelity` is valid-but-not-authorable
 # (errored separately below). This is also the embedded fallback for ASSERT_KEYS — kept EQUAL to the generated
@@ -282,8 +290,9 @@ def lint_doc(doc, path, raw_lines):
                     "WARN",
                     "replay-noop",
                     "every assertion is live-only (egress / no_delete_in_outputs / self_heal_ran / "
-                    "transcript_no_host_path) — on the token-free `replay` lane they are ALL silently "
-                    "skipped, so a replay PR gate would verify nothing.",
+                    "transcript_no_host_path) or a verdict modifier (allow_*, a no-op pass) — on the "
+                    "token-free `replay` lane the live-only ones are silently skipped and the verdict "
+                    "modifiers verify nothing, so a replay PR gate would verify nothing.",
                     "Add a content assertion (result / transcript_* / tool_* / subagent_*) or a "
                     "manifest-backed one (file_exists / user_visible_artifact / artifact_json), or run this "
                     "scenario only on the live (run/record) lane.",
@@ -419,6 +428,30 @@ def _print_findings(findings, n_files):
 
 def cmd_lint(args):
     all_findings = []
+    # Expand directory args to their scenario files — mirrors src/run/inputs.ts `resolveInputs`: a SINGLE
+    # combined-sorted `*.yaml` + `*.yml` listing (non-recursive), a single file kept as-is, and an EMPTY dir
+    # as a loud ERROR (never a vacuous "0 files = clean"). Done in place so the lint loop AND the count below
+    # both see the expanded list.
+    expanded = []
+    for arg in args.files:
+        p = Path(arg)
+        if p.is_dir():
+            matches = sorted(str(q) for q in (list(p.glob("*.yaml")) + list(p.glob("*.yml"))))
+            if matches:
+                expanded.extend(matches)
+            else:
+                all_findings.append(
+                    Finding(
+                        "ERROR",
+                        "no-scenarios",
+                        f"no .yaml/.yml files under {arg} — nothing to do (loud non-zero, not a vacuous pass)",
+                        "Point lint at a scenario file or a directory containing *.yaml / *.yml scenarios.",
+                        arg,
+                    )
+                )
+        else:
+            expanded.append(arg)
+    args.files = expanded
     # Linter self-check (B3): a valid schema key the replay-class sets don't classify can't be linted
     # correctly — surface it as a hard ERROR so it fails the gate (and --strict) until someone classifies it.
     if UNCLASSIFIED_KEYS:
@@ -598,7 +631,7 @@ def main(argv=None):
     sub = ap.add_subparsers(dest="command", required=True)
 
     lp = sub.add_parser("lint", help="lint scenario(s) for silent-false-green invariants")
-    lp.add_argument("files", nargs="+", help="scenario YAML file(s) to lint")
+    lp.add_argument("files", nargs="+", help="scenario YAML file(s) or director(ies) of *.yaml/*.yml to lint")
     lp.add_argument("--json", action="store_true", help="emit findings as JSON")
     lp.add_argument("--strict", action="store_true", help="exit non-zero on WARN/INFO too, not just ERROR")
     lp.set_defaults(func=cmd_lint)

package/CHANGELOG.md

@@ -6,6 +6,253 @@ All notable changes to this project are documented here. The format is based on
 
 ## [Unreleased]
 
+## [0.9.0] — 2026-06-22
+
+### Breaking changes
+
+- **Cassette staleness fingerprint bumped to format v6 (re-record once).** The skill-hash boundary changed,
+  so committed cassettes recorded before this release report `recorded under an older hash format — re-record
+  once`. Drivers: (1) **OS-junk** files (`.DS_Store` / `Thumbs.db` / `desktop.ini`) are excluded from
+  `skillHash` — an out-of-band OS metadata touch can no longer re-stale a cassette (the "fresh cassette is
+  immediately stale" bug); (2) **`contentSig` is unified onto the same walk as `skillHash`** (same file set,
+  plugin.json `version` stripped, in-tree symlinks hashed by target) — `rehash` cannot bridge this algorithm
+  change, so a pre-v6 cassette gets an honest *"algorithm changed — re-record"* (not "content changed"); (3)
+  the **git-tracked file set is the default boundary** (see Added).
+- **Git-tracked staleness/mount boundary is now the DEFAULT.** When a skill/plugin source dir is in a git
+  work tree, both the staleness hash and the sandbox mount use only its **git-tracked** files (untracked
+  scratch / build output / OS-junk are excluded from both, so they can't drift the hash or leak into the
+  sandbox). A dir that isn't a git repo falls back to the raw walk automatically. Opt out with
+  `COWORK_HARNESS_GITSET=0`.
+- **Removed the legacy CLI aliases.** `assert` → use `assertions`; `replay --cassette <file>` → pass the
+  path positionally (`replay <file | dir/>`); `verify-cassettes --privacy-only` / `--staleness-only` →
+  `--skip-privacy` / `--skip-staleness`. (0.8.0 had documented the latter two groups as renamed/removed but
+  the code still accepted the old forms; they are now gone. Each removed alias exits `2` if used.)
+- **`assertions --list --output-format json` now reports `command: "assertions"`** (was the stale
+  `"assert"`) — a JSON-envelope contract fix for anything keying on the `command` field.
+- **`decide` exits `2` (not `1`) on a runtime error**, matching the documented "usage / runtime → `2`"
+  contract. No-match / abstain still exits `1`.
+
+### Added
+
+- **`cowork-harness/secrets` package export** — `scrubField` and `collectSecrets` are now importable as a
+  declared subpath (`import { scrubField, collectSecrets } from "cowork-harness/secrets"`) for custom
+  redaction pipelines, with the documented usage corrected to `scrubField(value, collectSecrets())` (a bare
+  `[token]` array misses secrets embedded in encoded fields). Adding the `exports` map also **bounds the
+  package's public surface to this one subpath** — deep imports into `dist/` (`cowork-harness/dist/...`),
+  previously resolvable by accident, are now private. The CLI (`bin`) is unaffected.
+- **`lint` accepts a directory** — it expands to the directory's `*.yaml` / `*.yml` scenarios
+  (non-recursive, sorted), the same file-or-dir ergonomics as `replay` / `verify-cassettes`. An empty
+  directory is a loud error, never a vacuous "0 files = clean" pass.
+- **Staleness now names the EXACT changed file.** A per-file manifest (`fileSigs`) in the cassette fingerprint
+  lets `verify-cassettes` report e.g. `skill files changed since record — 1 changed (skills/x/SKILL.md)`
+  instead of a coarse bucket message (appended to the existing shared-vs-scoped diagnosis). Manifest paths are
+  root-relative and are scanned + redacted with the same privacy layer as `skillSources`. Omitted (with a
+  loud `fileSigsOmitted`) above an internal size cap.
+- **`COWORK_HARNESS_DEBUG_SKILLHASH=1`** — on a staleness mismatch, dumps the exact file set feeding the hash
+  to stderr and flags OS-junk, so a drift source is one line instead of a black-box hunt (a one-line hint
+  points to it when the flag is off).
+- **`COWORK_HARNESS_GITSET=0`** — opt out of the new default git-tracked boundary (see Breaking) back to the
+  legacy raw filesystem walk for every dir.
+- **`requires_capabilities` scenario assertion** — fail a scenario unless the running tier provides *and can
+  verify* the declared capability families (e.g. `office_convert`, `pdf_tables`). The unmet set is persisted
+  in the run result (`requiresCapabilityUnmet`), so `verify-run` can't false-fail; opt out with the
+  `allow_missing_capability` verdict modifier when the skill's fallback is genuinely equivalent.
+- **LLM decider `OTHER:` free-text directive** — on an options-bearing gate, a decider answer of
+  `OTHER: <text>` is matched to a label first, else passed through as free text; a bare out-of-set value
+  still fails loud.
+
+### Fixed
+
+- **`doctor --tier microvm` now checks the right prerequisites.** It previously probed the Docker daemon +
+  agent image + egress-proxy image for every live tier, but the `microvm` (L2) tier runs on **Lima / Apple
+  Virtualization.framework**, not Docker — so it could report "not ready" on a Lima-only host, or "ready"
+  with no Lima installed. `microvm` now checks `limactl` (honoring `COWORK_LIMACTL`) + the staged agent
+  binary, and skips the Docker checks; `container`/`hostloop`/`cowork` are unchanged.
+- **A freshly recorded cassette no longer reports `[stale]` immediately** because the OS rewrote a `.DS_Store`
+  (or other OS-junk) in the skill tree — OS-junk is excluded from the skill hash. A chronic false-positive
+  that pushed consumers to WARN-only (which then masked real drift).
+- A standalone verdict-modifier assertion (e.g. `allow_l0_plugin_divergence: true`) no longer false-fails
+  as "empty assertion", and verdict modifiers no longer trigger a misleading "filesystem/egress skipped"
+  warning on the replay lane. The verdict modifiers are now single-sourced from one list (`assert.ts`,
+  `cassette.ts`, and the Python linter all derive from / are checked against it), guarded by a convention
+  test against drift.
+- **A tail-end transport drop is no longer conflated with an agent failure.** A connection closed *after* a
+  clean result is classified as `resultErrorKind: "transport"` (vs `"agent"`) and surfaced as a
+  lane/assertion-aware `transport_error` verdict — still a failure (no false-green), but distinguishable from
+  a genuine skill error; a non-matching envelope falls back to the agent classification.
+- **Clearer guard / capability legibility.** The run footer lists only guards that actually ran this lane
+  (`capabilityProbe: definitive | unverified | skipped`) — never a false check-mark for a guard that didn't
+  run; capability notices state their own safety net + all-clear with verdict-impact tags; the unbuilt `max`
+  tier is dropped from capability hints; and Docker pool-exhaustion is reframed as a concurrency limit, not a
+  leak.
+- **Ordered interrupt cleanup.** A `SIGINT` / `SIGTERM` during a live run reaps in-flight egress resources in
+  order (container thunks before network thunks) and announces itself, instead of leaving them dangling.
+
+## [0.8.0] — 2026-06-21
+
+### Breaking changes
+
+- **Work folders now mount at `mnt/<folder-name>`, not `mnt/.projects/<id>`; the folder `to:` field is
+  removed.** Binary-verified (asar 1.14271.0): real Cowork mounts each connected work folder at a
+  collision-resolved **basename** of its canonical path (e.g. `mnt/project`) with no author-chosen name —
+  so the session-schema `folders[].to` override is GONE (it had no Cowork analog; names are always derived).
+  Same-basename folders are disambiguated tier-accurately (host-loop keeps the first bare, the VM/container
+  tier escalates both with a `--parent` prefix). Plugins likewise move from the synthetic
+  `mnt/.local-plugins/cache/<…>` to the real `mnt/.local-plugins/marketplaces/<marketplace>/<plugin>` (no
+  `cache/`, no version segment). **Version-gated:** this applies to Desktop **≥ 1.14271.0** (current
+  baselines); older baselines keep the legacy `.projects/<id>` + `cache/` paths. `user_visible_artifact`
+  and the artifact manifest now derive their visible roots from the actual mount set (persisted as
+  `RunResult.userVisibleRoots`), and the cassette format bumps **v3 → v4** to store them.
+  - *Upgrade note:* remove `to:` from `folders[]` in session files (the name derives from the folder
+    basename). Reference connected-folder artifacts as `<folder-name>/…` (e.g. `project/summary.md`) instead
+    of `.projects/<id>/…`. A folder-artifact cassette recorded before v4 must be **re-recorded** (`rehash`
+    cannot migrate it — it only re-hashes skill fingerprints). A connected folder whose basename collides
+    with a reserved Cowork mount name (`outputs`, `uploads`, `.projects`, …) on the VM/container tier is now
+    rejected loudly instead of silently shadowing the fixed dir — rename the folder.
+
+- **Run output now defaults to `~/.cowork-harness/runs`, not `<cwd>/runs`.** A `run` / `skill` / `chat` /
+  `record` launched from a repo no longer drops run artifacts (often sensitive skill inputs/outputs) into the
+  working tree — the root moved out of any working tree, matching the `~/.cowork-harness/` convention already
+  used for VM work dirs. The root is **flat and machine-global** (shared across every project on the machine),
+  not per-project. The readers (`trace` / `scaffold` / `verify-run`) resolve the same default, so a bare
+  `trace <run-id>` now works from any directory; the previous cwd-relative / repo-root resolution tiers were
+  removed. A one-time `runs → <dir>` line prints on stderr when the default is used (suppressed under
+  `--quiet` / `--output-format json`, or when an override is set).
+  - *Upgrade note (CI / scripts):* anything that reads `./runs` after a run — a CI `upload-artifact path: runs/`,
+    a glob over `runs/**`, a `.gitignore` entry — must now set **`COWORK_HARNESS_RUNS_DIR`** (or pass
+    `--run-dir`) to a workspace path so output lands where it's expected. Otherwise the step finds an empty
+    `./runs` (and, if it doesn't fail on empty, passes silently). The bundled CI recipe sets
+    `COWORK_HARNESS_RUNS_DIR: runs` on the live-scenario job for exactly this reason.
+
+- **Agent image bumped `cowork-agent-base:1` → `:2` — REBUILD REQUIRED.** The image now mirrors the real
+  Cowork rootfs's preinstalled toolchain (binary-verified by mounting the rootfs): **Node 22.22.3** (was
+  ubuntu's node 12), the full **Python document/data stack** (openpyxl/pandas/numpy/pdfplumber/python-docx/
+  python-pptx/matplotlib/…), node doc-gen globals (pdf-lib/pptxgenjs/sharp/tsx/…), `ruby`/`ffmpeg`/`qpdf`,
+  `C.UTF-8` locale, and it now runs as **uid 1000 (`ubuntu`)** like the real VM. Rebuild with the command
+  `cowork-harness doctor --tier container` prints, or set `COWORK_AGENT_IMAGE` to your own tag. *(Why: the
+  real rootfs ships openpyxl etc. preinstalled — omitting them made skills that read `.xlsx`/PDFs falsely
+  appear degraded under the harness. "pypi blocked at runtime" ≠ "not preinstalled.")*
+- **A green run that uses a capability the agent image OMITS now FAILS** (verdict signal `missing_capability`),
+  mirroring `permissive_auto_allow`/`l0_plugin_divergence`. The default "core" image omits the heavy lane
+  (OCR/LibreOffice/markitdown/opencv/PDF-tables); a run that uses one is a likely false negative (real Cowork
+  ships it). Suppress per-scenario with **`allow_missing_capability: true`** (when the fallback is equivalent),
+  rebuild full parity (`--build-arg COWORK_FULL_PARITY=1`), use the rootfs `max` tier, or skip the check with
+  `COWORK_SKIP_CAPABILITY_PROBE=1`. Live tiers only (container/hostloop/microvm).
+- **Stricter, fail-loud guardrails from the codebase bug-review sweep — a few previously-silent paths now
+  error.** These close false-greens / false-accepts and can surface on an existing setup:
+  - **Negative `verify-run` assertions fail on *missing* evidence instead of passing vacuously.**
+    `tool_result_not_contains`, `tool_not_called`, `subagent_tool_absent`, `dispatch_count_max`,
+    `subagent_declared_but_unused`, `no_delete_in_outputs`, `transcript_no_host_path`, and `self_heal_ran`
+    now fail with an "evidence unavailable" reason when the underlying field is absent from a partial/older
+    `result.json` (verify-run lane only — the live and replay lanes, where the evidence is always present,
+    are unchanged). *Upgrade note:* re-run rather than re-assert against a fresh `result.json` if a verify-run
+    flips to this failure.
+  - **Non-strict cassette replay now fails on corrupt `controlOut`** — a malformed line, or a duplicate
+    `request_id` with differing bodies — instead of warning and proceeding. Corruption is a protocol-fidelity
+    failure, not advisory; `--strict` still additionally catches staleness/extra-data.
+  - **`chat --raw` now rejects `--upload` / `--folder` / `--plugin` / `--fidelity`** (it can't honor them in
+    native mode) instead of silently ignoring them, and an invalid `COWORK_HARNESS_FIDELITY` value is rejected
+    loudly instead of silently falling back to `container`. An invalid `COWORK_HARNESS_MAX_ARTIFACT_BYTES` now
+    errors (parity with the `--max-artifact-bytes` flag) instead of silently using the default.
+  - **A `web_fetch` `approved_domains` / seed entry that isn't a bare host** (a URL, scheme, path, port, empty
+    string, or `*` wildcard) is now rejected loudly instead of being added as an inert, never-matching entry.
+  - **An over-cap (> 256 KiB) control-out frame now fails the live recording immediately** with a clear error,
+    instead of writing an unreplayable truncation marker that only surfaced later as a replay failure.
+
+### Added
+
+- **Capability fidelity detection.** The harness probes the agent runtime (Docker image via `--network none`
+  run, or the L2 microVM via `limactl shell`) for the document/OCR/Office capabilities the real Cowork rootfs
+  ships, caches the result by `(tier, identity)`, and detects (from `events.jsonl`) when a skill used an
+  omitted one — surfaced as the new `RunResult.missingCapabilityUse` field, a `::notice::`/`::warning::`, and
+  the `missing_capability` verdict above. New assertion `allow_missing_capability`.
+- **Opt-in full-parity image** (`docker build --build-arg COWORK_FULL_PARITY=1 -t cowork-agent-full:2`) adds
+  tesseract / LibreOffice / opencv / onnxruntime+markitdown / camelot+tabula for OCR/Office/extraction skills.
+- **Rootfs `max` tier (`npm run build:rootfs-image`)** — builds a Docker image from the user's OWN
+  `rootfs.img` (local, byte-for-byte parity; cached by rootfs mtime+size); point `COWORK_AGENT_IMAGE` at it.
+- **Provisioning drift gate (`npm run capture:rootfs`)** — captures the rootfs's toolchain to
+  `baselines/provisioning/rootfs-provisioning.json`; `--check <image>` diffs a built image against it.
+- **L2 (microVM) toolchain parity** — Lima provisioning now installs the same document/data stack
+  (best-effort, with 24.04 version drift accepted).
+- **`--run-dir <path>` global flag** to relocate the runs root (a thin shim over `COWORK_HARNESS_RUNS_DIR`).
+  Precedence: `--run-dir` > `COWORK_HARNESS_RUNS_DIR` > `~/.cowork-harness/runs`. Keeps sensitive artifacts out
+  of a working tree without the prior `cd`-into-a-scratch-dir workaround. Both spellings (`--run-dir <path>` and
+  `--run-dir=<path>`) are accepted; unlike `--dotenv` it does not require the path to exist (it's an output dir).
+- **Cross-project overwrite guard for pinned (`--session-id`) sessions.** On the flat shared root a pinned
+  `sess-<id>` run dir is deterministic, so two projects can resolve to the same path. The writer now identifies
+  a run by its **mounted-source content** (recorded in an `outDir/.origin` marker) and:
+  - **errors instead of silently `rm -rf`-ing** a dir that belongs to a different project (the old behavior
+    blind-deleted a colliding peer's persisted, resumable session);
+  - **fails closed** on a missing/partial marker (a crashed prior run) — it throws with a "delete `<dir>` to
+    reset" hint rather than deleting an unconfirmable dir;
+  - treats a **sourceless inline scenario** (which has no content to identify it, only cwd) as unconfirmable —
+    it throws rather than risk a cwd-collision delete (`skill <dir>` runs always mount the skill, so the common
+    pinned workflow is unaffected);
+  - blocks **`--resume`** onto a different project's session in place (override with
+    `COWORK_HARNESS_ALLOW_FOREIGN_RESUME=1`).
+- **`runs gc` never prunes pinned `sess-*` sessions** (and they don't consume a `--keep-last` slot — partitioned
+  out before counting, so a retained pinned dir can't evict a newer ephemeral run). Only ephemeral `local_*`
+  runs are pruned. Because the default root is now shared, a bare `runs gc` prunes ephemeral runs across **all**
+  projects; pass an explicit `<runs-dir>` to scope it.
+- **multiSelect `AskUserQuestion` gates are now answerable on every answer channel.** Scripted
+  `choose: [list]` already worked; the in-band `--decider-dir` channel now accepts a repeated
+  `--choose` (`answer <dir> --gate 1 --choose Auth --choose Audit`), and `--decider-cmd` helpers /
+  hand-written `resp-N.json` accept a JSON-array reply (`{"answers":{"<q>":["Auth","Audit"]}}`). All
+  channels deliver the binary-verified `", "`-joined wire shape; a member matching no option, an array
+  on a single-select gate, or an empty array each fails loud. `cowork-harness answer`'s `--choose` is
+  now repeatable for multiSelect gates (still single-only on single-select). Verified end-to-end
+  against a live model (the real agent re-reads the joined answer as multiple selections).
+- **`scaffold --from-run`** flags a delivered answer that looks like a multiSelect set (contains
+  `", "`) with a loud comment telling the author to split `choose: "A, B"` into `choose: [A, B]`
+  before replay (a scaffolded multiSelect answer would otherwise not match on replay).
+
+### Fixed
+
+- `doctor`'s staged-agent remedy now hints to put `COWORK_AGENT_BINARY` in `.env` so `--dotenv` covers it
+  (like the auth token) — avoiding a misleading "red" when `doctor` is run without the same env/flags the real
+  run uses.
+- **`--decider-dir` / `--decider-cmd` no longer crash on a multiSelect array reply.** `coerceLabel`
+  previously called `.trim()` on a non-string answer and threw a bare `TypeError`, aborting the run;
+  it now throws a clear `UnansweredError` instead, and a multiSelect array is validated per-member and
+  delivered as the joined wire shape.
+- **Codebase bug-review sweep — 49 validated fixes across the harness** (beyond the behavior changes noted
+  under Breaking):
+  - **CLI parsing:** `vm status --output-format json` works and emits a JSON envelope, instead of misreading
+    the flag as a baseline name; `skill` and common flags accept every documented `--flag=value` form;
+    `boundary-check` reports a missing/malformed session as a clean (JSON-aware) usage error rather than an
+    internal error; `chat` rejects extra positionals and empty/flag-looking value-flag arguments; `parseArgs`
+    rejects empty `--flag ""` values.
+  - **Path / boundary hardening:** named baselines can no longer escape `baselines/` via `../`; marketplace and
+    staged-mount symlinks that resolve out of tree are rejected (realpath, not lexical); collected artifacts
+    skip hardlinks (`nlink > 1`) that could inline out-of-root content into a cassette; a new
+    `src/boundary-paths.ts` centralizes `safeNamedBaseline` / `containedRealPath` / `normalizeHost` /
+    `validateBareDomain` so the egress allowlist and seed-domain paths share one policy.
+  - **Protocol / replay integrity:** every control-request validates its `request_id` before replying; the
+    AskUserQuestion body is validated at ingress (optionless / header-only gates still pass); a malformed
+    cassette no longer aborts the whole replay batch; a `web_fetch` decision of the wrong kind is recorded as
+    `mismatch→deny` with a warning; egress host matching is case- and trailing-dot-normalized.
+  - **host-loop fidelity:** the `web_fetch` SSRF backstop pins the vetted address through connect (closing a
+    DNS-rebind TOCTOU) and re-vets each redirect; a Docker infrastructure failure (daemon down, missing
+    container, exit 125) is reported to the model as a generic harness error and logged raw, instead of
+    leaking daemon text framed as a normal command exit.
+  - **Fidelity drift checks:** the rootfs `--check` diffs the whole Layer-A pip set (generated from the
+    Dockerfile) plus Node, the apt doc stack, and global npm; rootfs image tags are content-addressed; the
+    capability cache keys on image content rather than a mutable tag; `sync` cleans its temp extraction dir and
+    records a drift signal on a corrupt `config.json`.
+  - **decider / schema / Python:** `allow_if` predicates accept non-identifier input keys (`input["file-path"]`);
+    `choose`+`answer` and inert `grant` are rejected at schema time; optionless prompt/LLM gates are answerable;
+    the Python wrapper returns a `BatchResult` for directory/replay runs so a later failure can't hide behind a
+    passing first result.
+- **Documentation audit sweep — stale references corrected, gaps filled.** Bumped the "current baseline" pins
+  across README / DESIGN / SPEC / spawn-contract / skill docs to `desktop-1.14271.0` (agent ELF 2.1.181),
+  re-verified end-to-end against the live staged agent at this baseline; added the missing
+  `tool_result_contains` / `tool_result_not_contains` and `allow_missing_capability` assertion rows plus a
+  verdict-signals (`prompt_asset_missing`) section to the docs; documented `doctor` / `rehash` / `runs gc` and
+  exit code `3` in `llms.txt` and the README command table; corrected the SPEC §11 exit-code table
+  (`boundary` → `3`), the `chat --folder` / `folders[].to` notes, the `trace --view tools` flag, and the
+  skill-bootstrap version floor (`@>=0.7.1`). **CI fix:** the agent-base image build in
+  `.github/workflows/ci.yml` was tagged `:1` while every code path defaults to `:2` — now `:2`.
+
 ## [0.7.1] — 2026-06-20
 
 ### Fixed