cowork-harness 1.16.0 → 1.18.0

package/.claude/skills/cowork-harness/SKILL.md

@@ -3,8 +3,8 @@ name: cowork-harness
 description: Test or debug a Claude Code skill/plugin under Claude Cowork's runtime — sandboxed agent, default-deny egress, the can_use_tool permission/question protocol — using the cowork-harness CLI. Use when validating or regression-testing a skill, authoring or debugging a scenario YAML (prompt + scripted answers + assert:), choosing a fidelity tier, scripting AskUserQuestion / tool-permission answers, or asserting artifacts, egress, or sub-agent dispatch. Especially when a harness run no-ops an assertion, fails on an unanswered gate, false-greens, a steered answer never reaches the model, or a web_fetch is unexpectedly denied or gated. Also when iterating or hardening a skill across fixes, or grounding a skill's self-critique against its own run evidence — including a document-analysis skill (cap table, deck, financial model, transcript) that needs an uploaded file attached to be critiqued at all. NOT for generic unit testing (pytest/vitest of your own scripts) or non-Cowork CI. Covers the skill / run / chat / record / replay / trace / decide / assertions / scaffold commands and the session-vs-scenario split.
 metadata:
   author: cowork-harness
-  version: 1.16.0
-  tracks-harness: cowork-harness 1.16.0 (baseline desktop-1.24012.9)
+  version: 1.18.0
+  tracks-harness: cowork-harness 1.18.0 (baseline desktop-1.25927.0)
 ---
 
 # cowork-harness
@@ -22,8 +22,8 @@ flagged with a loud `::warning::`, not silent — auto-answer a gate, observe an
 allowlist). This skill exists mostly to keep you out of those traps — the Gotchas section below is
 the highest-value part. Read it.
 
-> **Version note:** the facts and `file:line` pointers here track `cowork-harness 1.16.0` (baseline
-> `desktop-1.24012.9`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
+> **Version note:** the facts and `file:line` pointers here track `cowork-harness 1.18.0` (baseline
+> `desktop-1.25927.0`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
 > `SPEC.md` / `docs/*.md` over this snapshot, and re-run the bundled linter.
 
 ## Preflight — make sure the harness can actually run
@@ -39,7 +39,7 @@ Before the first command, confirm the CLI is reachable and **fail loud** (never
 
 - **One-shot check.** Run `cowork-harness doctor [--tier <tier>]` first — a read-only prerequisite check that inspects Docker, the staged agent, the token, and the baseline in one pass. The bullets below explain each thing it checks (and how to fix it).
 - **Replay-only? Skip `doctor`.** Replaying committed cassettes needs no Docker, no staged agent, and no token — and every tier's `doctor` validates the auth token (the live tiers also Docker + the staged agent), so a ✗ there is expected, not a blocker. Go straight to `cowork-harness replay <cassette>`.
-- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 1.16.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@>=1.16.0" <cmd>` (Node ≥ 22), or install once with `npm i -g "cowork-harness@>=1.16.0"`. **Pin `@>=1.16.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
+- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 1.18.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@>=1.18.0" <cmd>` (Node ≥ 22), or install once with `npm i -g "cowork-harness@>=1.18.0"`. **Pin `@>=1.18.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
 
   This skill documents the CURRENT surface, not release history. If `cowork-harness --version` is
   OLDER than the floor, the per-release record of what you are missing is [CHANGELOG.md](https://github.com/yaniv-golan/cowork-harness/blob/main/CHANGELOG.md)
@@ -166,6 +166,10 @@ Exact accepted values (teach precisely): `--on-unanswered` takes `fail|prompt|fi
 only `fail|first` on `run`. **`llm` is NOT an `--on-unanswered` value** — the bare flag
 `--on-unanswered llm` is rejected (use `--decider-llm`); the YAML spelling is `on_unanswered: llm`.
 The word `agent` is **retired** — do not write `on_unanswered: agent` (the schema rejects it).
+`--on-unanswered` also conflicts with `--decider-dir`/`--decider-cmd`/`--decider-llm` (the channel or
+model IS the terminal, so a policy alongside it never applies) — pass one, not both. On `record`, a
+scenario setting `on_unanswered: prompt` is rejected too: the YAML field outranks the flag, and a TTY
+wait can't produce a deterministic committed fixture.
 `--on-unanswered first` is itself flagged `nonDeterministic` — it is *not* a deterministic stand-in
 for scripted answers. See `references/fidelity-and-answers.md`.
 
@@ -197,7 +201,7 @@ Conflating these is the **biggest landmine**. An assertion key has two independe
   `egress_*`, `file_exists`, `user_visible_artifact`, `result`) are robust. Free-text content is
   not: match prose with `transcript_matches` / `transcript_contains` (stable lexical markers only —
   not semantic content the model paraphrases, which re-records red); check structured JSON with YAML
-  `artifact_json` (or the pytest lane for complex predicates), not via a transcript substring.
+  `artifact_json` (or the [pytest lane](https://github.com/yaniv-golan/cowork-harness/blob/main/python/README.md) for complex predicates), not via a transcript substring.
 - **Axis B — survives `replay`?** *Independent of Axis A.* On the token-free `replay` lane, only
   **content keys** evaluate; filesystem / egress keys are skipped (live-only) — loudly, via an
   `::warning::` annotation, not a silent no-op. A key
@@ -319,6 +323,8 @@ When the scenario declares `answers:`, verify-run **also** checks they still mat
 reworded gate or a `choose:` the run never offered fails here in ~1s instead of on a paid re-record). Or skip
 the discovery/encode/record dance entirely and answer gates **live during the recording** with
 `record --decider-dir`/`--decider-llm` (the cassette is flagged non-deterministic but replays deterministically).
+`run` takes no `--dry-run`: to check that a scenario **loads** without spending, use
+`cowork-harness record <file.yaml> --dry-run`; `lint` checks the assertion invariants (both above).
 
 **Author answers WITHOUT re-paying — the cheap loop.** You don't need a fresh paid record to discover a
 scenario's gates or their labels: `--keep` ONE run, then `cowork-harness trace <run-dir> --view questions`
@@ -430,9 +436,25 @@ Recognize these before "fixing" a non-bug:
   only when you thought to ask for it, and the runs that most need this are the ones where nobody did.
   **Silent when the evidence cannot answer the question** (no workspace walk, or a tier that runs no
   scratchpad walk, absent delivery telemetry, or a resumed turn) — "cannot tell" never reads as "clean".
-  Fix by writing deliverables under `outputs/` or a connected folder, or delivering them explicitly; assert
+  **The fix is lane-dependent.** On `lane: local`, write deliverables under `outputs/` or a connected
+  folder, or deliver them explicitly. **On `lane: remote`, moving a file under `outputs/` does NOT help** —
+  nothing is delivered by location there, so only an explicit delivery counts. Assert
   **`allow_undelivered_deliverables: true`** when the leftovers are intentional (intermediates, caches,
   downloaded inputs) rather than a delivery gap.
+- **`delivery_unobservable`** (`WARN`, `lane: remote` only) — the run produced file(s) but the harness
+  serves **no delivery tool on that lane**, so whether they reached the user is unanswerable. This is the
+  honest cannot-verify companion to `undelivered_deliverables`: reporting every remote file as undelivered
+  would claim more than the evidence supports, and staying silent would read as clean. Mutually exclusive
+  with `undelivered_deliverables`, and quiet on a run that produced nothing to deliver. Not a skill defect —
+  a harness coverage gap (see the *File delivery* section of fidelity-gaps).
+- **`mount_delete`** (`WARN`) — a delete touched a **delete-denied mount other than `outputs`**: a `rw`
+  connected folder. Production denies `unlink`/`rmdir` on *every* Cowork FUSE mount until per-mount
+  approval, not just outputs — a connected folder shows the identical default — so this run diverged from
+  what production would have allowed. `WARN` rather than `FAIL` because the harness **detects** post-hoc
+  what production **enforces**: by the time the scan sees it, the agent already proceeded where it would
+  have hit `EPERM`, so failing the run would overstate what a post-hoc scan knows. Author
+  `no_delete_in_mounts: true` to hard-fail on it, or `allow_delete_in: ["<mount>"]` to waive that mount
+  (detection still runs and the hit is still recorded — the waiver is a verdict decision).
 - **`host_path_leak`** — skipped at **`hostloop` and `protocol`** fidelity (the agent runs on real host
   paths there, so a host path in model-visible text is expected, not a leak); it is *armed* at
   `container`/`microvm`, but only *fires* on an actual scanned leak with no authored
@@ -476,6 +498,19 @@ newest session's `status.json` and reads that. `--follow` fails loud on a timeou
 rather than hanging forever. (Fuller recipe in [`docs/run-status.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/run-status.md) — repo-only, not in the installed
 payload; `cowork-harness status --help` has the flags.)
 
+**Poll with `--follow`, not with a shell loop over `status`'s stdout.** The one-shot text form prints to
+**stderr** and writes nothing to stdout; `--output-format json` (one envelope) and `--follow` (one JSON
+line per status change) are the **stdout** forms. A poll that greps `status`'s stdout therefore matches
+nothing, exits 1, and returns instantly against a run with minutes left to go — a silent false "done":
+
+```bash
+# WRONG — stdout is empty, so grep exits 1, `!` inverts it, and the loop never sleeps.
+until ! cowork-harness status "$D" | grep -q '● running'; do sleep 30; done
+
+# RIGHT — the harness owns the poll loop and exits when the run reaches a terminal state.
+cowork-harness status "$D" --follow
+```
+
 **A multi-minute `record`/`run` outlives a short-lived wrapper.** Don't launch a long record from a
 subagent that returns before it finishes — the returning agent tears down its process tree and kills the
 in-flight run mid-artifact-write. Run it foreground, or detached from any process that will exit first.
@@ -512,7 +547,7 @@ Docker, no re-record.
 | Situation | Symptom | Reach for (in order) |
 |---|---|---|
 | **The skill misbehaved** | wrong output, an unexpected gate, a denied tool, an opaque crash | `inspect` — what did it produce? · `trace <run-dir> --view <view>` — what did it actually do (tools, gates, sub-agent tree)? · `verify-run` — re-assert cheaply when only an assertion is wrong · `diff <old-run> <new-run>` — what changed since it worked · `chat` — reproduce it by hand |
-| **A green you don't trust** | an assert that may have tested nothing, a stale cassette, an auto-answered or decided gate | `replay --explain` — the evidence trail behind each *passing* assert · `lint` — assertions on the wrong CI lane / mixed-class keys · `verify-cassettes` — privacy + staleness over committed cassettes · the Gotchas landmine catalog — how a check passes vacuously · `run --repeat N` / `skill --repeat N` — did it pass, or pass once? · `stats` — flaky or expensive over time |
+| **A green you don't trust** | an assert that may have tested nothing, a stale cassette, an auto-answered or decided gate | `replay --explain` — the evidence trail behind each *passing* assert · `replay --mutate` — perturbs each recorded JSON artifact value and reports which perturbations NOTHING caught (reporting only; never moves the verdict/exit code) · `lint` — assertions on the wrong CI lane / mixed-class keys · `verify-cassettes` — privacy + staleness over committed cassettes · the Gotchas landmine catalog — how a check passes vacuously · `run --repeat N` / `skill --repeat N` — did it pass, or pass once? · `stats` — flaky or expensive over time |
 
 A failed run also records `errorSource` (where the failure originated) and `stderrLogPath` (the captured
 agent stderr) — read those before re-running; a re-record rarely tells you more than the captured stderr
@@ -693,11 +728,17 @@ repeats the assertion/replay-relevant ones alongside the schema (a scoped subset
    `mode:r` mounts get a real `:ro` bind (a write fails in-guest). But `rw` vs `rwd`
    (write-but-no-delete on `outputs/` / connected folders) is *not* mount-enforced **in the harness** —
    `rm` succeeds and is only caught post-hoc by `no_delete_in_outputs`. **Real Cowork enforces it live:**
-   `rm` under `outputs/` fails `Operation not permitted`, and a skill must request approval via
-   `allow_cowork_file_delete` to delete. Two consequences: a skill should not stage disposable scratch
+   outputs is a FUSE mount, and `unlink`/`rmdir` fail `Operation not permitted`; a skill must request
+   approval via `allow_cowork_file_delete` (which re-mounts the folder `rwd` mid-session) to delete.
+   **Only unlinking is denied.** Emptying a file in place — `truncate -s 0`, `> file`, `shred` without
+   `-u` — and renaming *within* outputs both SUCCEED in production, so the harness does not flag them
+   either. Renaming a file OUT of outputs fails (`EXDEV`, then `EPERM` on the copy-then-unlink
+   fallback), so that stays a delete. Two consequences: a skill should not stage disposable scratch
    under `outputs/` (in production, cleanup there costs an approval prompt), and a skill's
    "catch-EPERM-then-request-approval" branch cannot be exercised at any harness tier (the `rm` just
    succeeds here). Do not read this gotcha as "delete-deny may not be real in production" — it is real.
+   If a scenario's deletion IS intended, assert `allow_outputs_delete: true` rather than dropping
+   `no_delete_in_outputs` — omitting it does not permit anything.
 
 9. **Keep `.env` out of any mounted folder** — it is copied into the sandbox and the token could
    leak. Put it at a working-dir or install root (token resolution: env > `--dotenv` > `./.env` >
@@ -847,6 +888,14 @@ repeats the assertion/replay-relevant ones alongside the schema (a scoped subset
     ([`docs/fidelity-gaps.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/fidelity-gaps.md)
     → "File delivery" has the binary-verified detail; repo-only.)
 
+25. **Two distinct host-inventory consent flags — a record-time one and a verify-time one.** `record
+    --allow-host-inventory-fixture` is the boolean consent to proceed recording a host-inheriting
+    (`protocol`/`hostloop`/`cowork`-resolving-to-hostloop) cassette into a repo-visible path — otherwise
+    `record` refuses (freezing this machine's MCP servers/agents/account into a committed fixture is the
+    risk). `verify-cassettes --allow-host-inventory <regex>` is unrelated: a per-finding suppressor for the
+    scanner's `host-inventory` class on an already-committed cassette. Passing one where the other command
+    wants it fails as an unrecognized flag — they don't interchange. Depth: `references/ci-recipe.md`.
+
 For the assertion catalog, the YAML schema, the fidelity/answer tables, and the CI recipe, read the
 files in `references/` (the gotchas above are the full list; the references repeat only the
 assertion/replay-relevant ones).

package/.claude/skills/cowork-harness/references/ci-recipe.md

@@ -1,6 +1,6 @@
 # CI recipe — replay vs live lanes
 
-Self-contained reference. Tracks `cowork-harness 1.16.0` (baseline `desktop-1.24012.9`).
+Self-contained reference. Tracks `cowork-harness 1.18.0` (baseline `desktop-1.25927.0`).
 
 **Fastest path: the packaged Action.** One step gets you `replay`/`lint`/`verify-cassettes` plus a PR
 job-summary reporter (verdict table, staleness findings, cost/turns when available):
@@ -13,7 +13,7 @@ job-summary reporter (verdict table, staleness findings, cost/turns when availab
 ```
 
 The Action's `version` input defaults to `latest` — intentional so a copy-pasted recipe tracks the current
-release; pin an exact version (e.g. `version: "1.16.0"`) for reproducible CI.
+release; pin an exact version (e.g. `version: "1.18.0"`) for reproducible CI.
 
 Reach for the manual multi-step form below only when you need per-step control the Action's inputs don't
 cover (a custom flag combination, a different runner matrix per step, or `lint`/`verify-cassettes` gated
@@ -32,7 +32,7 @@ jobs:
       - uses: actions/checkout@v4
       - name: Stage the agent binary (official channel, sha256-verified — see https://github.com/yaniv-golan/cowork-harness/blob/main/docs/maintenance.md)
         run: |
-          V=2.1.219   # match your scenario's pinned baseline's agentVersion
+          V=2.1.221   # match your scenario's pinned baseline's agentVersion
           curl -fSL "https://downloads.claude.ai/claude-code-releases/$V/linux-arm64/claude" -o "$RUNNER_TEMP/claude-$V"
           chmod +x "$RUNNER_TEMP/claude-$V"
           # verify against the committed baseline's sha256 (baselines/desktop-*.json → agentBinary.sha256)
@@ -58,12 +58,25 @@ sha256-*checked* but not hard-blocking on mismatch — it's advisory for an inte
 GitHub-hosted runners, no token/Docker/agent:
 
 ```yaml
-- run: npm i -g "cowork-harness@>=1.16.0"
-- run: cowork-harness lint scenarios/*.yaml          # no silent false-greens
-- run: cowork-harness verify-cassettes cassettes/    # privacy + staleness
+- run: npm i -g "cowork-harness@>=1.18.0"
+- run: cowork-harness lint scenarios/*.yaml --strict --min-severity WARN
+                                                    # no silent false-greens. WITHOUT --strict this
+                                                    # step cannot fail on a WARN-class rule (e.g.
+                                                    # vacuous-gate-assert) — it would print the
+                                                    # finding and still exit 0. --min-severity WARN
+                                                    # keeps the advisory INFO class advisory.
+- run: cowork-harness verify-cassettes cassettes/    # privacy + staleness — FAILS on a stale recording
+                                                    # ALSO fails on a leaked host inventory: recording at
+                                                    # protocol/hostloop freezes YOUR machine's MCP servers,
+                                                    # agents and account org into the cassette. Record
+                                                    # committed fixtures at `container` (sealed) to avoid it.
 - run: cowork-harness replay cassettes/              # token-free content/structure
 ```
 
+Both lines matter: `replay` alone **warns** on a stale recording and exits 0, so dropping the
+`verify-cassettes` step means a skill edit silently stops being tested. (One command instead of two:
+`replay --fail-on-skill-drift`.)
+
 The rest of this doc explains the lane split, recording, privacy, and the full pipeline + live job.
 
 ## The core split: token-free PR gate + live nightly (self-hosted)
@@ -111,6 +124,13 @@ The split is not just about tokens — it decides **where each lane can run**:
   cowork-harness assertions --list --output-format json   # every key, with its replay class
   ```
 
+  **`replay --mutate`** is a distinct, reporting-only diagnostic on this same lane: it perturbs each
+  recorded JSON artifact value one at a time, re-runs the assertions against the perturbed cassette,
+  and reports which perturbations NOTHING caught — those are the fields your `assert:` block leaves
+  unguarded. It never changes the verdict or exit code (it's coverage information, not a check), so
+  don't wire it into a pass/fail gate — read its `::warning::`/`::notice::` output to find `assert:`
+  gaps to close.
+
   Placing a key on this gate from a doc list rather than from `assertions --list` is how a valid
   replay-lane check ends up left off the PR gate. Filesystem/egress assertions are
   skipped on this token-free lane — loudly: replay emits an `::warning::` annotation whenever it drops
@@ -177,6 +197,12 @@ dollar figures). In a skill repo these cassettes get **committed**. So:
   (`hostloop`, `protocol`) has an **empty** redaction policy — that combination commits real host paths
   the `path` scanner then hard-fails at `verify-cassettes` time. The always-on scanner remains the
   universal net (container-tier recordings can trip it too).
+- **Host-inheriting record refused by default — `--allow-host-inventory-fixture` is the consent.** A
+  `protocol`/`hostloop`/`cowork`-resolving-to-hostloop record into a repo-visible cassette path would
+  freeze THIS machine's MCP server names, agents, and account metadata into a committed fixture, so
+  `record` refuses outright rather than warn. Pass `--allow-host-inventory-fixture` only when the
+  recording session genuinely has no personal MCP servers or plugins to leak — it is a per-record
+  boolean consent, not a pattern.
 - **Always-on scan gate** — `verify-cassettes` flags email / currency / bare-domain / local-path /
   machine-inventory matches it finds in the committed cassettes and **exits non-zero**, so "no leak" is
   a gate, not discipline. Non-zero is not one thing, though: exit `1` means verification RAN and found a
@@ -189,6 +215,13 @@ dollar figures). In a skill repo these cassettes get **committed**. So:
   Suppress synthetic / public reference names (NVCA, Cooley GO, …) with `--allow <regex>`. (Multi-word
   proper names are NOT a default class — too noisy to gate on; add a pattern via config if your corpus
   needs it.)
+- **`--allow-host-inventory <regex>` — the per-finding sibling of the record-time consent above, and a
+  different thing from it.** `verify-cassettes` scans a **structural** `host-inventory` class (an
+  `mcp_servers[].name`/`agents[]` entry outside the harness's own known set, or `account.email`/
+  `.organization`/`.subscriptionType`) over already-committed cassettes. `--allow-host-inventory <regex>`
+  suppresses a specific finding there — it is a scanner allowlist entry, not a record-time green light —
+  and, like `--allow-domain`/`--allow-email`/`--allow-path`/`--allow-machine-inventory`, scopes the
+  pattern to that one class so it can't accidentally clear an unrelated finding.
 
 ```bash
 cowork-harness verify-cassettes cassettes/                       # privacy scan + staleness — exit 1 = verified & failed, exit 3 = could not verify
@@ -246,7 +279,7 @@ jobs:
         with: { node-version: '24' }
       - uses: actions/setup-python@v5
         with: { python-version: '3.x' }                                       # python3 only — PyYAML is bundled with the linter
-      - run: npm i -g "cowork-harness@>=1.16.0"
+      - run: npm i -g "cowork-harness@>=1.18.0"
       - run: cowork-harness lint scenarios/*.yaml                              # no-silent-false-green (needs python3; PyYAML bundled)
       - run: cowork-harness verify-cassettes cassettes/ --output-format json   # privacy + staleness gate
       - run: cowork-harness replay cassettes/ --output-format json             # token-free content/structure
@@ -275,7 +308,7 @@ jobs:
             echo "live=true" >> "$GITHUB_OUTPUT"
           fi
       - if: steps.guard.outputs.live == 'true'
-        run: npm i -g "cowork-harness@>=1.16.0"
+        run: npm i -g "cowork-harness@>=1.18.0"
       - if: steps.guard.outputs.live == 'true'
         run: cowork-harness run scenarios/ --output-format json
         env:
@@ -302,6 +335,14 @@ scenario = `result === "success" && assertions.every(pass)`. Exit code is non-ze
 fails or a run errors, so a plain `cowork-harness run scenarios/` is already CI-ready without parsing
 JSON.
 
+**For the commands in this recipe, stdout carries the machine envelope and nothing else.** Without
+`--output-format json`, `run` / `record` / `replay` / `verify-cassettes` / `status` write their whole
+human rendering — warnings, verdict, `status`'s summary line — to **stderr**, and stdout stays empty.
+A wrapper that captures only stdout gets an empty log and, if it greps that for a state, a silent false
+negative. Capture stderr for the human trail (`2> run.stderr.log`), or ask for JSON and parse stdout.
+(Commands whose whole job is to print a value — `--version`, `assertions --list`, `scaffold`, `gates`,
+`skill --dry-run` — write it to stdout by design, with or without the flag.)
+
 `verify-cassettes` emits its **own** envelope (`{command, ok, coverage, results[]}` with per-file
 `findings`/`staleness`/`unverifiable`/`notes`/`version`/`error`), published as
 `schema/verify-cassettes.json` in the npm package. `ok:false` doesn't say *why* — read the buckets, or <!-- npm-only-ok -->

package/.claude/skills/cowork-harness/references/critique.md

@@ -1,6 +1,6 @@
 # Critique — the facts a plugin install can't otherwise reach
 
-Tracks `cowork-harness 1.16.0` (baseline `desktop-1.24012.9`). This is **not** a trim of the full
+Tracks `cowork-harness 1.18.0` (baseline `desktop-1.25927.0`). This is **not** a trim of the full
 [`docs/critique.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/critique.md) (repo-only —
 flags, cost, reproduction discipline, known limitations all live there). This file covers exactly what a
 plugin install cannot otherwise discover: the run-dir artifact a harvester actually reads, the report's

package/.claude/skills/cowork-harness/references/fidelity-and-answers.md

@@ -1,6 +1,6 @@
 # Fidelity tiers & answer paths
 
-Self-contained reference. Tracks `cowork-harness 1.16.0` (baseline `desktop-1.24012.9`).
+Self-contained reference. Tracks `cowork-harness 1.18.0` (baseline `desktop-1.25927.0`).
 
 ## Fidelity tiers (`fidelity:` in the scenario)
 
@@ -74,7 +74,7 @@ regressions.
 | **Spawned helper** | `--decider-cmd '<helper>'` | depends on the helper |
 | **In-band (driving agent)** | `--decider-dir <dir>` (+ a Monitor that writes responses) | depends |
 
-Scripted `answers:` and a terminal (`--decider-llm` / `--decider-cmd` / `--decider-dir` / `on_unanswered`) compose as a normal Chain — scripted rules resolve matched gates, the terminal answers whatever's left. What's mutually exclusive is picking **two terminals** at once (e.g. `--decider-llm` with `--decider-cmd`, or `--decider-llm` with an explicit `--on-unanswered`) — the CLI rejects that combination. The in-band path's Monitor drives two
+Scripted `answers:` and a terminal (`--decider-llm` / `--decider-cmd` / `--decider-dir` / `on_unanswered`) compose as a normal Chain — scripted rules resolve matched gates, the terminal answers whatever's left. What's mutually exclusive is picking **two terminals** at once — the CLI rejects every such pairing: two channels (`--decider-dir` with `--decider-cmd`), a model terminal with a channel or a policy (`--decider-llm` with either), and a channel with a policy (`--decider-dir`/`--decider-cmd` with `--on-unanswered`). A channel or the LLM decider *is* the terminal, so an accompanying `--on-unanswered` could only ever be inert — the chain never reaches the policy terminal. The in-band path's Monitor drives two
 subcommands: `gates <dir>` (stream the pending questions) and `answer <dir> --gate N …` (reply to one).
 
 **The `--decider-llm` answer protocol.** The answering model is shown the gate's options **numbered** and

package/.claude/skills/cowork-harness/references/scenario-schema.md

@@ -1,7 +1,7 @@
 # Scenario & session schema, assertion catalog, web_fetch, full gotchas
 
-Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 1.16.0`
-(baseline `desktop-1.24012.9`). If your checkout is newer, prefer the live [`docs/scenario.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/scenario.md),
+Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 1.18.0`
+(baseline `desktop-1.25927.0`). If your checkout is newer, prefer the live [`docs/scenario.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/scenario.md),
 [`docs/session.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/session.md), and `SPEC.md`.
 
 **Minimal scenario** — `prompt` is the only required field:
@@ -32,7 +32,7 @@ references a session for setup.
 ```yaml
 name: my-test                       # OPTIONAL — defaults to the filename; keys runs/<name>/
 baseline: latest                    # platform baseline: "latest" or "desktop-<ver>" (NOT "profile:")
-session: ../sessions/default.yaml   # pre-prompt setup (resolved relative to THIS file)
+session: ../sessions/my-session.yaml # pre-prompt setup (resolved relative to THIS file)
 fidelity: container                 # protocol | container | microvm | hostloop | cowork
 execution: local                    # OPTIONAL — orthogonal to fidelity (a privilege/sandbox tier, all
                                     # local): local (default) | cloud-describe (RESERVED — no runner
@@ -146,6 +146,13 @@ folders:
 uploads:
   - ~/Downloads/report.pdf
 
+# connected PROJECTS (userSelectedProjectUuids) — NOT the same as a work folder above, and not the
+#   legacy mnt/.projects/<id> work-folder path older baselines used
+projects:
+  - { uuid: 7f3c…, from: ~/code/myproject }   # mounted READ-ONLY at mnt/.projects/<uuid>
+                                              #   no mode: knob — production hardcodes ro
+                                              #   never becomes the cwd; {{workspaceFolder}} stays at outputs
+
 # discovery: marketplaces / plugins / skills / mcp
 plugins:
   marketplaces: []               # plugin_marketplaces (git URLs or local paths)
@@ -158,7 +165,7 @@ plugins:
 skills:
   local: []                      # extra host skill dirs
   suggest_enabled: true          # gate 245679952 override — `mcp__skills__suggest_skills` on/off (default true)
-  proactive_suggest_enabled: false  # gate 1598976391 override — proactive description + `trigger` param (default false)
+  proactive_suggest_enabled: false  # gate 1598976391 override — proactive description + `trigger` param; unset = synced baseline gate (ON from 1.24012.11)
 mcp:
   config: null                   # --mcp-config file (standard mcpServers map)
   enabled: []
@@ -274,6 +281,7 @@ same set live from the schema.
 | `file_exists: <path>` | the path exists under the run's `work/` (anchored at `mnt/`, e.g. `outputs/x.md`). For a user-facing deliverable prefer `user_visible_artifact` — with a connected folder the file lands in `mnt/<folder>` (= `{{workspaceFolder}}`), not `mnt/outputs`, so `file_exists: outputs/x.md` misses it |
 | `user_visible_artifact: <path>` | exists **and** under a user-visible root (`outputs/` + each connected folder's mount name) — the right primitive for a workspace deliverable when a folder is connected |
 | `no_delete_in_outputs: true` | no delete op touched `mnt/outputs` — **only `true` is valid**; `false` is rejected (omit to allow deletes) |
+| `no_delete_in_mounts: true` | no delete op touched ANY delete-denied mount — `outputs` plus every `rw` connected folder — except those waived by `allow_delete_in`. Production denies `unlink`/`rmdir` on every such mount, so `no_delete_in_outputs` covers only part of the real rule. **only `true` is valid** |
 | `no_unexpected_files: [<glob>, …]` | every **newly created** file under a user-visible root matches ≥1 glob (workRoot-relative paths; `**` = whole path segment for any depth — use `outputs/handoff/**` for per-run subdirs); `[]` = no new files; **new-files-only** — overwriting a pre-existing file in place is invisible (use content-level producer stamping); live/verify-run without a pre-run manifest ⇒ evidence-unavailable hard-fail (live runs capture the baseline only when this key is asserted; recordings always capture); an **incomplete post-run filesystem walk** (an unreadable subtree — a permission/I-O error) also fails evidence-unavailable rather than reporting "no strays" over a partial tree — distinct from the missing-manifest case (a `--resume` run), which fails for a different reason; captured on every live sandbox tier including microvm (its outputs are snapshotted from the VM into the run dir); replay needs `cassette.preRunPaths` (≥0.24 recordings) — cassettes without it **exclude** the key with a loud warning |
 | `input_unmodified: <glob>` or `[<glob>, …]` | a single glob or a list; every **pre-existing** file (incl. uploaded files under `uploads/**`) whose workRoot-relative path matches ≥1 glob keeps an unchanged content hash after the run — the in-place-mutation companion to `no_unexpected_files`'s new-files check (`[]` is rejected by the schema — list at least one glob); a glob that matches **no** pre-run path fails loud (a typo or renamed mount would otherwise verify zero files and pass vacuously); a matched file that was deleted counts as a content change (fails); live/verify-run without a pre-run hash manifest ⇒ evidence-unavailable hard-fail (a `--resume` run); captured on every live sandbox tier including microvm; replay needs `cassette.preRunHashes` — cassettes without it **exclude** the key with a loud warning; on replay it compares against the manifest's recorded `sha256`, never a re-hash of the materialized tree |
 | `self_heal_ran: <bool>` | a plugin-root self-heal script was (not) invoked |
@@ -334,12 +342,14 @@ same set live from the schema.
 | `allow_l0_plugin_divergence: true` | verdict modifier — opt into L0/protocol plugin divergence: suppresses the default-fail when a plugin behaves differently at `protocol` (L0) fidelity than under a sandboxed tier. Live tiers only |
 | `allow_stall: true` | verdict modifier — suppresses the `stalled` default-fail when a run ends on a question having done no productive tool work after its last gate (the agent asked for input and stopped — incl. re-asking in plain text after answering an `AskUserQuestion`); assert only when ending on a question is intended, else script the answer (`answer:` / `--answer` / a decider) |
 | `allow_undelivered_deliverables: true` | verdict modifier — suppresses the `undelivered_deliverables` WARN. Working in the scratchpad is Cowork's designed pattern, so a skill that legitimately leaves intermediates, caches or downloaded inputs behind can say so instead of carrying permanent noise. The signal is warn-only and never fails a run on its own; reach for this when the scratch activity is intentional, not to silence a real delivery gap |
+| `allow_outputs_delete: true` | verdict modifier — accepts a detected outputs delete instead of failing the run, for a skill whose deletion is intended. Omitting `no_delete_in_outputs` does **not** permit deletes (a detected delete fails via the `outputs_delete` signal precisely because the key was not authored), so this is the way to accept one. **Mutually exclusive** with `no_delete_in_outputs`. Waives the harness's post-hoc detection; it does not model Cowork's `allow_cowork_file_delete` approval handshake |
+| `allow_delete_in: [<mount>…]` | verdict modifier — accepts detected deletes in the named mounts (the per-mount analogue of `allow_outputs_delete`, mirroring production's `fileDeleteApprovedMounts`). Waives the verdict only; detection still runs and the hits stay in `result.json`. Listing `outputs` conflicts with `no_delete_in_outputs` |
 | `transcript_no_host_path: true` | no host path (`/Users/`, `/opt/cowork/`, `/home/`, `/root/`) leaked into model-visible text — **incompatible with `hostloop` AND `protocol`**: hostloop's native file tools legitimately expose real host paths, and protocol (L0) runs the agent's file tools on the real host cwd with no sealed filesystem, so this fails BY DESIGN on both (the harness warns at run start if asserted anyway); use `container`/`microvm` for this check |
 | `egress_denied: <host>` | the host was blocked by the egress proxy |
 | `egress_allowed: <host>` | the host was allowed through |
 | `no_mcp_error: true` | no MCP round-trip failed (`RunResult.mcpErrors` is empty — no unhandled server, no handler throw) — live-only: MCP round-trips are harness-computed, not in the SDK stdout stream, so evidence-unavailable on replay (never a vacuous pass). **Only `true` is valid** |
 | `max_peak_rss_bytes: <N>` | peak sampled RSS of the agent sandbox ≤ N bytes (`RunResult.resources.peakRssBytes`) — live-only: replay never spawns a sandbox to sample, so evidence-unavailable on replay/protocol (never a vacuous pass); also evidence-unavailable when sampling captured no RSS value |
-| `semantic_matches: {rubric: [...], min_pass?, judge_model?}` | a pinned LLM judge grades each fixed `rubric` claim against the run's answer — the **union of the agent's final result text (`RunResult.finalMessage`), the transcript, and the final on-disk content of any files the agent authored during the run** — so a claim about content the skill led the agent to *write to a file* grades as reliably as one about inlined prose (authored-file evidence is captured on every live sandbox tier including **microvm** — its session tree is snapshotted from the VM into the run dir). When the authored-file evidence backing the judged document is **incomplete** — a file dropped at the capture-size cap, unreadable at read-back, or (on `--resume`) the scratchpad walk skipped — the assert fails evidence-unavailable rather than trusting a judge grade over a partial document; this is separate from the malformed-grade `judgeInvalid` path below. The assert passes iff ≥ `min_pass` claims pass (default: all — avoid for a gating scenario). Results align by claim index and are recorded per-claim in `RunResult.assertions[].semanticClaims` (`[{index, claim, pass}]`, so a consumer can diff the per-claim profile across runs); a rep whose grade can't be parsed (after one retry) is marked `RunResult.assertions[].judgeInvalid` and **never silently dropped** — it is excluded from the pass denominator, and the guard against a misleading score from that exclusion is the gate's minimum-valid-rep floor (`MIN_VALID` ≥ 4) plus this visibility, not a claim that denominator-shrinking inflation is impossible. Within a rep, a grade that's still unparseable after the retry **fails that assert outright** (evidence-unavailable, not a vacuous pass) — a persistently-flaky judge reds the run rather than silently passing. `judge_model` pins the grader (default when neither it nor `COWORK_HARNESS_JUDGE_MODEL` is set: `claude-opus-4-8`; a dated id keeps a before/after comparison reproducible). Live-only: the judge is a live model call, so evidence-unavailable / skipped-loud on replay (never a vacuous pass) |
+| `semantic_matches: {rubric: [...], min_pass?, judge_model?, include_subagent_text?}` | a pinned LLM judge grades each fixed `rubric` claim against the run's answer — the **union of the agent's final result text (`RunResult.finalMessage`), the transcript, and the final on-disk content of any files the agent authored during the run** — so a claim about content the skill led the agent to *write to a file* grades as reliably as one about inlined prose. **"The transcript" is narrower than it reads: top-level `assistant_text` ONLY.** It excludes every `tool_use`/`tool_result` and **all sub-agent-originated text** (including fork-scoped `Skill`/`Agent(fork)` dispatches — the harness attributes their *tool* calls to the main agent, but not their text). ⚠️ **Consequence: a rubric claim about whether a tool was called can NEVER grade true** — the evidence is not in the judged document. Such a claim looks reasonable and silently caps your pass rate; assert tool use with `tool_called` / `present_files_called` / `subagent_dispatched` / `hook_blocked` instead. Sub-agent text is captured in `RunResult.subagents[].reasoning` and reaches the judge only via opt-in `include_subagent_text: true` (`kind:"text"` turns only — sub-agent *thinking* arrives empty with `redacted:true`, so it would pad the document with blanks) (authored-file evidence is captured on every live sandbox tier including **microvm** — its session tree is snapshotted from the VM into the run dir). When the authored-file evidence backing the judged document is **incomplete** — a file dropped at the capture-size cap, unreadable at read-back, or (on `--resume`) the scratchpad walk skipped — the assert fails evidence-unavailable rather than trusting a judge grade over a partial document; this is separate from the malformed-grade `judgeInvalid` path below. The assert passes iff ≥ `min_pass` claims pass (default: all — avoid for a gating scenario). Results align by claim index and are recorded per-claim in `RunResult.assertions[].semanticClaims` (`[{index, claim, pass}]`, so a consumer can diff the per-claim profile across runs); a rep whose grade can't be parsed (after one retry) is marked `RunResult.assertions[].judgeInvalid` and **never silently dropped** — it is excluded from the pass denominator, and the guard against a misleading score from that exclusion is the gate's minimum-valid-rep floor (`MIN_VALID` ≥ 4) plus this visibility, not a claim that denominator-shrinking inflation is impossible. Within a rep, a grade that's still unparseable after the retry **fails that assert outright** (evidence-unavailable, not a vacuous pass) — a persistently-flaky judge reds the run rather than silently passing. `judge_model` pins the grader (default when neither it nor `COWORK_HARNESS_JUDGE_MODEL` is set: `claude-opus-4-8`; a dated id keeps a before/after comparison reproducible). Live-only: the judge is a live model call, so evidence-unavailable / skipped-loud on replay (never a vacuous pass) |
 | `artifact_json: {artifact, path, …}` | assert a JSON artifact's contents — `equals`/`gt`/`in`/`exists`/`absent`/`is_null` over a dotted `path` (`in` = membership in a list, for a stochastic/LLM value; `absent` ≠ `is_null`; an unresolved intermediate fails loud) |
 | `computer_links_resolve: true` | every `computer://` link in the model-visible transcript resolves to an artifact that exists in the run's collected outputs/mounts — a dangling link fails, naming which target was checked (a live host path, the collected work tree, or the replay manifest). **Requires ≥1 link** (zero links fails — use `computer_links_resolve_if_present` for the presence-free variant). **Only `true` is valid** (`false` is rejected by the schema) |
 | `computer_links_resolve_if_present: true` | like `computer_links_resolve` but passes vacuously when the transcript has zero `computer://` links — the presence-free variant. **Only `true` is valid** |
@@ -369,6 +379,7 @@ codes (`VerdictSignal["code"]` in `src/run/verdict.ts`):
 | `transport_error` | fail | The connection dropped mid/after-run |
 | `permissive_auto_allow` | fail | A cowork-parity auto-allow real Cowork would block (opt out: `allow_permissive_auto_allow`) |
 | `outputs_delete` | fail | An unauthorized delete touched `mnt/outputs` (opt out: author `no_delete_in_outputs`) |
+| `mount_delete` | warn | A delete touched a delete-denied mount other than `outputs` (a `rw` connected folder). Production denies `unlink`/`rmdir` there until per-mount approval, so the run diverged. Warn, not fail: the harness detects post-hoc what production enforces. Author `no_delete_in_mounts` to hard-fail, or `allow_delete_in` to waive |
 | `host_path_leak` | fail | A host path leaked into model-visible text (opt out: author `transcript_no_host_path`) |
 | `l0_plugin_divergence` | fail | L0/protocol plugin loading diverged from Cowork (opt out: `allow_l0_plugin_divergence`) |
 | `missing_capability` | fail | A `requires_capabilities` need was unmet, or the skill used a capability the image omits (opt out: `allow_missing_capability`, or `skill --allow-missing-capability` on an open-ended run) |
@@ -378,7 +389,8 @@ codes (`VerdictSignal["code"]` in `src/run/verdict.ts`):
 | `prompt_asset_missing` | warn | The run proceeded with a missing prompt asset (`COWORK_HARNESS_ALLOW_MISSING_PROMPT=1`); fidelity is degraded |
 | `scan_unavailable` | warn | Post-run scan evidence unavailable (`RunResult.scan` undefined) — the host-path and outputs-delete guards did not run this run |
 | `ended_with_question` | warn | Live-lane heuristic: the final answer contains a question and the run wrote no deliverable to `outputs/` — the lenient sibling of `stalled` (covers a mid-message `?`, or tool work after the last gate that still ended asking). Opt out: `allow_stall` |
-| `undelivered_deliverables` | warn | The skill produced file(s) OUTSIDE every user-visible root and never delivered them — on a remote Cowork session the workspace is reclaimed at session end; on a local one they stay invisible to the user. Fires on every run without opting in, because the scenarios that most need it are the ones whose author never considered delivery. Silent when the evidence cannot answer the question (no workspace walk, a tier that runs no scratchpad walk, absent delivery telemetry, or a resumed turn) — never a vacuous clean. Opt out: `allow_undelivered_deliverables` |
+| `undelivered_deliverables` | warn | The skill produced file(s) OUTSIDE every user-visible root and never delivered them, so they stay invisible to the user. Fires on every run without opting in, because the scenarios that most need it are the ones whose author never considered delivery. Silent when the evidence cannot answer the question (no workspace walk, a tier that runs no scratchpad walk, absent delivery telemetry, a resumed turn, or a lane where delivery is unobservable — see `delivery_unobservable`) — never a vacuous clean. **`lane: local` only**: on remote, delivery cannot be measured at all, so that lane reports `delivery_unobservable` instead of guessing. Opt out: `allow_undelivered_deliverables` |
+| `delivery_unobservable` | warn | `lane: remote` only — the run produced file(s), but whether any reached the user CANNOT be verified: nothing is delivered by location on that lane and the harness models no remote delivery tool (production uses the agent-native `SendUserFile`). The honest counterpart to `undelivered_deliverables`, which would otherwise fire on every remote run that writes anything — a signal that always fires carries no information. Mutually exclusive with it; quiet when the run produced nothing to deliver. A harness coverage gap, not a skill defect. Opt out: `allow_undelivered_deliverables` |
 | `exec_infra_error` | warn | Host-loop: one or more container `exec` calls failed for infrastructure reasons, so those tool calls returned an error to the agent. Warns rather than fails because the run's other evidence is intact — unlike `infra_error`, where a dead supervisor contaminates everything. Caveat: if *every* exec failed, the agent ran nothing and this still only warns — check `result.infraErrors` |
 
 A **fail**-severity signal does not change `result.result` (still `"success"`), but it DOES fail the
@@ -390,12 +402,12 @@ overall run verdict and exit code — `assert result: success` alone won't catch
 A cassette (`record`/`replay`) has **no filesystem and no network**. `replay` re-evaluates only the
 **content** assertions. The authoritative list is `ALWAYS_CONTENT_KEYS`/`QUESTION_GATE_KEYS`/`MANIFEST_KEYS` (composed) in `src/run/cassette.ts`.
 
-**Scenario source — the WHOLE scenario is frozen; only `assert:` can be opted back to disk.** A cassette
-captures every key (`name`/`prompt`/`session`/`baseline`/`fidelity`/`lane`/`skills`/`answers`/`execution`/
-`requires_capabilities`/`expect_denied`/`assert`), and a plain `replay` evaluates **all** of them from that
-frozen copy (byte-deterministic, ignores the working tree); editing `scenarios/<name>.yaml` does not change
-it — replay only prints a `::notice::` when a sibling's `assert:`/`prompt:` differs, or when it fails to
-load at all. An edited `lane:`/`fidelity:`/`baseline:` reaches a replay ONLY by re-recording. `replay --assert-from
+**Scenario source — the WHOLE scenario is frozen; only `assert:` (+`expect_denied:`) can be opted back to
+disk.** A cassette captures every key (`name`/`prompt`/`session`/`baseline`/`fidelity`/`lane`/`skills`/
+`answers`/`execution`/`requires_capabilities`/`expect_denied`/`assert`), and a plain `replay` evaluates
+**all** of them from that frozen copy (byte-deterministic, ignores the working tree); editing
+`scenarios/<name>.yaml` does not change it — replay only prints a `::notice::` when a sibling's
+`assert:`/`prompt:` differs, or when it fails to load at all. An edited `lane:`/`fidelity:`/`baseline:` reaches a replay ONLY by re-recording. `replay --assert-from
 <scenario.yaml>` / `--reassert` is the opt-in token-free re-check against the on-disk block; it **hard-fails**
 on recording-shaping drift (`prompt`/`answers`/`baseline`/`skills`) or skill-content staleness (it implies
 `--fail-on-skill-drift`). `expect_denied`/filesystem/egress keys are sourced from on-disk but stay live-only —

package/.claude/skills/cowork-harness/references/task-recipes.md

@@ -2,7 +2,7 @@
 
 Each recipe composes facts that live scattered across SKILL.md and the other references into one
 decision path. Every one answers a question a real fleet owner had to work out the hard way.
-Tracks `cowork-harness 1.16.0` (baseline `desktop-1.24012.9`), same as SKILL.md's front-matter. Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
+Tracks `cowork-harness 1.18.0` (baseline `desktop-1.25927.0`), same as SKILL.md's front-matter. Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
 Recipe 3's `init-redact` shipped in 0.24.0 and are part of the current feature set — no version gate
 needed if your CLI meets SKILL.md's version floor.
 
@@ -131,7 +131,8 @@ degrade the advice. It is real work to calibrate; these steps are the traps that
 1. **Author a suite of Q&A scenarios — one per representative question.** Each installs your skill and
    asserts the answer with a rubric. The judge grades the **union of the agent's final answer, the
    transcript, and any files it wrote**, so a claim about content your skill leads the agent to *write to a
-   file* grades as reliably as one about inlined prose — you don't have to force an inline answer:
+   file* grades as reliably as one about inlined prose — you don't have to force an inline answer.
+   **But "the transcript" is narrower than it sounds — see step 2a before writing a claim about tool use:**
    ```yaml
    session: ./_session.yaml      # plugins.local_plugins + enabled: [<your-skill>@local]
    fidelity: container
@@ -142,6 +143,20 @@ degrade the advice. It is real work to calibrate; these steps are the traps that
            - <one discrete, checkable claim a correct answer MUST make>
            - <another>
    ```
+2a. **NEVER write a claim about whether a TOOL was called — the judge cannot see tool calls.** The
+   "transcript" the judge receives is **top-level assistant prose only**. It excludes every `tool_use`
+   and `tool_result`, and it excludes **all sub-agent text** (including `Skill` and `Agent(fork)`
+   dispatches, whose *tool* calls the harness does attribute to the main agent — the text path does not).
+   Sub-agent text is captured in `RunResult.subagents[].reasoning` but is **not** sent to the judge
+   unless you opt in with `include_subagent_text: true`.
+
+   So a rubric claim like *"the agent used a tool to surface the file, or said none was available"* has a
+   first branch that **can never grade true**, no matter how the skill behaves — the evidence simply
+   isn't in the document. Such a claim looks reasonable, survives drafting, and silently caps your pass
+   rate. Assert tool use with the structural keys instead (`tool_called`, `present_files_called`,
+   `subagent_dispatched`, `hook_blocked`), and reserve `semantic_matches` for what the agent *said* or
+   *wrote*. For a fan-out skill whose real work happens in sub-agents, add `include_subagent_text: true`.
+
 2. **Write DISCRIMINATING claims, and verify each against ground truth — not memory.** A claim that
    contradicts how the tool actually behaves can *never* pass (the correct skill will contradict it), and
    it silently poisons the gate. Check each claim against the code/docs. Decompose into single,

package/.claude/skills/cowork-harness/scripts/assertion-keys.json

@@ -2,8 +2,10 @@
   "$comment": "GENERATED from the Zod schemas (src/types.ts) by scripts/gen-schema.ts — do not edit; run `npm run schema`.",
   "keys": [
     "all_tasks_completed",
+    "allow_delete_in",
     "allow_l0_plugin_divergence",
     "allow_missing_capability",
+    "allow_outputs_delete",
     "allow_permissive_auto_allow",
     "allow_stall",
     "allow_undelivered_deliverables",
@@ -26,6 +28,7 @@
     "max_tokens",
     "max_tool_errors",
     "max_turns",
+    "no_delete_in_mounts",
     "no_delete_in_outputs",
     "no_hook_blocked",
     "no_lost_write_back",
@@ -91,10 +94,26 @@
     "timeout_ms"
   ],
   "verdictModifierKeys": [
+    "allow_delete_in",
     "allow_l0_plugin_divergence",
     "allow_missing_capability",
+    "allow_outputs_delete",
     "allow_permissive_auto_allow",
     "allow_stall",
     "allow_undelivered_deliverables"
+  ],
+  "servedHookEvents": [
+    "PreToolUse"
+  ],
+  "knownHookEvents": [
+    "Notification",
+    "PostToolUse",
+    "PreCompact",
+    "PreToolUse",
+    "SessionEnd",
+    "SessionStart",
+    "Stop",
+    "SubagentStop",
+    "UserPromptSubmit"
   ]
 }