cowork-harness 1.18.0 → 1.20.0

package/.claude/skills/cowork-harness/SKILL.md

@@ -3,8 +3,8 @@ name: cowork-harness
 description: Test or debug a Claude Code skill/plugin under Claude Cowork's runtime — sandboxed agent, default-deny egress, the can_use_tool permission/question protocol — using the cowork-harness CLI. Use when validating or regression-testing a skill, authoring or debugging a scenario YAML (prompt + scripted answers + assert:), choosing a fidelity tier, scripting AskUserQuestion / tool-permission answers, or asserting artifacts, egress, or sub-agent dispatch. Especially when a harness run no-ops an assertion, fails on an unanswered gate, false-greens, a steered answer never reaches the model, or a web_fetch is unexpectedly denied or gated. Also when iterating or hardening a skill across fixes, or grounding a skill's self-critique against its own run evidence — including a document-analysis skill (cap table, deck, financial model, transcript) that needs an uploaded file attached to be critiqued at all. NOT for generic unit testing (pytest/vitest of your own scripts) or non-Cowork CI. Covers the skill / run / chat / record / replay / trace / decide / assertions / scaffold commands and the session-vs-scenario split.
 metadata:
   author: cowork-harness
-  version: 1.18.0
-  tracks-harness: cowork-harness 1.18.0 (baseline desktop-1.25927.0)
+  version: 1.20.0
+  tracks-harness: cowork-harness 1.20.0 (baseline desktop-1.26832.0)
 ---
 
 # cowork-harness
@@ -22,8 +22,8 @@ flagged with a loud `::warning::`, not silent — auto-answer a gate, observe an
 allowlist). This skill exists mostly to keep you out of those traps — the Gotchas section below is
 the highest-value part. Read it.
 
-> **Version note:** the facts and `file:line` pointers here track `cowork-harness 1.18.0` (baseline
-> `desktop-1.25927.0`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
+> **Version note:** the facts and `file:line` pointers here track `cowork-harness 1.20.0` (baseline
+> `desktop-1.26832.0`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
 > `SPEC.md` / `docs/*.md` over this snapshot, and re-run the bundled linter.
 
 ## Preflight — make sure the harness can actually run
@@ -39,7 +39,7 @@ Before the first command, confirm the CLI is reachable and **fail loud** (never
 
 - **One-shot check.** Run `cowork-harness doctor [--tier <tier>]` first — a read-only prerequisite check that inspects Docker, the staged agent, the token, and the baseline in one pass. The bullets below explain each thing it checks (and how to fix it).
 - **Replay-only? Skip `doctor`.** Replaying committed cassettes needs no Docker, no staged agent, and no token — and every tier's `doctor` validates the auth token (the live tiers also Docker + the staged agent), so a ✗ there is expected, not a blocker. Go straight to `cowork-harness replay <cassette>`.
-- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 1.18.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@>=1.18.0" <cmd>` (Node ≥ 22), or install once with `npm i -g "cowork-harness@>=1.18.0"`. **Pin `@>=1.18.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
+- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 1.20.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@>=1.20.0" <cmd>` (Node ≥ 22), or install once with `npm i -g "cowork-harness@>=1.20.0"`. **Pin `@>=1.20.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
 
   This skill documents the CURRENT surface, not release history. If `cowork-harness --version` is
   OLDER than the floor, the per-release record of what you are missing is [CHANGELOG.md](https://github.com/yaniv-golan/cowork-harness/blob/main/CHANGELOG.md)
@@ -324,7 +324,10 @@ reworded gate or a `choose:` the run never offered fails here in ~1s instead of
 the discovery/encode/record dance entirely and answer gates **live during the recording** with
 `record --decider-dir`/`--decider-llm` (the cassette is flagged non-deterministic but replays deterministically).
 `run` takes no `--dry-run`: to check that a scenario **loads** without spending, use
-`cowork-harness record <file.yaml> --dry-run`; `lint` checks the assertion invariants (both above).
+`cowork-harness record <file.yaml> --dry-run` — it runs the real loader AND the same scenario-level
+refusals the real `record` applies (`on_unanswered: prompt`, and an unsatisfiable assert pairing), so it
+cannot green something a paid run would reject. On a directory it reports every offender and the batch
+cost estimate. `lint` checks the assertion invariants (both above).
 
 **Author answers WITHOUT re-paying — the cheap loop.** You don't need a fresh paid record to discover a
 scenario's gates or their labels: `--keep` ONE run, then `cowork-harness trace <run-dir> --view questions`
@@ -547,7 +550,7 @@ Docker, no re-record.
 | Situation | Symptom | Reach for (in order) |
 |---|---|---|
 | **The skill misbehaved** | wrong output, an unexpected gate, a denied tool, an opaque crash | `inspect` — what did it produce? · `trace <run-dir> --view <view>` — what did it actually do (tools, gates, sub-agent tree)? · `verify-run` — re-assert cheaply when only an assertion is wrong · `diff <old-run> <new-run>` — what changed since it worked · `chat` — reproduce it by hand |
-| **A green you don't trust** | an assert that may have tested nothing, a stale cassette, an auto-answered or decided gate | `replay --explain` — the evidence trail behind each *passing* assert · `replay --mutate` — perturbs each recorded JSON artifact value and reports which perturbations NOTHING caught (reporting only; never moves the verdict/exit code) · `lint` — assertions on the wrong CI lane / mixed-class keys · `verify-cassettes` — privacy + staleness over committed cassettes · the Gotchas landmine catalog — how a check passes vacuously · `run --repeat N` / `skill --repeat N` — did it pass, or pass once? · `stats` — flaky or expensive over time |
+| **A green you don't trust** | an assert that may have tested nothing, a stale cassette, an auto-answered or decided gate | `replay --explain` — the evidence trail behind each *passing* assert · `replay --mutate` — perturbs a CAPPED SAMPLE of recorded JSON values (10/file, 50 total) and reports which perturbations NOTHING caught; the report names the sample size, so read it as a sample not a total (reporting only; never moves the verdict/exit code) · `lint` — assertions on the wrong CI lane / mixed-class keys · `verify-cassettes` — privacy + staleness over committed cassettes · the Gotchas landmine catalog — how a check passes vacuously · `run --repeat N` / `skill --repeat N` — did it pass, or pass once? · `stats` — flaky or expensive over time |
 
 A failed run also records `errorSource` (where the failure originated) and `stderrLogPath` (the captured
 agent stderr) — read those before re-running; a re-record rarely tells you more than the captured stderr
@@ -836,10 +839,13 @@ repeats the assertion/replay-relevant ones alongside the schema (a scoped subset
     sub-question count and a matching footer total — read that off instead of the tool-call count when
     sizing the budget.
 
-19. **`gate_answers_delivered` passes vacuously when no gate fires — use `gate_answer_count_min: 1` to
-    also require a gate.** Whether a gate fires is model-dependent, so `gate_answers_delivered: true`
-    alone can't catch "the gate never fired at all"; pair it with `gate_answer_count_min` when
-    presence matters, not just delivery.
+19. **`gate_answers_delivered` passes vacuously when no gate fires — pair it, or drop it.** Whether a
+    gate fires is model-dependent, so `gate_answers_delivered: true` alone can't catch "the gate never
+    fired at all". If the scenario is meant to gate, pair it with `gate_answer_count_min: 1` (a floor of
+    `0` witnesses nothing). If the scenario is gate-clean by design, drop the key — it asserts nothing
+    there — and declare `questions_count_max: 0`, which fails loudly if a gate ever appears. Asserting
+    `questions_count_max: 0` alongside a gate-presence key is unsatisfiable: `run`/`skill`/`record`
+    refuse it before spending.
 
 20. **A `mode: r` connected folder's contents are recorded body-less, not excluded.** `record` captures a
     read-only folder's files as path + hash only (`truncated: true`, no `body`) — it's an input the agent

package/.claude/skills/cowork-harness/references/ci-recipe.md

@@ -1,6 +1,6 @@
 # CI recipe — replay vs live lanes
 
-Self-contained reference. Tracks `cowork-harness 1.18.0` (baseline `desktop-1.25927.0`).
+Self-contained reference. Tracks `cowork-harness 1.20.0` (baseline `desktop-1.26832.0`).
 
 **Fastest path: the packaged Action.** One step gets you `replay`/`lint`/`verify-cassettes` plus a PR
 job-summary reporter (verdict table, staleness findings, cost/turns when available):
@@ -13,7 +13,7 @@ job-summary reporter (verdict table, staleness findings, cost/turns when availab
 ```
 
 The Action's `version` input defaults to `latest` — intentional so a copy-pasted recipe tracks the current
-release; pin an exact version (e.g. `version: "1.18.0"`) for reproducible CI.
+release; pin an exact version (e.g. `version: "1.20.0"`) for reproducible CI.
 
 Reach for the manual multi-step form below only when you need per-step control the Action's inputs don't
 cover (a custom flag combination, a different runner matrix per step, or `lint`/`verify-cassettes` gated
@@ -32,7 +32,7 @@ jobs:
       - uses: actions/checkout@v4
       - name: Stage the agent binary (official channel, sha256-verified — see https://github.com/yaniv-golan/cowork-harness/blob/main/docs/maintenance.md)
         run: |
-          V=2.1.221   # match your scenario's pinned baseline's agentVersion
+          V=2.1.222   # match your scenario's pinned baseline's agentVersion
           curl -fSL "https://downloads.claude.ai/claude-code-releases/$V/linux-arm64/claude" -o "$RUNNER_TEMP/claude-$V"
           chmod +x "$RUNNER_TEMP/claude-$V"
           # verify against the committed baseline's sha256 (baselines/desktop-*.json → agentBinary.sha256)
@@ -58,7 +58,7 @@ sha256-*checked* but not hard-blocking on mismatch — it's advisory for an inte
 GitHub-hosted runners, no token/Docker/agent:
 
 ```yaml
-- run: npm i -g "cowork-harness@>=1.18.0"
+- run: npm i -g "cowork-harness@>=1.20.0"
 - run: cowork-harness lint scenarios/*.yaml --strict --min-severity WARN
                                                     # no silent false-greens. WITHOUT --strict this
                                                     # step cannot fail on a WARN-class rule (e.g.
@@ -279,7 +279,7 @@ jobs:
         with: { node-version: '24' }
       - uses: actions/setup-python@v5
         with: { python-version: '3.x' }                                       # python3 only — PyYAML is bundled with the linter
-      - run: npm i -g "cowork-harness@>=1.18.0"
+      - run: npm i -g "cowork-harness@>=1.20.0"
       - run: cowork-harness lint scenarios/*.yaml                              # no-silent-false-green (needs python3; PyYAML bundled)
       - run: cowork-harness verify-cassettes cassettes/ --output-format json   # privacy + staleness gate
       - run: cowork-harness replay cassettes/ --output-format json             # token-free content/structure
@@ -308,7 +308,7 @@ jobs:
             echo "live=true" >> "$GITHUB_OUTPUT"
           fi
       - if: steps.guard.outputs.live == 'true'
-        run: npm i -g "cowork-harness@>=1.18.0"
+        run: npm i -g "cowork-harness@>=1.20.0"
       - if: steps.guard.outputs.live == 'true'
         run: cowork-harness run scenarios/ --output-format json
         env:

package/.claude/skills/cowork-harness/references/critique.md

@@ -1,6 +1,6 @@
 # Critique — the facts a plugin install can't otherwise reach
 
-Tracks `cowork-harness 1.18.0` (baseline `desktop-1.25927.0`). This is **not** a trim of the full
+Tracks `cowork-harness 1.20.0` (baseline `desktop-1.26832.0`). This is **not** a trim of the full
 [`docs/critique.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/critique.md) (repo-only —
 flags, cost, reproduction discipline, known limitations all live there). This file covers exactly what a
 plugin install cannot otherwise discover: the run-dir artifact a harvester actually reads, the report's

package/.claude/skills/cowork-harness/references/fidelity-and-answers.md

@@ -1,6 +1,6 @@
 # Fidelity tiers & answer paths
 
-Self-contained reference. Tracks `cowork-harness 1.18.0` (baseline `desktop-1.25927.0`).
+Self-contained reference. Tracks `cowork-harness 1.20.0` (baseline `desktop-1.26832.0`).
 
 ## Fidelity tiers (`fidelity:` in the scenario)
 

package/.claude/skills/cowork-harness/references/scenario-schema.md

@@ -1,7 +1,7 @@
 # Scenario & session schema, assertion catalog, web_fetch, full gotchas
 
-Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 1.18.0`
-(baseline `desktop-1.25927.0`). If your checkout is newer, prefer the live [`docs/scenario.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/scenario.md),
+Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 1.20.0`
+(baseline `desktop-1.26832.0`). If your checkout is newer, prefer the live [`docs/scenario.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/scenario.md),
 [`docs/session.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/session.md), and `SPEC.md`.
 
 **Minimal scenario** — `prompt` is the only required field:
@@ -329,9 +329,9 @@ same set live from the schema.
 | `present_files_called: true` | at least one file was actually delivered via the `present_files` tool (`RunResult.presentedFiles` is non-empty) — the presence companion to `no_scratchpad_leak` (which passes vacuously when nothing was presented). Pair them to require a delivery **and** require it not to leak. Content-class (re-derives identically on replay). **`fidelity: container` or `hostloop`** — the harness serves `present_files` at both (hostloop via a handler mirroring production's own host-loop branch: validate the path, pass it through, no promotion). `protocol` and `microvm` report cannot-verify. See the `no_scratchpad_leak` row, which stays container-only for a different reason; and see the lane note there — the tool name differs on remote Cowork. **Only `true` is valid** |
 | `question_asked: <regex>` | the agent asked an AskUserQuestion whose text matches |
 | `questions_count_max: <N>` | at most N **sub-questions** asked — a bundled `AskUserQuestion` with K sub-questions counts as K, not 1; `trace --view questions`'s footer total uses the same definition |
-| `gate_answers_delivered: true` | every answered gate's answer reached the model (observed `tool_result`; unobserved = fail); **zero gates fired passes vacuously** — pair with `gate_answer_count_min` to also require a gate |
-| `gate_answers_delivered: false` | asserts at least one answered gate's answer was **confirmed not delivered** (an observed delivery failure); an unobserved/null delivery does **not** satisfy this — for negative-path delivery tests |
-| `gate_answer_count_min: <N>` | at least N AskUserQuestion gates fired AND were delivered non-error — presence companion to `gate_answers_delivered`'s vacuous-pass |
+| `gate_answers_delivered: true` | every answered gate's answer reached the model (observed `tool_result`; unobserved = fail); **zero gates fired passes vacuously** — pair with `gate_answer_count_min: >= 1` to also require a gate, or drop this key and declare `questions_count_max: 0` in a scenario that expects none |
+| `gate_answers_delivered: false` | asserts at least one answered gate's answer was **confirmed not delivered** (an observed delivery failure); an unobserved/null delivery does **not** satisfy this — for negative-path delivery tests. Requires a gate, so **mutually exclusive** with `questions_count_max: 0` (refused by `run`/`skill`/`record`) |
+| `gate_answer_count_min: <N>` | at least N AskUserQuestion gates fired AND were delivered non-error — presence companion to `gate_answers_delivered`'s vacuous-pass. **`: 0` asserts nothing** and does not satisfy that pairing; `>= 1` is **mutually exclusive** with `questions_count_max: 0` (refused by `run`/`skill`/`record`) |
 | `hook_blocked: <regex>` | a PreToolUse hook blocked a tool whose name matches the regex (`RunResult.hookEvents`) — evidence-unavailable if hook telemetry is absent. Replay: needs a `controlOut` cassette (a custom hook's decision lives only there, not the recorded stream) |
 | `no_hook_blocked: true` | no tool was hook-blocked during the run (distinguishes a real tool crash from an intentional hook block) — evidence-unavailable if hook telemetry is absent. Replay: needs a `controlOut` cassette. **Only `true` is valid** |
 | `vm_path_denied: true` | **`fidelity: hostloop` only** — at least one recorded path denial (`RunResult.pathDenials`, any source) targeted a `/sessions` VM path — evidence-unavailable if path-denial telemetry is absent. Replay: needs a `controlOut` cassette. Any other tier FAILS "cannot verify". **Only `true` is valid** |

package/.claude/skills/cowork-harness/references/task-recipes.md

@@ -2,7 +2,7 @@
 
 Each recipe composes facts that live scattered across SKILL.md and the other references into one
 decision path. Every one answers a question a real fleet owner had to work out the hard way.
-Tracks `cowork-harness 1.18.0` (baseline `desktop-1.25927.0`), same as SKILL.md's front-matter. Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
+Tracks `cowork-harness 1.20.0` (baseline `desktop-1.26832.0`), same as SKILL.md's front-matter. Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
 Recipe 3's `init-redact` shipped in 0.24.0 and are part of the current feature set — no version gate
 needed if your CLI meets SKILL.md's version floor.
 
@@ -115,7 +115,13 @@ have:
    indexed runs — better than a single observation.
 3. **Set the budget with headroom:** observed × 1.5, rounded up (agentic run lengths vary run to
    run; a budget at the observed value flakes).
-4. **Replay-class note:** `max_turns` / `tool_calls_max` / `dispatch_count_max` re-evaluate
+4. **`questions_count_max: 0` is a declaration, not a budget.** If the observed value is zero, you are
+   writing "this scenario expects no gates" — which is supported and useful, but it is then **mutually
+   exclusive** with `gate_answer_count_min: >= 1`, `question_asked` and `gate_answers_delivered: false`
+   (a delivered gate records at least one question). `run` / `skill` / `record` refuse that pairing
+   before spending, and `lint` reports `assert-contradiction`. Drop `gate_answers_delivered`
+   alongside it too — it asserts nothing when no gate fires.
+5. **Replay-class note:** `max_turns` / `tool_calls_max` / `dispatch_count_max` re-evaluate
    token-free on replay; `questions_count_max` needs `controlOut` (Recipe 1's tree applies).
    `max_cost_usd` / `max_tokens` on replay assert the FROZEN recording's spend — near-zero signal
    as a regression gate; if you need a cost gate, put it on the live lane via `stats` (history) or

package/.claude/skills/cowork-harness/scripts/scenario.py

@@ -26,6 +26,10 @@ lint flags (see references/scenario-schema.md for the why of each):
   E  on_unanswered: agent / invalid value            (schema rejects `agent`)
   E  authored `replay_protocol_fidelity` assertion   (replay-synthesized only)
   E  `assertions:` instead of `assert:`              (block ignored → every check no-ops)
+  E  a presence assert + its absence sibling            (unsatisfiable; run/skill/record refuse it:
+                                                       questions_count_max:0 vs gate presence,
+                                                       no_hook_blocked vs hook_blocked,
+                                                       no_path_denied vs path_denied/vm_path_denied)
   W  `transcript_no_host_path` on `fidelity: cowork` (tier resolves per baseline gate —
                                                       incompatible if it lands hostloop)
   W  `no_scratchpad_leak` on `fidelity: cowork`    (tier resolves per baseline gate)
@@ -338,6 +342,63 @@ def _all_assert_keys(items):
     return keys
 
 
+def _assert_values(items, key):
+    """Every value authored for `key` across the assert items (a key may repeat across entries).
+
+    `_all_assert_keys` sees only NAMES, which is how this linter shipped two value-blind gate checks:
+    one firing on an assertion whose premise it inverted, one exempting a floor of zero."""
+    return [item[key] for item in items if isinstance(item, dict) and key in item]
+
+
+def _numeric(v):
+    """The number the HARNESS would see for a YAML scalar, or None if it isn't one.
+
+    NOT `isinstance(v, int)`. This linter parses with PyYAML (YAML 1.1); the harness loads scenarios
+    with the npm `yaml` package (YAML 1.2 core). `1.0` reaches Python as a float and `1e0` as a STRING,
+    yet npm yaml resolves both to the integer 1 and `z.number().int()` accepts them -- so both are
+    loadable scenarios that an int-only test would mis-read.
+
+    The dialect cuts the other way too, benignly: PyYAML resolves `1_000` -> 1000 and `1:30` -> 90
+    (sexagesimal), which npm yaml leaves as strings that `z.number()` REJECTS at load. Those read as a
+    number here and are refused by the loader -- silent lint, loud load. Same shape as `no`/`off`
+    resolving to False in 1.1 but staying strings in 1.2."""
+    if isinstance(v, bool):
+        return None  # `True >= 1` is true in Python; a schema-invalid `: true` is not a floor
+    if isinstance(v, (int, float)):
+        return float(v)
+    if isinstance(v, str):
+        try:
+            return float(v)
+        except ValueError:
+            return None
+    return None
+
+
+def _tool_glob_matches(pattern, name):
+    """Port of `globToRegExp` (src/glob.ts) for a tool name.
+
+    `tool_called` is a GLOB, not a regex (src/types.ts `toolGlob`, src/assert.ts `toolMatches`):
+    anchored, CASE-SENSITIVE, only `*` and `?` special, every other character literal. A value carrying
+    a regex metacharacter is rejected at scenario load, so reading this field with `re.search` was wrong
+    on three axes at once -- it flagged valid globs, and exempted a wrong-case glob that can never match.
+
+    Segment-aware on purpose: a whole-segment `**` matches ZERO segments, so `**/AskUserQuestion`
+    matches a bare `AskUserQuestion`. That is a property of the pattern's segments, not the subject's,
+    which is why "a tool name contains no `/`" does not make a flat per-character loop equivalent."""
+    segments = pattern.replace("\\", "/").split("/")
+    rx = "^"
+    for i, seg in enumerate(segments):
+        last = i == len(segments) - 1
+        if seg == "**":
+            rx += "(?:[^/]+(?:/[^/]+)*)?" if last else "(?:[^/]+/)*"
+            continue
+        for ch in seg:
+            rx += "[^/]*" if ch == "*" else "[^/]" if ch == "?" else re.escape(ch)
+        if not last:
+            rx += "/"
+    return re.match(rx + "$", name) is not None
+
+
 def _is_positional_choose(choose):
     """True if a `choose` value selects by POSITION — `first` or a 1-based index (scalar or in a
     multiSelect list) — as opposed to an exact label. Positional answers are order-dependent (H1)."""
@@ -600,40 +661,150 @@ def lint_doc(doc, path, raw_lines):
     # 0 gates sit green for weeks against a scenario asserting exactly this key.
     #
     # A companion is anything that FAILS (rather than vacuously passes) on an empty gate set:
-    #   · gate_answer_count_min — the explicit floor
-    #   · question_asked        — fails "no question matched" against an empty question list
-    #   · tool_called matching AskUserQuestion — fails "tool not called"
+    #   · gate_answer_count_min WITH A FLOOR >= 1 — the explicit floor. The value matters: `: 0` is legal
+    #     (the schema is nonnegative) and `delivered >= 0` always holds, so a zero floor witnesses nothing
+    #     and must not silence this rule. Reading the key NAME alone made the "looks paired" scenario a
+    #     silent false-green — worse than the loud one this rule was written for.
+    #   · question_asked — fails "no question matched" against an empty question list, for ANY pattern
+    #     (`.some` over an empty list is false, so no value gate is needed here).
+    #   · tool_called whose GLOB matches AskUserQuestion — fails "tool not called".
     # `questions_count_max` is deliberately NOT a companion: a MAX passes vacuously at zero, so pairing it
     # leaves the hole wide open. The harness's own `scaffold` emits `question_asked` alongside this key,
     # which is why the exemption must include it — otherwise this rule reds the tool's own output.
-    if "gate_answers_delivered" in assert_keys:
-        has_companion = bool(assert_keys & {"gate_answer_count_min", "question_asked"})
+    #
+    # VALUE, not just key. `gate_answers_delivered: false` is the INVERSE assertion — it demands at least
+    # one gate whose answer was confirmed NOT delivered, so zero gates FAILS it. It is not the vacuous
+    # direction, and `gate_answer_count_min` (which counts delivered === true) is not its companion.
+    # Firing there reds a correct negative-path scenario under CI's `--strict --min-severity WARN`, with a
+    # message whose premise is inverted. Skip on `is False` specifically, so a schema-invalid non-bool
+    # still warns rather than opening a new hole. (`no`/`off` also reach here as False under PyYAML's
+    # YAML 1.1 but are rejected by the loader as strings — see _numeric for the same dialect gap.)
+    delivered_values = _assert_values(items, "gate_answers_delivered")
+    if any(v is not False for v in delivered_values):
+        has_companion = "question_asked" in assert_keys or any(
+            (n := _numeric(v)) is not None and n >= 1 for v in _assert_values(items, "gate_answer_count_min")
+        )
         if not has_companion:
             for item in items:
                 tc = item.get("tool_called")
-                if not isinstance(tc, str):
-                    continue
-                # `tool_called` is a user regex over observed tool names; ask whether THEIR pattern would
-                # match the gate tool rather than string-comparing. A bad regex is somebody else's finding.
-                try:
-                    if re.search(tc, "AskUserQuestion", re.IGNORECASE):
-                        has_companion = True
-                        break
-                except re.error:
-                    continue
+                # A GLOB, not a regex (src/types.ts toolGlob) — ask whether THEIR pattern would match the
+                # gate tool under the harness's own matching rules. A non-str value is somebody else's
+                # finding; a glob cannot fail to compile, so there is nothing to guard against here.
+                if isinstance(tc, str) and _tool_glob_matches(tc, "AskUserQuestion"):
+                    has_companion = True
+                    break
         if not has_companion:
-            findings.append(
-                Finding(
-                    "WARN",
-                    "vacuous-gate-assert",
-                    "`gate_answers_delivered` has no presence companion — zero gates fired passes it "
-                    "VACUOUSLY, so this assertion stays green if the skill stops asking altogether "
-                    "(exactly the regression it looks like it is guarding).",
-                    'Pair it with `gate_answer_count_min: 1` (or a `question_asked: "<rx>"`, or '
-                    '`tool_called: "AskUserQuestion"`) so a gate must actually fire.',
-                    path,
+            # The scenario may already have DECLARED that it expects no gates. Then "add a companion" is
+            # wrong advice — the key is inert, and the fix is to drop it. Same rule id, different message;
+            # it must not go silent, because `questions_count_max: 0` is still not a presence companion.
+            declares_zero_gates = any(_numeric(v) == 0 for v in _assert_values(items, "questions_count_max"))
+            if declares_zero_gates:
+                findings.append(
+                    Finding(
+                        "WARN",
+                        "vacuous-gate-assert",
+                        "`gate_answers_delivered` is inert here — this scenario already declares it expects "
+                        "no gates (`questions_count_max: 0`), and zero gates fired passes "
+                        "`gate_answers_delivered` VACUOUSLY, so the key asserts nothing.",
+                        "Drop `gate_answers_delivered` — `questions_count_max: 0` already states the intent "
+                        "and fails loudly if a gate ever appears. If the scenario is meant to gate after all, "
+                        "drop `questions_count_max: 0` and pair the delivery check with "
+                        "`gate_answer_count_min: 1`.",
+                        path,
+                    )
                 )
+            else:
+                findings.append(
+                    Finding(
+                        "WARN",
+                        "vacuous-gate-assert",
+                        "`gate_answers_delivered` has no presence companion — zero gates fired passes it "
+                        "VACUOUSLY, so this assertion stays green if the skill stops asking altogether "
+                        "(exactly the regression it looks like it is guarding).",
+                        "If the scenario is meant to gate, pair it with `gate_answer_count_min: 1` (a floor "
+                        'of 0 witnesses nothing) — or a `question_asked: "<rx>"`, or `tool_called: '
+                        '"AskUserQuestion"` — so a gate must actually fire. If the scenario is gate-clean by '
+                        "design, DROP `gate_answers_delivered` (it asserts nothing there) and declare the "
+                        "intent with `questions_count_max: 0` (or `tool_not_called: \"AskUserQuestion\"`), "
+                        "which fails loudly if a gate ever appears.",
+                        path,
+                    )
+                )
+
+    # E: a statically unsatisfiable assert pairing — the scenario can never pass, on any lane.
+    #
+    # Each group pairs ONE assertion demanding a record NOT exist with the assertions demanding the SAME
+    # record does exist, on a single evidence channel:
+    #   · questions_count_max: 0 vs gate presence — a delivered gate records at least one question (the
+    #     harness pushes one entry per sub-question BEFORE answering, and a zero-question gate throws).
+    #   · no_hook_blocked vs hook_blocked — one hook-event list.
+    #   · no_path_denied vs path_denied / vm_path_denied — one path-denial list.
+    # Verified against the assertion implementations, not the schema prose: a scope split would make a
+    # pair satisfiable, and there is none. Where the evidence is missing BOTH halves fail
+    # evidence-unavailable rather than passing, and the denial keys are hostloop-only so a wrong tier
+    # fails both too — no combination yields a both-pass.
+    #
+    # Deliberately NOT extended to `tool_not_called` as a gate witness: it reads the tool log while the
+    # gate keys read the control channel, and a fixture-driven `protocol` run can gate on the control
+    # channel alone, so that cross-channel contradiction is not provable from the YAML.
+    #
+    # ERROR because `run`/`skill`/`record` refuse the scenario outright (assertContradiction in
+    # src/run/execute.ts) — the same reason `on_unanswered: agent` is an ERROR. Note the pairing is
+    # unsatisfiable, not always-red: on a lane where the evidence is absent it is not evaluated at all
+    # (verify-run fails evidence-unavailable; a controlOut-less cassette SKIPS these keys on replay).
+    # Either way it guards nothing.
+    contradiction_groups = [
+        (
+            "`questions_count_max: 0`",
+            any(_numeric(v) == 0 for v in _assert_values(items, "questions_count_max")),
+            [
+                (
+                    "gate_answer_count_min: >= 1",
+                    any((n := _numeric(v)) is not None and n >= 1 for v in _assert_values(items, "gate_answer_count_min")),
+                ),
+                ("question_asked", "question_asked" in assert_keys),
+                ("gate_answers_delivered: false", any(v is False for v in _assert_values(items, "gate_answers_delivered"))),
+            ],
+            "a delivered gate records at least one question, so requiring a gate to be present contradicts requiring zero questions",
+        ),
+        (
+            "`no_hook_blocked: true`",
+            any(v is True for v in _assert_values(items, "no_hook_blocked")),
+            [("hook_blocked", "hook_blocked" in assert_keys)],
+            "both read the same hook-event list — the block `hook_blocked` requires is the one `no_hook_blocked` requires not to exist",
+        ),
+        (
+            "`no_path_denied: true`",
+            any(v is True for v in _assert_values(items, "no_path_denied")),
+            [
+                ("path_denied", "path_denied" in assert_keys),
+                ("vm_path_denied: true", any(v is True for v in _assert_values(items, "vm_path_denied"))),
+            ],
+            "both read the same path-denial list — the denial the positive key requires is one `no_path_denied` requires not to exist",
+        ),
+    ]
+    clauses = []
+    for absence_label, absent, presences, why in contradiction_groups:
+        if not absent:
+            continue
+        hits = [label for label, present in presences if present]
+        # Report EVERY contradictory group, not just the first — a scenario can carry more than one.
+        if hits:
+            clauses.append(f"{absence_label} alongside {' and '.join(hits)} ({why})")
+    if clauses:
+        findings.append(
+            Finding(
+                "ERROR",
+                "assert-contradiction",
+                # "both" is wrong once more than one group is named -- and a scenario carrying two is
+                # exactly the one whose message gets read carefully.
+                f"{'; and '.join(clauses)} — "
+                + ("no run can satisfy both." if len(clauses) == 1 else "no run can satisfy all of them."),
+                "Keep the negative assertion and drop the positive one, or drop the negative if the "
+                "scenario really does expect the record.",
+                path,
             )
+        )
 
     # W: mixed-class assert item → the live-only half is dropped on replay (manifest-backed keys are NOT)
     for idx, item in enumerate(items):
@@ -1615,8 +1786,13 @@ def build_scenario(args):
         # sub-questions each gate bundles. Any number emitted here would be a guess: too low false-reds
         # on the first run, too high is a dead tripwire. A budget must come from observation, not
         # fabrication — so emit it COMMENTED OUT with the calibration path, not a made-up value.
+        # `<N> >= 1` is not decoration: this block also emits gate-PRESENCE assertions, and
+        # `questions_count_max: 0` alongside one of those is unsatisfiable — refused by run/skill/record
+        # and flagged as `assert-contradiction`. Zero is the natural value to reach for on a
+        # gate-clean scenario, so the hint has to say where it does NOT belong.
         content_lines.append(
-            "  # - questions_count_max: <N>   # BUDGET — calibrate from a real run: `trace --view "
+            "  # - questions_count_max: <N>   # BUDGET (N >= 1 — `0` contradicts the gate assertions "
+            "below; use it only in a scenario with none) — calibrate from a real run: `trace --view "
             "questions` prints the SUB-question total (what this asserts); set N to that + headroom."
         )
         content_lines.append("  - gate_answers_delivered: true   # the steered answers actually reached the model")