cowork-harness 1.25.0 → 2.0.1

package/.claude/skills/cowork-harness/SKILL.md

@@ -3,8 +3,8 @@ name: cowork-harness
 description: Test or debug a Claude Code skill/plugin under Claude Cowork's runtime — sandboxed agent, default-deny egress, the can_use_tool permission/question protocol — using the cowork-harness CLI. Use when validating or regression-testing a skill, authoring or debugging a scenario YAML (prompt + scripted answers + assert:), choosing a fidelity tier, scripting AskUserQuestion / tool-permission answers, or asserting artifacts, egress, or sub-agent dispatch. Especially when a harness run no-ops an assertion, fails on an unanswered gate, false-greens, a steered answer never reaches the model, or a web_fetch is unexpectedly denied or gated. Also when iterating or hardening a skill across fixes, or grounding a skill's self-critique against its own run evidence — including a document-analysis skill (cap table, deck, financial model, transcript) that needs an uploaded file attached to be critiqued at all. NOT for generic unit testing (pytest/vitest of your own scripts) or non-Cowork CI. Covers the skill / run / chat / record / replay / trace / decide / assertions / scaffold commands and the session-vs-scenario split.
 metadata:
   author: cowork-harness
-  version: 1.25.0
-  tracks-harness: cowork-harness 1.25.0 (baseline desktop-1.32885.1)
+  version: 2.0.1
+  tracks-harness: cowork-harness 2.0.1 (baseline desktop-1.34493.1)
 ---
 
 # cowork-harness
@@ -22,8 +22,8 @@ flagged with a loud `::warning::`, not silent — auto-answer a gate, observe an
 allowlist). This skill exists mostly to keep you out of those traps — the Gotchas section below is
 the highest-value part. Read it.
 
-> **Version note:** the facts and `file:line` pointers here track `cowork-harness 1.25.0` (baseline
-> `desktop-1.32885.1`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
+> **Version note:** the facts and `file:line` pointers here track `cowork-harness 2.0.1` (baseline
+> `desktop-1.34493.1`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
 > `SPEC.md` / `docs/*.md` over this snapshot, and re-run the bundled linter.
 
 ## Preflight — make sure the harness can actually run
@@ -39,7 +39,7 @@ Before the first command, confirm the CLI is reachable and **fail loud** (never
 
 - **One-shot check.** Run `cowork-harness doctor [--tier <tier>]` first — a read-only prerequisite check that inspects Docker, the staged agent, the token, and the baseline in one pass. The bullets below explain each thing it checks (and how to fix it).
 - **Replay-only? Skip `doctor`.** Replaying committed cassettes needs no Docker, no staged agent, and no token — and every tier's `doctor` validates the auth token (the live tiers also Docker + the staged agent), so a ✗ there is expected, not a blocker. Go straight to `cowork-harness replay <cassette>`.
-- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 1.25.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@>=1.25.0" <cmd>` (Node ≥ 22), or install once with `npm i -g "cowork-harness@>=1.25.0"`. **Pin `@>=1.25.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
+- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 2.0.1**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@^2.0.1" <cmd>` (Node ≥ 22), or install once with `npm i -g "cowork-harness@^2.0.1"`. **Pin `@^2.0.1`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
 
   This skill documents the CURRENT surface, not release history. If `cowork-harness --version` is
   OLDER than the floor, the per-release record of what you are missing is [CHANGELOG.md](https://github.com/yaniv-golan/cowork-harness/blob/main/CHANGELOG.md)
@@ -220,9 +220,14 @@ run's echoed `--answer "<q>=<choice>"` footer lines into the scenario's `answers
 being unattended. Skip the transcribe step only for one-off/exploratory runs.
 <!-- answer-channels:end -->
 
-**Never hand-write the `req-N.json`/`resp-N.json` files.** `gates` and `answer` wrap the protocol — the
-atomic temp+rename, the `{id, answers}` envelope, the multiSelect array shape. Hand-rolling a Monitor over
-the raw files is the single most common mistake on this channel.
+**For a QUESTION gate, never hand-write the `req-N.json`/`resp-N.json` files.** `gates` and `answer` wrap
+the protocol — the atomic temp+rename, the `{id, answers}` envelope, the multiSelect array shape.
+Hand-rolling a Monitor over the raw files is the single most common mistake on this channel.
+
+`answer` writes `{id, answers}` and nothing else, so it covers **question gates only**. The channel also
+carries **permission**, **dialog** and **elicit** gates, whose replies need `{behavior}` / `{action}` — for
+those, write `resp-N.json` yourself, following the `reply_with` template the gate's own `req-N.json`
+advertises (it spells out the exact shape, e.g. `{"id":"…","behavior":"allow|deny"}`).
 
 Exact accepted values (teach precisely): `--on-unanswered` takes `fail|prompt|first` on `skill`,
 only `fail|first` on `run`. **`llm` is NOT an `--on-unanswered` value** — the bare flag
@@ -407,7 +412,7 @@ That choice is permanent: the cassette rewrites `scenario.session` and `scenario
 its own directory** at record time, so moving the file later — a different `--out`, a `git mv`, a copy
 into another repo — leaves those unresolvable and
 `verify-cassettes` reports `unverifiable-skill` ("can't verify ⇒ not green", exit 3) until you
-re-record at the new location. **`record` now says so BEFORE it spends:** a pre-flight — at the same
+re-record at the new location — or point `replay`/`verify-cassettes` at the session with `--session <file>`, which resolves it without a re-record. Since 2.0.0 a bare `replay` FAILS on this class rather than warning. **`record` now says so BEFORE it spends:** a pre-flight — at the same
 pre-spend point as the host-inventory refusal, and in `record --dry-run`, so the rehearsal is free —
 warns when the cassette would be written outside the scenario's tree, or when `session:` itself lives
 outside it (an absolute or `~` path: the mirror case, invisible to a check that only looks at where the
@@ -416,7 +421,8 @@ missing was anything saying so while you could still act. Related: recording at
 (`protocol`/`hostloop`/`cowork`→hostloop) into a repo-visible path is refused outright (gotcha 25).
 The clean answer there is `fidelity: container` (sealed, `HOME=/tmp`, nothing to leak) — **not**
 redirecting `--out` outside the repo and moving the file in afterwards, which trades a loud refusal
-for a permanently unverifiable cassette.
+for a cassette that cannot verify staleness from its own location — recoverable only by passing
+`--session <file>` on every invocation thereafter.
 
 **Author answers WITHOUT re-paying — the cheap loop.** You don't need a fresh paid record to discover a
 scenario's gates or their labels: `--keep` ONE run, then `cowork-harness trace <run-dir> --view questions`
@@ -917,8 +923,11 @@ repeats the assertion/replay-relevant ones alongside the schema (a scoped subset
       `artifact_json` / `transcript_matches`), never just `result: success`.
     - `on_unanswered` governs **unanswered** `AskUserQuestion` gates; the `stalled` signal covers
       stalling *after* one is answered — two different failure modes.
-    - **Free-text aside:** a "type-it-in-notes" option has **no scripted deterministic answer** today
-      (the `OTHER:` directive works only on the LLM-decider path, not scripted `choose:`, and only on
+    - **Free-text aside:** the scripted key for a "type-it-in-notes" option is **`answer:`** — an
+      arbitrary string delivered verbatim, bypassing label validation by author intent (Cowork
+      auto-provides an "Other" free-text path on every gate). Mutually exclusive with `choose:`; setting
+      both fails loud. What has no scripted equivalent is the `OTHER:` *directive*
+      (it works only on the LLM-decider path, not scripted `choose:`, and only on
       **single-select** gates — a **multi-select** gate is index-only, so `OTHER:` fails loud there; on an
       options-bearing single-select gate a bare out-of-set LLM answer also fails loud (exit 2) — see the
       LLM-decider free-text note in `references/fidelity-and-answers.md`). An LLM decision answered via
@@ -1028,8 +1037,14 @@ repeats the assertion/replay-relevant ones alongside the schema (a scoped subset
 25. **Two distinct host-inventory consent flags — a record-time one and a verify-time one.** `record
     --allow-host-inventory-fixture` is the boolean consent to proceed recording a host-inheriting
     (`protocol`/`hostloop`/`cowork`-resolving-to-hostloop) cassette into a repo-visible path — otherwise
-    `record` refuses (freezing this machine's MCP servers/agents/account into a committed fixture is the
-    risk). `verify-cassettes --allow-host-inventory <regex>` is unrelated: a per-finding suppressor for the
+    `record` refuses before it spends (freezing this machine's MCP servers/agents/account into a committed
+    fixture is the risk). That pre-spend check **warns rather than refuses when the cassette already
+    exists** — refusing would fire on every `--rerecord-stale` pass — and it reads the tier and the
+    destination path, never the bytes. So `record` also scans the FINISHED recording, after redaction and
+    before the write: a `host-inventory`/`machine-inventory` finding on a repo-visible path is
+    **quarantined** to `<runs-root>/quarantine/` with a `.findings.txt` naming what leaked, and the command
+    fails without writing the path you asked for (the recording is not discarded — you paid for it).
+    `verify-cassettes --allow-host-inventory <regex>` is unrelated: a per-finding suppressor for the
     scanner's `host-inventory` class on an already-committed cassette. Passing one where the other command
     wants it fails as an unrecognized flag — they don't interchange. Depth: `references/ci-recipe.md`.
 

package/.claude/skills/cowork-harness/references/ci-recipe.md

@@ -1,6 +1,6 @@
 # CI recipe — replay vs live lanes
 
-Self-contained reference. Tracks `cowork-harness 1.25.0` (baseline `desktop-1.32885.1`).
+Self-contained reference. Tracks `cowork-harness 2.0.1` (baseline `desktop-1.34493.1`).
 
 **Fastest path: the packaged Action.** One step gets you `replay`/`lint`/`verify-cassettes` plus a PR
 job-summary reporter (verdict table, staleness findings, cost/turns when available):
@@ -13,7 +13,7 @@ job-summary reporter (verdict table, staleness findings, cost/turns when availab
 ```
 
 The Action's `version` input defaults to `latest` — intentional so a copy-pasted recipe tracks the current
-release; pin an exact version (e.g. `version: "1.25.0"`) for reproducible CI.
+release; pin an exact version (e.g. `version: "2.0.1"`) for reproducible CI.
 
 Reach for the manual multi-step form below only when you need per-step control the Action's inputs don't
 cover (a custom flag combination, a different runner matrix per step, or `lint`/`verify-cassettes` gated
@@ -30,15 +30,19 @@ jobs:
     runs-on: [self-hosted, linux, arm64]   # needs Docker + this staged ELF; not a stock GitHub-hosted runner
     steps:
       - uses: actions/checkout@v4
-      - name: Stage the agent binary (official channel, sha256-verified — see https://github.com/yaniv-golan/cowork-harness/blob/main/docs/maintenance.md)
+      - name: Stage the agent binary (official channel, sha256-verified against the pinned baseline)
         run: |
-          V=2.1.234   # match your scenario's pinned baseline's agentVersion
+          V=2.1.237   # match your scenario's pinned baseline's agentVersion
+          # The expected digest is baselines/desktop-<ver>.json -> agentBinary.sha256. Paste it here, or
+          # read it with jq if you vendor the baseline. An unverified download is an unverified agent:
+          # this step FAILS rather than staging one, which is the whole point of naming it "verified".
+          EXPECTED=<paste agentBinary.sha256 for $V>
           curl -fSL "https://downloads.claude.ai/claude-code-releases/$V/linux-arm64/claude" -o "$RUNNER_TEMP/claude-$V"
+          echo "$EXPECTED  $RUNNER_TEMP/claude-$V" | sha256sum -c -
           chmod +x "$RUNNER_TEMP/claude-$V"
-          # verify against the committed baseline's sha256 (baselines/desktop-*.json → agentBinary.sha256)
-          # before trusting it — see the "Agent-binary provenance" section of
-          # https://github.com/yaniv-golan/cowork-harness/blob/main/docs/maintenance.md
           echo "COWORK_AGENT_BINARY=$RUNNER_TEMP/claude-$V" >> "$GITHUB_ENV"
+          # Background on the provenance chain: the "Agent-binary provenance" section of
+          # https://github.com/yaniv-golan/cowork-harness/blob/main/docs/maintenance.md
       - uses: yaniv-golan/cowork-harness@main
         with:
           command: run
@@ -58,7 +62,7 @@ sha256-*checked* but not hard-blocking on mismatch — it's advisory for an inte
 GitHub-hosted runners, no token/Docker/agent:
 
 ```yaml
-- run: npm i -g "cowork-harness@>=1.25.0"
+- run: npm i -g "cowork-harness@^2.0.1"
 - run: cowork-harness lint scenarios/*.yaml --strict --min-severity WARN
                                                     # no silent false-greens. WITHOUT --strict this
                                                     # step cannot fail on a WARN-class rule (e.g.
@@ -77,7 +81,20 @@ GitHub-hosted runners, no token/Docker/agent:
 - run: cowork-harness replay cassettes/              # token-free content/structure
 ```
 
-Both lines matter: `replay` alone **warns** on a stale recording and exits 0, so dropping the
+If a cassette has MOVED (a `git mv`, a repo reorg, a copy between projects), staleness becomes
+unverifiable — `verify-cassettes` exits 3 and says the skill dirs are not resolvable. Recover with
+`--session <file>` on either command rather than re-recording:
+
+```yaml
+- run: cowork-harness verify-cassettes cassettes/moved.cassette.json --session sessions/default.yaml
+```
+
+It takes a session (not skill dirs) so `staleness.hash_ignore` survives, refuses a directory target,
+and echoes the dirs it resolved. Full contract:
+[docs/cassette.md](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/cassette.md).
+
+Both lines matter: for the CONTENT-drift classes (`skill`, `shared-root`) `replay` alone **warns** and
+exits 0, so dropping the
 `verify-cassettes` step means a skill edit silently stops being tested. (One command instead of two:
 `replay --fail-on-skill-drift`.)
 
@@ -210,9 +227,23 @@ dollar figures). In a skill repo these cassettes get **committed**. So:
 - **Host-inheriting record refused by default — `--allow-host-inventory-fixture` is the consent.** A
   `protocol`/`hostloop`/`cowork`-resolving-to-hostloop record into a repo-visible cassette path would
   freeze THIS machine's MCP server names, agents, and account metadata into a committed fixture, so
-  `record` refuses outright rather than warn. Pass `--allow-host-inventory-fixture` only when the
+  `record` refuses **before the paid spawn**. Pass `--allow-host-inventory-fixture` only when the
   recording session genuinely has no personal MCP servers or plugins to leak — it is a per-record
   boolean consent, not a pattern.
+
+  Two details that matter for a re-record loop. The pre-spend check **warns rather than refuses when the
+  cassette already exists**, deliberately: refusing there would fire on every `--rerecord-stale` pass and
+  make the escape flag reflexive. And it is a **prediction** — it reads the tier and the destination path,
+  never the resulting bytes, so it can be wrong in both directions.
+
+  So `record` also checks the **evidence**. After redaction and before the write, the finished cassette is
+  scanned; a `host-inventory` or `machine-inventory` finding on a repo-visible path is **quarantined** —
+  written to `<runs-root>/quarantine/` (honouring `--run-dir`/`COWORK_HARNESS_RUNS_DIR`) with a
+  `.findings.txt` sibling naming what leaked, and the command fails without writing the path you asked for.
+  The recording is not discarded; you paid for it. Only the machine-identity classes trigger this —
+  `email`/`currency`/`domain`/`path` are frequently legitimate scenario content, and a gate that fires on
+  those just teaches you to pass the escape flag. Outside a git repo it warns instead: nothing there
+  publishes the file by accident.
 - **Always-on scan gate** — `verify-cassettes` flags email / currency / bare-domain / local-path /
   machine-inventory matches it finds in the committed cassettes and **exits non-zero**, so "no leak" is
   a gate, not discipline. Non-zero is not one thing, though: exit `1` means verification RAN and found a
@@ -222,6 +253,13 @@ dollar figures). In a skill repo these cassettes get **committed**. So:
   $? -ne 0 ]` tripwire treats both the same — if you need to tell "the gate caught something" apart from
   "the gate couldn't run", branch on the exit code (or parse `--output-format json`'s per-file
   `findings`/`staleness` vs `unverifiable`/`version`/`error` buckets).
+
+  **Do not read `error` as "this file was never scanned".** The privacy scan needs a readable *transcript*
+  (an `events` array of strings), not a *valid* cassette — so a file that fails shape validation is still
+  scanned, and reports its findings **and** its `error`. Each result carries **`privacyScanned`**, which
+  answers that question directly. A gate that must not treat "could not verify" as "verified clean" should
+  key on `privacyScanned === false`, where `findings: []` is an absence of evidence rather than evidence of
+  absence. `--skip-privacy` also reports `false`, for the same reason.
   Suppress synthetic / public reference names (NVCA, Cooley GO, …) with `--allow <regex>`. (Multi-word
   proper names are NOT a default class — too noisy to gate on; add a pattern via config if your corpus
   needs it.)
@@ -289,7 +327,7 @@ jobs:
         with: { node-version: '24' }
       - uses: actions/setup-python@v5
         with: { python-version: '3.x' }                                       # python3 only — PyYAML is bundled with the linter
-      - run: npm i -g "cowork-harness@>=1.25.0"
+      - run: npm i -g "cowork-harness@^2.0.1"
       - run: cowork-harness lint scenarios/*.yaml                              # no-silent-false-green (needs python3; PyYAML bundled)
       - run: cowork-harness verify-cassettes cassettes/ --output-format json   # privacy + staleness gate
       - run: cowork-harness replay cassettes/ --output-format json             # token-free content/structure
@@ -318,7 +356,7 @@ jobs:
             echo "live=true" >> "$GITHUB_OUTPUT"
           fi
       - if: steps.guard.outputs.live == 'true'
-        run: npm i -g "cowork-harness@>=1.25.0"
+        run: npm i -g "cowork-harness@^2.0.1"
       - if: steps.guard.outputs.live == 'true'
         run: cowork-harness run scenarios/ --output-format json
         env:
@@ -340,10 +378,14 @@ sandbox).
 ## Reading results in CI
 
 `--output-format json` emits a machine envelope on stdout (human output goes to stderr):
-`{tool, version, command, ok, results[], error}` — one `RunResult` per scenario. Overall pass for a
-scenario = `result === "success" && assertions.every(pass)`. Exit code is non-zero if any assertion
-fails or a run errors, so a plain `cowork-harness run scenarios/` is already CI-ready without parsing
-JSON.
+`{tool, version, command, ok, results[], error}` — one `RunResult` per scenario. **Overall pass for a
+scenario is `verdict.pass`** (envelope-wide: `ok`), and it is strictly stronger than
+`result === "success" && assertions.every(pass)`: the verdict also carries ~20 signal codes that fail a run
+with no failing assertion at all — `stalled`, `outputs_delete`, `mount_delete`, `host_path_leak`,
+`undelivered_deliverables`, `missing_capability`, `permissive_auto_allow`, `ended_with_question`,
+`infra_error`, and more. A parser that reimplements the shorter formula greens through every one of them.
+Read `ok` / `verdict.pass`, or just use the exit code — a plain `cowork-harness run scenarios/` is already
+CI-ready without parsing JSON.
 
 **Telling *why* a run failed, without scraping stderr.** Each result carries a `verdict` whose
 `failures[]` is the one place every failure reason is enumerated, in one shape (the same object lands
@@ -406,19 +448,21 @@ evaluation), not present-and-passing. A CI script that counts assertions will se
 on replay vs live — compare by assertion identity / pass-fail, not by total count. The count of
 skipped live-only assertions is reported on each replay result as `skippedAssertions: {full, partial}`.
 
-## Staleness does NOT fail a replay by default — read it from the JSON
+## Staleness mostly does NOT fail a replay — read it from the JSON
 
-A plain `replay` **warns** on a stale cassette (skill/baseline drift) but stays `ok:true` — a green replay
-does **not** imply the recording is still valid. Each replay result carries `staleness[]`, an array of
+A plain `replay` **warns** on a DRIFTED cassette (skill/baseline drift) but stays `ok:true` — a green
+replay does **not** imply the recording is still valid. **Since 2.0.0 there is one exception:**
+`unverifiable-skill` — staleness that could not be checked at all, most often a cassette that moved —
+FAILS a bare `replay`. Recover with `--session <file>` rather than re-recording. Each replay result carries `staleness[]`, an array of
 `{class, message}`, so a token-free gate can act on it without `ok` being the whole story:
 
 | `class` | meaning | concern |
 |---|---|---|
 | `baseline` | platform baseline moved since record | low (format-compatible) |
 | `skill` / `shared-root` | the skill source the assertions validate drifted | **high** (assertions may validate dead code) |
-| `format` | recorded under an older hash format | re-record once |
+| `format` | the git/raw file-set mode or agent-scope differs from the recording | re-record under the same setting (waivable) |
 | `unverifiable-baseline` | the latest baseline couldn't be loaded | couldn't verify (env, not skill) |
-| `unverifiable-skill` | skill dirs unresolvable — skill staleness couldn't be checked | couldn't verify the skill |
+| `unverifiable-skill` | skill dirs unresolvable, **or** the cassette predates the hash-format epoch (v12) so its digest is not comparable | couldn't verify the skill. **Fails a bare `replay`.** For the epoch case try `rehash` first — it migrates without a re-record where it can prove the content unchanged (`rehash <file> --session <s.yaml>` if the cassette moved) |
 | `resolved-tier` | a `fidelity: cowork` cassette's recorded `effectiveFidelity` no longer matches what the baseline resolves to today (the host-loop gate flipped) | **high** (the recording exercises the wrong tier) |
 | `unverifiable-tier` | tier check couldn't run for a `fidelity: cowork` cassette (no recorded `effectiveFidelity`, or its pinned baseline failed to load) | couldn't verify the tier — re-record |
 
@@ -433,7 +477,7 @@ fail it either way.)
 To gate in CI, pick the severity you want:
 
 - `replay --strict` — fail (exit 1) on **any** staleness class.
-- `replay --fail-on-skill-drift` — fail only on skill-source drift (`skill` / `shared-root` / `unverifiable-skill`);
+- `replay --fail-on-skill-drift` — fail on the skill-source DRIFT classes (`skill` / `shared-root`); `unverifiable-skill` needs no flag, it fails the default verdict since 2.0.0;
   baseline / format / `unverifiable-baseline` stay non-failing warnings.
   Note `--allow-failing` waives this gate wholesale, including the copy `--assert-from` turns on for you:
   `replay --assert-from … --write --allow-failing` will persist an assert block validated against a

package/.claude/skills/cowork-harness/references/critique.md

@@ -1,6 +1,6 @@
 # Critique — the facts a plugin install can't otherwise reach
 
-Tracks `cowork-harness 1.25.0` (baseline `desktop-1.32885.1`). This is **not** a trim of the full
+Tracks `cowork-harness 2.0.1` (baseline `desktop-1.34493.1`). This is **not** a trim of the full
 [`docs/critique.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/critique.md) (repo-only —
 flags, cost, reproduction discipline, known limitations all live there). This file covers exactly what a
 plugin install cannot otherwise discover: the run-dir artifact a harvester actually reads, the report's

package/.claude/skills/cowork-harness/references/fidelity-and-answers.md

@@ -1,6 +1,6 @@
 # Fidelity tiers & answer paths
 
-Self-contained reference. Tracks `cowork-harness 1.25.0` (baseline `desktop-1.32885.1`).
+Self-contained reference. Tracks `cowork-harness 2.0.1` (baseline `desktop-1.34493.1`).
 
 ## Fidelity tiers (`fidelity:` in the scenario)
 
@@ -210,7 +210,7 @@ up often enough to spell out:
 - **A green `replay` proves "same as when recorded," not "correct today."** `replay` never touches
   a filesystem or network — it re-evaluates assertions from the frozen cassette. A fixed set of
   keys is live-only and **skipped outright** on replay (absent from `assertions[]`, not vacuously
-  passed): `file_absent`, `no_delete_in_outputs`, `self_heal_ran`, `transcript_no_host_path`, `egress_denied`,
+  passed): `file_absent`, `no_delete_in_outputs`, `no_delete_in_mounts`, `self_heal_ran`, `transcript_no_host_path`, `egress_denied`,
   `egress_allowed`, `no_mcp_error`, `max_peak_rss_bytes`, `semantic_matches`, `no_lost_write_back`, and `expect_denied`.
   Everything else that *is* evaluated is checked against the **recording**, not fresh behavior — a
   green replay says the skill produced these events when it was recorded, not that it still does

package/.claude/skills/cowork-harness/references/scenario-schema.md

@@ -1,7 +1,7 @@
 # Scenario & session schema, assertion catalog, web_fetch, full gotchas
 
-Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 1.25.0`
-(baseline `desktop-1.32885.1`). If your checkout is newer, prefer the live [`docs/scenario.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/scenario.md),
+Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 2.0.1`
+(baseline `desktop-1.34493.1`). If your checkout is newer, prefer the live [`docs/scenario.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/scenario.md),
 [`docs/session.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/session.md), and `SPEC.md`.
 
 **Minimal scenario** — `prompt` is the only required field:
@@ -107,7 +107,7 @@ form a relocatable bundle. `~` expands to home.
 > references relative to **its own** directory at record time (`scenario.session` and
 > `scenarioSource`), so moving it afterwards — a different `--out`, a
 > `git mv`, a copy into another repo — leaves them unresolvable and `verify-cassettes` reports
-> `unverifiable-skill` ("can't verify ⇒ not green", exit 3) until you re-record at the new location.
+> `unverifiable-skill` ("can't verify ⇒ not green", exit 3) until you re-record at the new location, or pass `--session <file>`.
 > Decide where a cassette will live *before* you record it.
 
 ## Session YAML

package/.claude/skills/cowork-harness/references/task-recipes.md

@@ -2,7 +2,7 @@
 
 Each recipe composes facts that live scattered across SKILL.md and the other references into one
 decision path. Every one answers a question a real fleet owner had to work out the hard way.
-Tracks `cowork-harness 1.25.0` (baseline `desktop-1.32885.1`), same as SKILL.md's front-matter. Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
+Tracks `cowork-harness 2.0.1` (baseline `desktop-1.34493.1`), same as SKILL.md's front-matter. Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
 Recipe 3's `init-redact` shipped in 0.24.0 and are part of the current feature set — no version gate
 needed if your CLI meets SKILL.md's version floor.
 
@@ -49,11 +49,11 @@ what production would do. Two layers of defense:
 
 ### Cassette anatomy (what you're looking at when you open one)
 
-Top-level fields of a `*.cassette.json` (schema [`schema/cassette.v11.json`](https://github.com/yaniv-golan/cowork-harness/blob/main/schema/cassette.v11.json)):
+Top-level fields of a `*.cassette.json` (schema [`schema/cassette.v12.json`](https://github.com/yaniv-golan/cowork-harness/blob/main/schema/cassette.v12.json)):
 
 | Field | What it is |
 |---|---|
-| `$schema`, `generator`, `cassetteVersion` | Provenance: schema URL, producing tool, format version — the MINIMUM a reader needs for this scenario, not the recorder's version (current max: 11; a `lane: remote` scenario stamps 11, nearly everything else stays 10) |
+| `$schema`, `generator`, `cassetteVersion` | Provenance: schema URL, producing tool, format version — the MINIMUM a reader needs for this scenario, not the recorder's version (current max: 12 — the hash-format epoch floors every stamp there, so a fresh recording stamps 12 whatever its `lane:`) |
 | `scenario` | The embedded scenario snapshot at record time |
 | `events` | The recorded agent event stream (the replay source) |
 | `controlOut` | Driver→agent control responses — presence unlocks gate asserts on replay |

package/.claude/skills/cowork-harness/scripts/scenario.py

@@ -409,6 +409,67 @@ def _is_positional_choose(choose):
     return any(isinstance(v, str) and (v == "first" or v.isdigit()) for v in vals)
 
 
+# Single-segment absolute paths that legitimately appear in prompt prose. A `/word` from this set is a
+# path, not a slash command, so it never raises the not-leading warning below.
+_SLASH_PATH_WORDS = frozenset(
+    {"outputs", "mnt", "tmp", "home", "users", "var", "etc", "usr", "bin", "dev", "opt", "workspace", "root", "srv"}
+)
+# A `/`-prefixed token at a word start (start-of-string or whitespace), captured WHOLE up to the next
+# space. An opening bracket or quote also counts as a word start, so "(/deck-review)" is seen; `and/or`,
+# `8/22` and `https://x` still cannot match, because their slash follows a letter, digit or colon. The
+# token is then classified in Python rather than by a lookahead: an earlier lookahead-based pattern
+# BACKTRACKED, matching `/mn` inside `/mnt/uploads` because a shorter prefix satisfied the lookahead.
+_SLASH_TOKEN_RE = re.compile(r"""(?:^|[\s(\[{"'])/(\S+)""")
+# What a slash command may look like once trailing sentence punctuation is stripped: a bare name, or a
+# plugin-qualified `plugin:skill`. Anchored, so any residual `/` or `.` disqualifies it as a path/filename.
+_SLASH_CMD_NAME_RE = re.compile(r"^[A-Za-z][A-Za-z0-9_-]*(?::[A-Za-z][A-Za-z0-9_-]*)?$")
+
+
+def _lint_prompt_slash(doc, path):
+    """W: `prompt:` names a slash command somewhere other than position 0.
+
+    The agent binary resolves a slash command only when the TRIMMED prompt starts with `/` — its parser
+    trims, then requires `startsWith("/")` (verified against agent 2.1.239 in the harness's own spawn
+    shape: `-p --input-format stream-json --output-format stream-json --setting-sources user`). A slash
+    named mid-sentence is never expanded. It reaches the model as ordinary prose, and the model may then
+    reach for the `Skill` tool on its own — the model-invocation path, i.e. exactly the unreliable
+    auto-trigger a slash is normally used to bypass. The scenario still runs and can still pass, so the
+    failure mode is a scenario that silently tests something other than what it reads as.
+
+    Deliberately silent when the prompt DOES start with `/`: that is the working case. Registration is not
+    checkable statically (it depends on how the skill is staged), so an unresolvable leading name is left
+    to the run itself, where it shows up as `Unknown command: /x` with `num_turns: 0`.
+    """
+    findings = []
+    prompt = doc.get("prompt")
+    if not isinstance(prompt, str) or prompt.lstrip().startswith("/"):
+        return findings
+    seen = []
+    for m in _SLASH_TOKEN_RE.finditer(prompt):
+        # Trailing sentence punctuation is not part of the name, so "use /deck-review." still counts.
+        name = m.group(1).rstrip(".,;:!?)]}\"'")
+        if not _SLASH_CMD_NAME_RE.match(name):
+            continue  # a path (`/mnt/uploads`), a filename (`/deck.pdf`), or not command-shaped
+        if name.lower() in _SLASH_PATH_WORDS or name in seen:
+            continue
+        seen.append(name)
+    for name in seen:
+        findings.append(
+            Finding(
+                "WARN",
+                "prompt-slash-not-leading",
+                f"`prompt:` names `/{name}` but does not START with it. A slash command is expanded only "
+                "when the trimmed prompt begins with `/`, so here it reaches the model as ordinary prose "
+                "and the skill is NOT preloaded — the model may or may not reach for it on its own, which "
+                "is the auto-trigger path a slash is normally used to bypass.",
+                f'Put the command first — `prompt: "/{name} <args>"` — or drop the slash if the scenario '
+                "means to test auto-triggering from a natural request.",
+                path,
+            )
+        )
+    return findings
+
+
 def lint_doc(doc, path, raw_lines):
     findings = []
     if not isinstance(doc, dict):
@@ -456,6 +517,9 @@ def lint_doc(doc, path, raw_lines):
                 )
             )
 
+    # W: a slash command named mid-prompt is never expanded — see _lint_prompt_slash.
+    findings.extend(_lint_prompt_slash(doc, path))
+
     # W: unknown assertion keys inside assert items (e.g. invented file_not_empty, kind, path)
     unknown_assert = sorted(assert_keys - ASSERT_KEYS)
     for k in unknown_assert:
@@ -1834,11 +1898,16 @@ def build_scenario(args):
         )
         content_lines.append("  - gate_answers_delivered: true   # the steered answers actually reached the model")
 
-    live_lines = []
+    # Two buckets, not one. `file_exists`/`user_visible_artifact` are MANIFEST_KEYS above — they DO
+    # evaluate on replay whenever the cassette carries an artifacts manifest, which `record` has
+    # snapshotted since 0.24. Filing them under a "LIVE-only" heading taught the reader the opposite of
+    # what this file's own taxonomy says, and of what the `manifest-needs-snapshot` INFO tells them.
+    manifest_lines = []
     for p in (args.file or []):
-        live_lines.append(f"  - file_exists: {p}")
+        manifest_lines.append(f"  - file_exists: {p}")
     for p in (args.artifact or []):
-        live_lines.append(f"  - user_visible_artifact: {p}")
+        manifest_lines.append(f"  - user_visible_artifact: {p}")
+    live_lines = []
     if args.no_delete:
         live_lines.append("  - no_delete_in_outputs: true")
     for h in (args.egress_allowed or []):
@@ -1850,12 +1919,16 @@ def build_scenario(args):
     L.append("assert:")
     L.append("  # --- content / structure: evaluate on the token-free replay PR gate AND live ---")
     L.extend(content_lines)
+    if manifest_lines:
+        L.append("  # --- artifacts: replay-checkable WHEN the cassette carries an artifacts manifest ---")
+        L.extend(manifest_lines)
     if live_lines:
-        L.append("  # --- filesystem / egress: LIVE-only (skipped on replay, with a loud warning) ---")
+        L.append("  # --- egress / deletes: LIVE-only (skipped on replay, with a loud warning) ---")
         L.extend(live_lines)
-    else:
-        L.append("  # TODO add filesystem/egress checks (file_exists / user_visible_artifact /")
-        L.append("  #      egress_denied / no_delete_in_outputs) — they run on the LIVE lane only.")
+    if not manifest_lines and not live_lines:
+        L.append("  # TODO add artifact checks (file_exists / user_visible_artifact — these replay from")
+        L.append("  #      the cassette's artifacts manifest) and filesystem/egress checks")
+        L.append("  #      (egress_denied / no_delete_in_outputs — LIVE lane only).")
 
     if args.web_fetch:
         notes.append(