cowork-harness 1.5.0 → 1.6.0

package/.claude/skills/cowork-harness/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: cowork-harness
-description: Test or debug a Claude Code skill/plugin under Claude Cowork's runtime — sandboxed agent, default-deny egress, the can_use_tool permission/question protocol — using the cowork-harness CLI. Use when validating or regression-testing a skill, authoring or debugging a scenario YAML (prompt + scripted answers + assert:), choosing a fidelity tier, scripting AskUserQuestion / tool-permission answers, or asserting artifacts, egress, or sub-agent dispatch. Especially when a harness run no-ops an assertion, fails on an unanswered gate, false-greens, a steered answer never reaches the model, or a web_fetch is unexpectedly denied or gated. Also when iterating or hardening a skill across fixes, or grounding a skill's self-critique against its own run evidence. NOT for generic unit testing (pytest/vitest of your own scripts) or non-Cowork CI. Covers the skill / run / chat / record / replay / trace / decide / assertions / scaffold commands and the session-vs-scenario split.
+description: Test or debug a Claude Code skill/plugin under Claude Cowork's runtime — sandboxed agent, default-deny egress, the can_use_tool permission/question protocol — using the cowork-harness CLI. Use when validating or regression-testing a skill, authoring or debugging a scenario YAML (prompt + scripted answers + assert:), choosing a fidelity tier, scripting AskUserQuestion / tool-permission answers, or asserting artifacts, egress, or sub-agent dispatch. Especially when a harness run no-ops an assertion, fails on an unanswered gate, false-greens, a steered answer never reaches the model, or a web_fetch is unexpectedly denied or gated. Also when iterating or hardening a skill across fixes, or grounding a skill's self-critique against its own run evidence — including a document-analysis skill (cap table, deck, financial model, transcript) that needs an uploaded file attached to be critiqued at all. NOT for generic unit testing (pytest/vitest of your own scripts) or non-Cowork CI. Covers the skill / run / chat / record / replay / trace / decide / assertions / scaffold commands and the session-vs-scenario split.
 metadata:
   author: cowork-harness
-  version: 1.5.0
-  tracks-harness: cowork-harness 1.5.0 (baseline desktop-1.22209.3)
+  version: 1.6.0
+  tracks-harness: cowork-harness 1.6.0 (baseline desktop-1.22209.3)
 ---
 
 # cowork-harness
@@ -22,7 +22,7 @@ flagged with a loud `::warning::`, not silent — auto-answer a gate, observe an
 allowlist). This skill exists mostly to keep you out of those traps — the Gotchas section below is
 the highest-value part. Read it.
 
-> **Version note:** the facts and `file:line` pointers here track `cowork-harness 1.5.0` (baseline
+> **Version note:** the facts and `file:line` pointers here track `cowork-harness 1.6.0` (baseline
 > `desktop-1.22209.3`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
 > `SPEC.md` / `docs/*.md` over this snapshot, and re-run the bundled linter.
 
@@ -39,9 +39,21 @@ Before the first command, confirm the CLI is reachable and **fail loud** (never
 
 - **One-shot check.** Run `cowork-harness doctor [--tier <tier>]` first — a read-only prerequisite check that inspects Docker, the staged agent, the token, and the baseline in one pass. The bullets below explain each thing it checks (and how to fix it).
 - **Replay-only? Skip `doctor`.** Replaying committed cassettes needs no Docker, no staged agent, and no token — and every tier's `doctor` validates the auth token (the live tiers also Docker + the staged agent), so a ✗ there is expected, not a blocker. Go straight to `cowork-harness replay <cassette>`.
-- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 1.5.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@>=1.5.0" <cmd>` (Node ≥ 20), or install once with `npm i -g "cowork-harness@>=1.5.0"`. **Pin `@>=1.5.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
-
-  What the ≥ 1.5.0 floor gates, by release:
+- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 1.6.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@>=1.6.0" <cmd>` (Node ≥ 20), or install once with `npm i -g "cowork-harness@>=1.6.0"`. **Pin `@>=1.6.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
+
+  What the ≥ 1.6.0 floor gates, by release:
+
+  - **1.6.0 (`critique`'s skill-flag parity):** `critique` accepts most `skill` flags under the same names,
+    which is what makes a document-analysis skill (cap table, deck, financial model, transcript)
+    critiquable at all: `--upload`/`--folder`/`--plugin`/`--marketplace`/`--enable`/`--model`/
+    `--allow-missing-capability` reach BOTH spawned turns; `--label`/`--timeout`/`--answer`/
+    `--answer-policy`/`--on-unanswered`/the decider flags reach the graded turn only; `--prompt-file` is
+    new. Anything that can't work is REFUSED with a reason rather than silently ignored.
+    **Repeating a flag:** `--upload`/`--folder`/`--plugin`/`--marketplace`/`--enable`/`--answer`
+    accumulate; every other value-taking flag is single-valued and repeating it is a usage error (exit `2`)
+    rather than a silent last-wins — do not assume the CLI-conventional "last one wins". Booleans repeat
+    harmlessly. On `1.5.0` these flags do not exist: `critique --upload x.xlsx` fails as "unknown flag", so
+    if a user hits that, they are below the floor.
 
   - **1.5.0:** `critique <skill-folder> --prompt "<probe>"` (EXPERIMENTAL) — runs a skill, asks the agent
     what confused it, then grades that self-report against a frozen record of the run: a blinded evaluator
@@ -69,7 +81,7 @@ Before the first command, confirm the CLI is reachable and **fail loud** (never
 - **Agent binary (sandboxed live tiers — `container`/`microvm`/`hostloop`/`cowork`).** The staged Claude Code agent is **bind-mounted** from a local Claude Desktop install, or point `COWORK_AGENT_BINARY` at a `claude-code-vm/<ver>/claude` ELF. Nothing is bundled. `protocol` (L0) and `replay` need no staged agent; for the sandboxed tiers, no agent → no run; report that, don't skip silently.
 - **Docker / Lima.** Only `--fidelity protocol` (L0) runs without them. `container` / `microvm` / `hostloop` / `cowork` need Docker (Lima for L2). If they're absent, drop to `--fidelity protocol` and **say so** — a green that never exercised the sandbox is not a sandbox pass.
 - **Auth.** `CLAUDE_CODE_OAUTH_TOKEN` (preferred), or `ANTHROPIC_API_KEY` / `ANTHROPIC_AUTH_TOKEN`, via env or `.env`. Minting an OAuth token needs the **`claude` CLI** (`npm i -g @anthropic-ai/claude-code`, then `claude setup-token`).
-- **`--dotenv` is a GLOBAL flag — put it BEFORE the subcommand.** `cowork-harness --dotenv .env record …`, never `cowork-harness record … --dotenv .env`. Every *other* flag is subcommand-level, so muscle memory fights this one; the harness rejects the misplaced form with an exact-fix error, but placing it first avoids the round-trip.
+- **`--dotenv` is a GLOBAL flag — put it BEFORE the subcommand.** `cowork-harness --dotenv .env record …`, never `cowork-harness record … --dotenv .env`. Every *other* flag is subcommand-level, so muscle memory fights this one; the harness rejects the misplaced form with an exact-fix error, but placing it first avoids the round-trip. **One exception: `critique` also accepts `--dotenv` per-command** (`critique <folder> --prompt "…" --dotenv <path>`) — UNRELEASED, see the floor list; `--run-dir` stays global-only everywhere.
 
 ## Orient — the three loops
 

package/.claude/skills/cowork-harness/references/ci-recipe.md

@@ -1,6 +1,6 @@
 # CI recipe — replay vs live lanes
 
-Self-contained reference. Tracks `cowork-harness 1.5.0` (baseline `desktop-1.20186.1`).
+Self-contained reference. Tracks `cowork-harness 1.6.0` (baseline `desktop-1.20186.1`).
 
 **Fastest path: the packaged Action.** One step gets you `replay`/`lint`/`verify-cassettes` plus a PR
 job-summary reporter (verdict table, staleness findings, cost/turns when available):
@@ -13,7 +13,7 @@ job-summary reporter (verdict table, staleness findings, cost/turns when availab
 ```
 
 The Action's `version` input defaults to `latest` — intentional so a copy-pasted recipe tracks the current
-release; pin an exact version (e.g. `version: "1.5.0"`) for reproducible CI.
+release; pin an exact version (e.g. `version: "1.6.0"`) for reproducible CI.
 
 Reach for the manual multi-step form below only when you need per-step control the Action's inputs don't
 cover (a custom flag combination, a different runner matrix per step, or `lint`/`verify-cassettes` gated
@@ -57,7 +57,7 @@ sha256-*checked* but not hard-blocking on mismatch — it's advisory for an inte
 GitHub-hosted runners, no token/Docker/agent:
 
 ```yaml
-- run: npm i -g "cowork-harness@>=1.5.0"
+- run: npm i -g "cowork-harness@>=1.6.0"
 - run: cowork-harness lint scenarios/*.yaml          # no silent false-greens
 - run: cowork-harness verify-cassettes cassettes/    # privacy + staleness
 - run: cowork-harness replay cassettes/              # token-free content/structure
@@ -197,7 +197,7 @@ jobs:
         with: { node-version: '20' }
       - uses: actions/setup-python@v5
         with: { python-version: '3.x' }                                       # python3 only — PyYAML is bundled with the linter
-      - run: npm i -g "cowork-harness@>=1.5.0"
+      - run: npm i -g "cowork-harness@>=1.6.0"
       - run: cowork-harness lint scenarios/*.yaml                              # no-silent-false-green (needs python3; PyYAML bundled)
       - run: cowork-harness verify-cassettes cassettes/ --output-format json   # privacy + staleness gate
       - run: cowork-harness replay cassettes/ --output-format json             # token-free content/structure
@@ -226,7 +226,7 @@ jobs:
             echo "live=true" >> "$GITHUB_OUTPUT"
           fi
       - if: steps.guard.outputs.live == 'true'
-        run: npm i -g "cowork-harness@>=1.5.0"
+        run: npm i -g "cowork-harness@>=1.6.0"
       - if: steps.guard.outputs.live == 'true'
         run: cowork-harness run scenarios/ --output-format json
         env:

package/.claude/skills/cowork-harness/references/fidelity-and-answers.md

@@ -1,6 +1,6 @@
 # Fidelity tiers & answer paths
 
-Self-contained reference. Tracks `cowork-harness 1.5.0` (baseline `desktop-1.20186.1`).
+Self-contained reference. Tracks `cowork-harness 1.6.0` (baseline `desktop-1.20186.1`).
 
 ## Fidelity tiers (`fidelity:` in the scenario)
 
@@ -122,6 +122,7 @@ hands `fn` exactly this dict.
 
 - On `skill`: `fail | prompt | first`.
 - On `run`: `fail | first` (`prompt` rejected — it would break determinism).
+- On `critique` (UNRELEASED): `fail | first` (`prompt` rejected — there is no TTY inside the spawned turn).
 - **`llm` is NOT an `--on-unanswered` value.** The bare flag `--on-unanswered llm` is rejected; use
   `--decider-llm` (CLI) or `on_unanswered: llm` (YAML).
 - `agent` is **retired** — `on_unanswered: agent` is rejected by the schema. The enum is

package/.claude/skills/cowork-harness/references/scenario-schema.md

@@ -1,6 +1,6 @@
 # Scenario & session schema, assertion catalog, web_fetch, full gotchas
 
-Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 1.5.0`
+Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 1.6.0`
 (baseline `desktop-1.20186.1`). If your checkout is newer, prefer the live `docs/scenario.md`,
 `docs/session.md`, and `SPEC.md`.
 

package/.claude/skills/cowork-harness/references/task-recipes.md

@@ -179,7 +179,11 @@ Hardening a skill is a loop: run → read what it did → fix → run again. Two
    The full loop (harvest -> reproduce -> fix -> prove freshness -> compare) is written out end-to-end in
    docs/debugging.md under "The whole loop, end to end". The harness now SHIPS a grader — `cowork-harness critique <skill-folder> --prompt "<probe>"` runs the
    skill, asks the agent what confused it, and grades that self-report against a frozen record of the run
-   (blinded evaluator + mechanical citation checking). See docs/critique.md for cost and limits. If you
+   (blinded evaluator + mechanical citation checking). **Critiquing a document-analysis skill?** The probe
+   attaches nothing on its own — pass `--upload <path>` (repeatable) or `--folder <dir>` exactly as you
+   would to `skill`, or the graded run has no file and "there was no file attached" is the correct finding,
+   not a skill defect. Source flags reach both spawned turns automatically. UNRELEASED — see SKILL.md's
+   floor list. See docs/critique.md for the full flag table, cost and limits. If you
    prefer to build your own grader, the substrate is still here:
    - `result.json` → `finalMessage` (the skill's own answer/critique) + `toolResults[]` (tool outputs).
    - `cowork-harness trace <run-dir> --output-format json` → the tool-call stream. Add `--full-results` so

package/CHANGELOG.md

@@ -6,6 +6,48 @@ All notable changes to this project are documented here. The format is based on
 
 ## [Unreleased]
 
+## [1.6.0] — 2026-07-20
+
+### Added
+
+- **`critique` now accepts the `skill` flags a graded run needs — starting with uploads.** A skill whose
+  whole job is "here is a document, analyze it" (cap table, pitch deck, financial model, transcript) could
+  not be critiqued at all: there was no way to attach the file, so the agent was asked to analyze a
+  document that was never there and then asked what confused it — you harvested a finding about the test
+  rig. `--upload`, `--folder`, `--plugin`, `--marketplace`/`--enable` (all repeatable), `--model` and
+  `--allow-missing-capability` now reach **both** spawned turns; that is forced, not stylistic, because
+  those paths are part of the session-origin key the reflection turn's `--resume` recomputes. `--label`,
+  `--timeout`, `--answer`/`--answer-policy`, `--on-unanswered` and the decider flags reach the graded turn
+  only. `--answer`/`--answer-policy` make **gated** skills critiquable for the first time — the inner spawn
+  has no TTY, so an unscripted gate previously killed the task turn before anything could be graded.
+  Anything that cannot work is refused **with its reason** rather than silently ignored:
+  `--session-id`/`--resume`, the `--repeat` family, `--ablate-skill`, and the rendering/preview flags.
+- **`critique --prompt-file <path>`** — read the probe verbatim from a file, so a probe containing quotes,
+  `$` or newlines does not have to survive shell parsing.
+- **"Attached inputs" evidence section** — upload filenames and sizes, plus connected-folder mount names,
+  never content. Without it the evaluator could not tell "the agent said there was no file, and correctly
+  so" from a confabulation.
+- **One source of truth for the `skill` flag surface** (`src/run/skill-flag-surface.ts`), where each flag's
+  critique disposition is a **required** field, plus a parity guard that fails CI when a new `skill` flag
+  arrives without one. The old hand-rolled subset drifted silently — this repo's recurring bug shape.
+
+### Changed
+
+- **Repeating a single-valued `critique` flag is now a usage error (exit `2`) instead of silent
+  last-wins.** `--upload`, `--folder`, `--plugin`, `--marketplace`, `--enable` and `--answer` accumulate —
+  repeating them is how you pass several. Everything else is single-valued, and `--prompt a --prompt b`
+  silently discarding a probe you typed is the class of no-op this command refuses on principle. Boolean
+  flags may still be repeated harmlessly. Documented in `critique --help` and
+  [docs/critique.md](./docs/critique.md).
+
+### Fixed
+
+- **`critique --dotenv <path>` was documented but unreachable** (shipped that way in 1.5.0). The
+  misplaced-global guard rejected the token after any subcommand, and the `--dotenv=x` form that slipped
+  past it then hit critique's exact-match parser as "unknown flag". `critique` is now exempt from the guard
+  (`--run-dir` still has no per-command meaning and stays rejected everywhere), and a missing file fails
+  fast with critique's own error instead of surfacing later as an instrument-failure diagnostic.
+
 ## [1.5.0] — 2026-07-20
 
 ### Added

package/README.md

@@ -91,7 +91,7 @@ node dist/cli.js replay examples/replays/example-pdf-skill.cassette.json
 
 > **Installed globally instead?** Once linked/installed, the same command is `cowork-harness replay
 > <cassette>` — but the relative path above only resolves from a source checkout's `examples/replays/`.
-> From a global install (`npm i -g "cowork-harness@>=1.5.0"`), point at the package root instead:
+> From a global install (`npm i -g "cowork-harness@>=1.6.0"`), point at the package root instead:
 > `cowork-harness replay "$(npm root -g)/cowork-harness/examples/replays/example-pdf-skill.cassette.json"`
 > (or copy the cassette into your own project and pass that path).
 
@@ -101,7 +101,7 @@ Live `run`/`skill` need the prerequisites in the next section — note the `prot
 > - **Replay only (zero setup):** `cowork-harness replay <cassette>` — no token, no Docker, no agent. The command above.
 > - **`protocol` (real model, no Docker):** needs only the auth token (item 3 below).
 > - **Live `container` / `microvm` / `hostloop` / `cowork`:** needs Docker (or Lima for `microvm`), a staged agent, and the token — run `cowork-harness doctor` first.
-> - **Invocation:** from a source checkout, `node dist/cli.js <cmd>` (or `npm link` to get the `cowork-harness` command); from a global install, `cowork-harness <cmd>`; the companion skill falls back to `npx "cowork-harness@>=1.5.0"`.
+> - **Invocation:** from a source checkout, `node dist/cli.js <cmd>` (or `npm link` to get the `cowork-harness` command); from a global install, `cowork-harness <cmd>`; the companion skill falls back to `npx "cowork-harness@>=1.6.0"`.
 
 Two more worked examples worth knowing about: `examples/scenarios/protocol-smoke.yaml` (zero-Docker smoke
 test) and `examples/scenarios/skill-loads.yaml` (container-tier acceptance check) — see
@@ -126,7 +126,7 @@ claude plugin marketplace add yaniv-golan/cowork-harness
 claude plugin install cowork-harness@cowork-harness
 ```
 
-The skill **self-bootstraps the CLI**: if `cowork-harness` isn't on your PATH it falls back to `npx "cowork-harness@>=1.5.0"` (a version floor that fails loud rather than silently fetching a too-old CLI; Node ≥ 20). Tiers above `protocol` still need Docker/Lima and a Claude Desktop agent binary — see the prerequisites below.
+The skill **self-bootstraps the CLI**: if `cowork-harness` isn't on your PATH it falls back to `npx "cowork-harness@>=1.6.0"` (a version floor that fails loud rather than silently fetching a too-old CLI; Node ≥ 20). Tiers above `protocol` still need Docker/Lima and a Claude Desktop agent binary — see the prerequisites below.
 
 It also follows the open [Agent Skills](https://agentskills.io) spec, so it installs cross-editor (Cursor, Codex, OpenCode, …) via [`npx skills`](https://github.com/vercel-labs/skills) (Vercel Labs' CLI implementation of that spec):
 
@@ -147,7 +147,7 @@ A global install is enough for CI `lint`, reading the teaching skill, and replay
 To `run` the worked examples live or copy them as a starting point, use a source checkout. (The marketplace
 skill install itself only pulls `.claude/skills/cowork-harness/` — SKILL.md + `references/` + `scenario.py`/
 assertion keys, per `.claude-plugin/marketplace.json`'s `source` — not the rest of this table; the full set
-above becomes available once the skill's first command self-bootstraps `npx "cowork-harness@>=1.5.0"` — see
+above becomes available once the skill's first command self-bootstraps `npx "cowork-harness@>=1.6.0"` — see
 [above](#drive-it-from-claude-code-companion-skill) — which pulls the same npm package as the global-install row.)
 
 ### Prerequisites for anything above `protocol` fidelity
@@ -415,7 +415,7 @@ Skill testing is the headline use, but the tool is a general harness over the Co
 | `boundary-check [baseline] [--session <file>]` | Prove the **L1 Docker** sandbox enforces Cowork's limitations (sealed FS + default-deny egress; `container`/`hostloop` share this sandbox — `microvm`'s guest firewall is not probed here); `--session` folds a session's `egress.extra_allow` into the probe allowlist | verifying the harness's own fidelity |
 | `sync` / `list` | Derive/refresh (`sync [--diff] [--allow-empty\|--force]`) & list platform baselines from the Desktop install | after Claude Desktop updates (baselines ship, so it's optional otherwise) |
 | `diff <a> <b>` | Compare two baselines, two runs, two cassettes, or a run+cassette — kind auto-detected by content (view/normalization flags below). Token-free, no live Desktop/Docker needed | "what changed between two runs/cassettes/baselines?" |
-| `critique <skill-folder>` | **EXPERIMENTAL.** Run a skill, ask the agent what confused it, then grade that self-report against a frozen record of the run — blinded evaluator, mechanical citation checking. Discovery instrument, never a gate (findings always exit 0). Costs four model workloads; see [docs/critique.md](./docs/critique.md) | "what confused the agent about my skill?" |
+| `critique <skill-folder>` | **EXPERIMENTAL.** Run a skill, ask the agent what confused it, then grade that self-report against a frozen record of the run — blinded evaluator, mechanical citation checking. Accepts the `skill` flags a graded run needs — `--upload`/`--folder`/`--plugin` reach both spawned turns, `--answer`/`--decider-*` the graded turn only; anything that can't work is refused with a reason (full table in `critique --help`). Discovery instrument, never a gate (findings always exit 0). Costs four model workloads; see [docs/critique.md](./docs/critique.md) | "what confused the agent about my skill?" — including "does it even see the attached document?" |
 | `doctor [--tier <t>]` | Read-only prerequisite check, per tier (Docker + agent image for `container`/`hostloop`/`cowork`; **Lima** for `microvm`; plus staged agent, token, baseline); prints the exact `docker build` line if the agent image is missing | "can I run the live tiers — what's missing?" before a first live run |
 | `prune [<runs-dir>] [--keep-last <n>] [--pinned-older-than <N>d\|h\|m]` | Prune accumulated run dirs (keeps the N most recent per scenario; pinned `--session-id` runs are never pruned unless `--pinned-older-than` opts in to reclaiming stale ones by last-activity age); the optional positional overrides the runs root; `--dry-run` | the machine-global runs root has grown and you want space back |
 | `rehash <dir/>` | Migrate cassette fingerprints to the current format version when the content is provably unchanged (`--dry-run`); no re-record needed | a cassette-format bump flagged committed fixtures as stale |
@@ -671,7 +671,7 @@ jobs:
           anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
 ```
 
-Every run writes a Markdown verdict table (scenario, pass/fail, signals, cost/turns when available, staleness findings, and the replay-skipped-assertions honesty line) to the job summary. Inputs: `command`, `path` (required), `version` (npm dist-tag/version, default `latest` — intentional so recipes track the current release; pin an exact version for reproducible CI. The companion skill's `cowork-harness@>=1.5.0` floor guidance applies to ad-hoc CLI installs, not this input), `strict` (applies to `replay` (staleness findings), `lint`/`lint-skill` (WARN/INFO), and `analyze-skill` (any advisory finding); IGNORED — not forwarded — for `verify-cassettes`/`run`, which don't accept the flag), `fail-on-skill-drift` (**`replay`-only** — never forwarded to the analyzers), `extra-args`, `summary` (default `true`), `anthropic-api-key` (live lane only). See [`action.yml`](./action.yml) for the full input reference.
+Every run writes a Markdown verdict table (scenario, pass/fail, signals, cost/turns when available, staleness findings, and the replay-skipped-assertions honesty line) to the job summary. Inputs: `command`, `path` (required), `version` (npm dist-tag/version, default `latest` — intentional so recipes track the current release; pin an exact version for reproducible CI. The companion skill's `cowork-harness@>=1.6.0` floor guidance applies to ad-hoc CLI installs, not this input), `strict` (applies to `replay` (staleness findings), `lint`/`lint-skill` (WARN/INFO), and `analyze-skill` (any advisory finding); IGNORED — not forwarded — for `verify-cassettes`/`run`, which don't accept the flag), `fail-on-skill-drift` (**`replay`-only** — never forwarded to the analyzers), `extra-args`, `summary` (default `true`), `anthropic-api-key` (live lane only). See [`action.yml`](./action.yml) for the full input reference.
 
 The provided [GitHub Actions workflow](.github/workflows/ci.yml) runs a **six-stage pipeline**. The **unit** stage is the token-free gate you can copy into your skill repo; the `action-self-test`, `python`, `boundary`, `scenarios`, and `parity-drift` stages are this repo's own fidelity self-tests and are not directly portable (they build the harness's Docker image and run harness-specific e2e scenarios — see [`ci-recipe.md`](./.claude/skills/cowork-harness/references/ci-recipe.md) for the skill-repo template):
 
@@ -714,7 +714,7 @@ Most runs need **none** of these — the defaults are correct. They're grouped b
 - `COWORK_HARNESS_JUDGE_MODEL` — the default model for `semantic_matches`' LLM judge (overridden by a
   per-assertion `judge_model`; falls back to the pinned default `claude-opus-4-8`). Pin it alongside `judge_model` for a
   reproducible before/after comparison across re-records.
-- `COWORK_HARNESS_RUNS_DIR` (or the `--run-dir <path>` flag — a **global** flag that must precede the subcommand, like `--dotenv`) — override the default run-output root `~/.cowork-harness/runs` (kept out of any working tree so sensitive skill inputs/outputs don't land in a repo). Precedence: `--run-dir` > env > default. The root is flat and machine-global (shared across projects); pinned `--session-id` runs are guarded against cross-project overwrite, and `prune` never prunes them. In CI, set it to a workspace path (e.g. `runs`) so artifact upload can collect the runs. `COWORK_HARNESS_ALLOW_FOREIGN_RESUME=1` overrides the guard that blocks `--resume` onto another project's pinned session.
+- `COWORK_HARNESS_RUNS_DIR` (or the `--run-dir <path>` flag — a **global** flag that must precede the subcommand — `--dotenv` follows the same rule everywhere except `critique`, which also takes it per-command) — override the default run-output root `~/.cowork-harness/runs` (kept out of any working tree so sensitive skill inputs/outputs don't land in a repo). Precedence: `--run-dir` > env > default. The root is flat and machine-global (shared across projects); pinned `--session-id` runs are guarded against cross-project overwrite, and `prune` never prunes them. In CI, set it to a workspace path (e.g. `runs`) so artifact upload can collect the runs. `COWORK_HARNESS_ALLOW_FOREIGN_RESUME=1` overrides the guard that blocks `--resume` onto another project's pinned session.
 - **Networking / loop:** `COWORK_EGRESS_PROXY` overrides the egress-proxy URL injected into the sandbox; `COWORK_PROXY_IMAGE` overrides the egress proxy Docker image name (default `cowork-egress-proxy:2`); `COWORK_DOCKER_NETWORK` pins the Docker network the agent container joins; `CLAUDE_FORCE_HOST_LOOP=1` forces the host-loop path regardless of the baseline's loop decision (the `cowork` tier's auto-pick). `COWORK_LIMACTL` overrides the `limactl` binary path (default `/opt/homebrew/bin/limactl`).
 - `COWORK_HARNESS_PRERUN_HASH_CAP` — override the default cap on pre-run file hashing (bytes); raise it if `input_unmodified`/`no_unexpected_files` report evidence unavailable on a large connected folder.
 - `COWORK_HARNESS_MAX_ARTIFACT_BYTES` — override the inline-artifact-body cap (default 65536 bytes;

package/dist/cli.js

@@ -608,7 +608,11 @@ async function main() {
     // more specific "<flag> requires a value" error; both exit 2, and the input is rare (value omitted AND
     // literally equal to the token).
     if (!hasHelp(rest) && COMMANDS.includes(cmd)) {
-        const misplacedGlobal = rest.find((t) => t === "--dotenv" || t === "--run-dir");
+        // `critique` is exempt from the `--dotenv` half: it is a legitimate PER-COMMAND flag there (forwarded
+        // to the inner `skill` turns and, since the fix below, validated by critique's own parseArgs), not a
+        // misplaced global. `--run-dir` stays rejected for every command, `critique` included — nothing reads
+        // a per-command `--run-dir`.
+        const misplacedGlobal = rest.find((t) => (t === "--dotenv" && cmd !== "critique") || t === "--run-dir");
         if (misplacedGlobal)
             fail(cmd, "usage", `${misplacedGlobal} is a GLOBAL flag and must come BEFORE the subcommand (e.g. \`cowork-harness ${misplacedGlobal} <path> ${cmd} …\`)`, undefined, isJsonOutput(rest));
     }

package/dist/critique/command.js

@@ -12,7 +12,8 @@
 // so the tier is pinned rather than left to the caller.
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
-import { existsSync } from "node:fs";
+import { lookupSkillFlag } from "../run/skill-flag-surface.js";
+import { existsSync, readFileSync } from "node:fs";
 import { randomUUID } from "node:crypto";
 import { writeSync } from "node:fs";
 import { basename } from "node:path";
@@ -49,18 +50,49 @@ you while you worked:
 
 Answer plainly, in prose. Do not restate the task's final answer.`;
 function usage() {
-    return `cowork-harness critique <skill-folder> --prompt "<probe>"
+    return `cowork-harness critique <skill-folder> --prompt "<probe>" | --prompt-file <path>
 
   EXPERIMENTAL. Runs the skill, asks the agent what confused it, then does NOT believe the answer:
   a blinded evaluator grades the self-report against a frozen record of what actually happened, and
   drops any claim whose citation is not verbatim in that evidence. Discovery instrument, not a gate.
 
-  --prompt "<probe>"        the task to run the skill against (required)
-  --evaluator-model <id>    override the evaluator model (env: COWORK_HARNESS_EVALUATOR_MODEL)
-  --dotenv <path>           load credentials from a dotenv file
-  --fidelity container      container tier only — the resume-continuity this loop depends on is
-                            verified there and nowhere else
-  --output-format json|text
+Probe (one required):
+  --prompt "<probe>"        the task to run the skill against
+  --prompt-file <path>      read the probe verbatim from a file (no shell parsing)
+
+Files and sources (forwarded to the graded run — REQUIRED for "analyze this document" skills):
+  --upload <path>           mount a file at mnt/uploads/<name> (repeatable)
+  --folder <dir>            connect a folder at mnt/<name> (repeatable)
+  --plugin <dir> | --marketplace <dir> --enable <name@mkt>   extra skill sources
+
+Graded-run tuning (shapes the run being graded):
+  --model <id>              session model for the agent doing the work AND reflecting
+  --timeout <ms>            wall-clock budget for the task turn
+  --label <tag>             generation tag in the run index (pair critiques across fixes)
+  --allow-missing-capability   don't fail EITHER turn on a lean-image capability gap (both turns)
+  --answer "<q-regex>=<choice>" | --answer-policy <yaml>   pre-answer the skill's gates (repeatable)
+  --on-unanswered fail|first   unscripted-gate policy ('prompt' is refused: no TTY inside the spawn)
+  --decider-llm [--intent "<line>"] [--decider-model <id>] | --decider-cmd '<helper>' | --decider-dir <dir>
+                            answer LIVE gates in the graded run (see 'skill --help')
+
+Critique's own:
+  --evaluator-model <id>    the grading model (env: COWORK_HARNESS_EVALUATOR_MODEL)
+  --output-format json|text critique's REPORT format (inner turns always speak json internally)
+  --fidelity container      container tier only
+  --keep                    accepted as a no-op — runs are always kept
+  --dotenv <path>           credentials
+  Global --run-dir <path>   must PRECEDE the subcommand
+
+Not accepted (each errors with its reason rather than being silently ignored):
+  --session-id / --resume   critique mints and manages its own session internally
+  --repeat + companions     fixed two-turn protocol — loop critique itself; pair by fingerprint.skillHash
+  --ablate-skill            grading a skill you removed is incoherent
+  --quiet/--verbose/--compact/--demo/--dry-run   inner-turn rendering or preview — no effect on the report
+
+Repeating a flag: --upload/--folder/--plugin/--marketplace/--enable/--answer accumulate (that is how you
+  pass several). Every other value-taking flag is single-valued and repeating it is a USAGE ERROR rather
+  than a silent last-wins — '--prompt a --prompt b' would otherwise discard a probe you typed. Boolean
+  flags may be repeated harmlessly.
 
 COST AND PREREQUISITES — read before running:
   * Each critique is FOUR model workloads: two container runs (task + reflection) and two evaluator
@@ -79,6 +111,33 @@ KNOWN LIMITATIONS: container tier only; SKILL.md is capped at 16KB (a larger one
   the instruction plane from evidence but cannot stop hostile content that merely ARGUES — see
   docs/critique.md.`;
 }
+/** Reads a value-flag that may appear as EITHER `--flag value` (space form) OR `--flag=value` (equals
+ *  form). critique's argv parsing runs in a separate process from cli.ts's `flagValue`/`flagValueEitherForm`
+ *  helpers (a process-boundary-separated CLI — see the plan's Option (c) rejection), so it gets its own
+ *  small copy rather than importing those private helpers. Returns `[value, extraTokensConsumed]` — 0 for
+ *  the equals form (the value is inline in `a`), 1 for the space form (the value is the NEXT token) — so
+ *  the caller's `i += extraTokensConsumed` advances the loop exactly like the old `argv[++i]` did. */
+/** Returns [value, indexAdvance] and whether the EQUALS form was used (the child's escape hatch for a
+ *  value starting with `-`, which its spaced-form parser rejects).
+ *
+ *  The empty/missing check lives HERE, not at the call sites: it was previously applied only in the
+ *  spec-forwarding branch, so `critique … --dotenv` with a forgotten path was ACCEPTED and ran a full
+ *  four-workload critique without loading env — a silent no-op on the flag this branch made reachable. */
+function flagVal(argv, i, flag) {
+    const a = argv[i];
+    if (a.startsWith(`${flag}=`)) {
+        const value = a.slice(flag.length + 1);
+        if (value.trim() === "")
+            throw new Error(`${flag} requires a non-empty value\n${usage()}`);
+        return { value, adv: 0, equalsForm: true };
+    }
+    const value = argv[i + 1];
+    // trim(), matching the child's own value checks — otherwise `--label " "` passes here and dies
+    // one layer later, which is the failure shape this check exists to prevent.
+    if (value === undefined || value.trim() === "")
+        throw new Error(`${flag} requires a value\n${usage()}`);
+    return { value, adv: 1, equalsForm: false };
+}
 function parseArgs(argv) {
     const positional = [];
     let prompt;
@@ -86,32 +145,143 @@ function parseArgs(argv) {
     let fidelity = "container";
     let evaluatorModel;
     let outputFormat = "text";
+    let promptFile;
+    let taskTimeoutMs;
+    const forwardBoth = [];
+    const forwardTask = [];
+    const seen = new Set();
+    /** A repeat of a non-repeatable flag silently discards the earlier value — the exact no-op this
+     *  command's refusal design exists to prevent. Applied to critique's OWN flags too: an earlier version
+     *  guarded only the forwarded branch, so `--prompt a --prompt b` quietly dropped a probe the user typed.
+     *  Arity-0 flags are exempt: there is no value to lose, and the child accepts them idempotently. */
+    const once = (flag, arity = 1) => {
+        if (arity === 0)
+            return;
+        if (seen.has(flag))
+            throw new Error(`${flag} given more than once (it is not repeatable)\n${usage()}`);
+        seen.add(flag);
+    };
     for (let i = 0; i < argv.length; i++) {
         const a = argv[i];
-        if (a === "--prompt")
-            prompt = argv[++i];
-        else if (a === "--dotenv")
-            dotenv = argv[++i];
-        else if (a === "--fidelity")
-            fidelity = argv[++i];
-        else if (a === "--evaluator-model")
-            evaluatorModel = argv[++i];
-        else if (a === "--output-format")
-            outputFormat = argv[++i];
-        else if (a.startsWith("-"))
-            throw new Error(`unknown flag: ${a}\n${usage()}`);
+        if (a === "--prompt" || a.startsWith("--prompt=")) {
+            once("--prompt");
+            const { value: v, adv } = flagVal(argv, i, "--prompt");
+            prompt = v;
+            i += adv;
+        }
+        else if (a === "--dotenv" || a.startsWith("--dotenv=")) {
+            once("--dotenv");
+            const { value: v, adv } = flagVal(argv, i, "--dotenv");
+            dotenv = v;
+            i += adv;
+        }
+        else if (a === "--fidelity" || a.startsWith("--fidelity=")) {
+            once("--fidelity");
+            const { value: v, adv } = flagVal(argv, i, "--fidelity");
+            fidelity = v;
+            i += adv;
+        }
+        else if (a === "--evaluator-model" || a.startsWith("--evaluator-model=")) {
+            once("--evaluator-model");
+            const { value: v, adv } = flagVal(argv, i, "--evaluator-model");
+            evaluatorModel = v;
+            i += adv;
+        }
+        else if (a === "--output-format" || a.startsWith("--output-format=")) {
+            once("--output-format");
+            const { value: v, adv } = flagVal(argv, i, "--output-format");
+            outputFormat = v;
+            i += adv;
+        }
+        else if (a === "--prompt-file" || a.startsWith("--prompt-file=")) {
+            once("--prompt-file");
+            const { value: v, adv } = flagVal(argv, i, "--prompt-file");
+            promptFile = v;
+            i += adv;
+        }
+        else if (a === "--keep" || a.startsWith("--keep=")) {
+            // Match the equals form too so it errors as "takes no value" rather than falling through to the
+            // owned-flag branch's "unknown flag: --keep=x", which misdescribes the mistake.
+            if (a.includes("="))
+                throw new Error(`--keep takes no value (got "${a}")\n${usage()}`);
+            // accepted no-op: critique always keeps its runs, so the flag's promise already holds. Erroring on
+            // an already-satisfied request is hostile; silently ignoring an UNsatisfied one is this repo's
+            // anti-pattern — this is the former.
+        }
+        else if (a.startsWith("-")) {
+            // Not critique-owned: consult THE shared spec rather than a hand-mirrored list here. A skill flag
+            // with no disposition is impossible — the parity test makes that red CI.
+            const name = a.includes("=") ? a.slice(0, a.indexOf("=")) : a;
+            const spec = lookupSkillFlag(name);
+            if (!spec)
+                throw new Error(`unknown flag: ${a}\n${usage()}`);
+            // `repeatable` is enforced, not decorative — see `once()`.
+            if (!spec.repeatable)
+                once(name, spec.arity);
+            if (spec.critique.kind === "reject")
+                throw new Error(`${name} is not accepted by critique: ${spec.critique.reason}\n${usage()}`);
+            if (spec.critique.kind === "owned")
+                throw new Error(`unknown flag: ${a}\n${usage()}`); // owned => handled above
+            let value;
+            let eq = false;
+            if (spec.arity === 1) {
+                const { value: v, adv, equalsForm } = flagVal(argv, i, name);
+                eq = equalsForm;
+                value = v;
+                i += adv;
+            }
+            else if (a.includes("=")) {
+                // The child rejects `--boolean=x` outright ("takes no value"). Accepting it here and forwarding a
+                // BARE flag would silently invert intent — `--allow-missing-capability=false` would enable it.
+                throw new Error(`${name} takes no value (got "${a}")\n${usage()}`);
+            }
+            // --on-unanswered prompt would resolve differently than the caller expects: there is no TTY inside
+            // the spawn, so it cannot actually prompt anyone.
+            if (name === "--on-unanswered" && value !== "fail" && value !== "first")
+                throw new Error(`--on-unanswered must be "fail" or "first" for critique (got "${value}") — there is no TTY inside the spawned turn\n${usage()}`);
+            if (name === "--timeout") {
+                const n = Number(value);
+                if (!Number.isInteger(n) || n <= 0)
+                    throw new Error(`--timeout requires a positive integer (ms), got "${value}"`);
+                taskTimeoutMs = n;
+            }
+            // Preserve the EQUALS form when that is how it arrived: the child's spaced-form parser rejects a
+            // value starting with `-`, so normalising `--intent=-terse` to two argv entries would kill a valid
+            // input one layer later with a wrong diagnosis.
+            const fragment = spec.arity === 1 ? (eq ? [`${name}=${value}`] : [name, value]) : [name];
+            // EXCLUSIVE buckets. `buildTaskTurnArgs` spreads BOTH arrays, so a "both" flag pushed into both
+            // would be emitted TWICE on the task turn — which is not a no-op for repeatable flags like
+            // --upload (it mounts the file twice). Sources go to forwardBoth ONLY; the task builder picks
+            // them up from there.
+            if (spec.critique.turns === "both")
+                forwardBoth.push(...fragment);
+            else
+                forwardTask.push(...fragment);
+        }
         else
             positional.push(a);
     }
     if (positional.length !== 1)
         throw new Error(usage());
+    if (prompt !== undefined && promptFile !== undefined)
+        throw new Error(`--prompt and --prompt-file are mutually exclusive\n${usage()}`);
+    if (promptFile !== undefined) {
+        if (!existsSync(promptFile))
+            throw new Error(`--prompt-file not found: ${promptFile}`);
+        prompt = readFileSync(promptFile, "utf8");
+    }
     if (!prompt || !prompt.trim())
-        throw new Error(`--prompt "<probe>" is required\n${usage()}`);
+        throw new Error(`--prompt "<probe>" or --prompt-file <path> is required\n${usage()}`);
     if (fidelity !== "container")
         throw new Error(`skill-critique is container-tier only (the resume-continuity behavior it relies on is only verified there); got --fidelity ${fidelity}`);
     if (outputFormat !== "json" && outputFormat !== "text")
         throw new Error(`--output-format must be "text" or "json" (got "${outputFormat}")`);
-    return { skillFolder: positional[0], prompt, dotenv, fidelity, evaluatorModel, outputFormat };
+    // Fail fast with critique's OWN clear error (mirroring cli.ts's global --dotenv existence check,
+    // ~line 627) rather than letting an absent file surface later as a generic instrument-failure
+    // diagnostic from the child `skill` invocation's own (differently-worded) rejection.
+    if (dotenv !== undefined && !existsSync(dotenv))
+        throw new Error(`--dotenv file not found: ${dotenv}\n${usage()}`);
+    return { skillFolder: positional[0], prompt, dotenv, fidelity, evaluatorModel, outputFormat, forwardBoth, forwardTask, taskTimeoutMs };
 }
 // F36: a hung reflection (stuck container, network stall, a `claude` process that never returns) must not
 // block the whole discovery command forever, and a spewing/looping child must not grow the buffer
@@ -472,6 +642,53 @@ export function buildJsonReport(state) {
  *  invoked, unexpected throw). Distinct from FINDINGS, which never gate. Matches SPEC's exit 2
  *  (usage/runtime) rather than inventing a new code. */
 const EXIT_INSTRUMENT_FAILURE = 2;
+/** Argv for the GRADED turn. Forwarded fragments come BEFORE critique's pinned flags so a pinned value
+ *  always wins (value flags are last-wins in the skill lane's parser). Exported for unit tests — the
+ *  forwarding invariants are the kind that fail every run when wrong, so they are worth testing without
+ *  paying for a spawn. */
+export function buildTaskTurnArgs(opts, sessionId) {
+    const dotenvArgs = opts.dotenv ? ["--dotenv", opts.dotenv] : [];
+    return [
+        ...dotenvArgs,
+        "skill",
+        opts.skillFolder,
+        opts.prompt,
+        ...opts.forwardBoth,
+        ...opts.forwardTask,
+        "--fidelity",
+        "container",
+        "--session-id",
+        sessionId,
+        "--keep",
+        "--output-format",
+        "json",
+    ];
+}
+/** Argv for the REFLECTION turn — a resume of the same session.
+ *
+ *  Only `forwardBoth` is replayed here, and it MUST be: session sources are part of the origin key, so a
+ *  reflection turn that omits them computes a different identity and the resume throws fail-closed.
+ *  `forwardTask` is deliberately absent — `--decider-dir` in particular requires a fresh empty dir per run
+ *  and would break on turn 2, and gates belong to the graded run, not to critique's own protocol turn. */
+export function buildReflectionTurnArgs(opts, sessionId) {
+    const dotenvArgs = opts.dotenv ? ["--dotenv", opts.dotenv] : [];
+    return [
+        ...dotenvArgs,
+        "skill",
+        opts.skillFolder,
+        REFLECTION_PROMPT,
+        ...opts.forwardBoth,
+        "--session-id",
+        sessionId,
+        "--resume",
+        "--fidelity",
+        "container",
+        "--on-unanswered",
+        "first",
+        "--output-format",
+        "json",
+    ];
+}
 async function main(argv = process.argv.slice(2)) {
     if (argv.includes("--help") || argv.includes("-h")) {
         writeSync(1, usage() + "\n");
@@ -488,23 +705,13 @@ async function main(argv = process.argv.slice(2)) {
         process.exit(2);
         return;
     }
-    const dotenvArgs = opts.dotenv ? ["--dotenv", opts.dotenv] : [];
     const sessionId = `crit-${randomUUID()}`;
     try {
         // 1. Task turn.
-        const task = await runSkillTurn([
-            ...dotenvArgs,
-            "skill",
-            opts.skillFolder,
-            opts.prompt,
-            "--fidelity",
-            "container",
-            "--session-id",
-            sessionId,
-            "--keep",
-            "--output-format",
-            "json",
-        ]);
+        // Stretch critique's own kill-switch past a forwarded --timeout: otherwise a longer budget would be
+        // killed by the INSTRUMENT and misreported as an infra failure rather than a gradeable timeout. The
+        // +60s covers staging and container start — not principled, and a cold image pull can exceed it.
+        const task = await runSkillTurn(buildTaskTurnArgs(opts, sessionId), opts.taskTimeoutMs ? Math.max(TURN_TIMEOUT_MS, opts.taskTimeoutMs + 60_000) : TURN_TIMEOUT_MS);
         const outDir = extractOutDir(task);
         if (!outDir) {
             // F36: surface WHY there's no envelope/status line when it was the bounded spawn itself that gave up.
@@ -552,21 +759,7 @@ async function main(argv = process.argv.slice(2)) {
         // 2. Snapshot the turn-1/turn-2 boundary BEFORE the reflection turn touches anything.
         const boundary = snapshotTurnBoundary(outDir);
         // 3. Reflection turn: resume the SAME session.
-        const reflect = await runSkillTurn([
-            ...dotenvArgs,
-            "skill",
-            opts.skillFolder,
-            REFLECTION_PROMPT,
-            "--session-id",
-            sessionId,
-            "--resume",
-            "--fidelity",
-            "container",
-            "--on-unanswered",
-            "first",
-            "--output-format",
-            "json",
-        ]);
+        const reflect = await runSkillTurn(buildReflectionTurnArgs(opts, sessionId));
         // F37: validate the reflection turn at the PROTOCOL level — exit code, envelope shape, and
         // session/turn continuity (turn>1 AND outDir/sessionId match the task turn's) — BEFORE trusting its
         // `finalMessage` as a self-report or handing anything to the evaluator. A failed reflection (crash, bad

package/dist/critique/package-evidence.js

@@ -1,6 +1,7 @@
-import { readFileSync, readdirSync, existsSync } from "node:fs";
+import { readFileSync, readdirSync, existsSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { readTurn1ResultWithStatus, readTurn1Slice, verifyBoundaryIntegrity } from "./evidence.js";
+import { loadVmPathContext } from "../run/vm-path-ctx-file.js";
 // Assembles the TURN-1-ONLY evidence document a tool-less, one-shot evaluator model is graded against.
 // This packager is a from-scratch, load-bearing build (this instrument's design): a tool-less
 // evaluator can't grep the logs itself, so its recall is bounded by exactly what this function decides to
@@ -50,6 +51,48 @@ function readTurn1Transcript(runDir, boundary) {
         return { text: "", degraded: true };
     }
 }
+/** List of what was ATTACHED to this run — upload filenames + byte sizes, and connected-folder mount names.
+ *  NEVER file content: the evaluator needs to be able to tell "the agent said there was no file, and
+ *  correctly so" apart from "the agent confabulated that", but packaging the bytes themselves would blow
+ *  the package's byte budget and widen the prompt-injection surface the armor exists to contain (see this
+ *  module's header and `armor.ts`'s header) — names and sizes are enough to answer "was anything attached."
+ *
+ *  Source of truth, with fallbacks, in order:
+ *   1. `loadVmPathContext(runDir)` (`run/vm-path-ctx-file.ts`) — the recorded `uploadsHostDir` and
+ *      `folders` map for THIS run. Already never throws (absent/corrupt `mounts.json` -> `null`).
+ *   2. The fixed container layout `<runDir>/work/session/mnt/uploads` (mirrors the derivation in
+ *      `run/display-translate.ts`'s `vmPathContextFromPlan`) — covers runs where `mounts.json` wasn't
+ *      written or couldn't be parsed.
+ *   3. `(none)` — via `sec()`'s empty-body fallback below. Every filesystem read here is try/catch-guarded
+ *      so a missing/unreadable uploads dir degrades gracefully rather than throwing and sinking packaging. */
+function listAttachedInputs(runDir) {
+    const loaded = loadVmPathContext(runDir);
+    const uploadsDir = loaded?.ctx.uploadsHostDir ?? join(runDir, "work", "session", "mnt", "uploads");
+    const folderNames = loaded ? Array.from(loaded.ctx.folders.keys()).sort() : [];
+    const lines = [];
+    try {
+        const uploadNames = readdirSync(uploadsDir, { withFileTypes: true })
+            .filter((e) => e.isFile())
+            .map((e) => e.name)
+            .sort();
+        for (const name of uploadNames) {
+            let sizeNote;
+            try {
+                sizeNote = `${statSync(join(uploadsDir, name)).size} bytes`;
+            }
+            catch {
+                sizeNote = "size unknown";
+            }
+            lines.push(`${name} (${sizeNote})`);
+        }
+    }
+    catch {
+        /* uploads dir absent/unreadable — no uploads to list, not an error */
+    }
+    for (const name of folderNames)
+        lines.push(`${name} (connected folder)`);
+    return lines.join("\n");
+}
 /** Byte-bound a text section, appending a loud (never silent) truncation marker so the evaluator knows the
  *  section was cut rather than reading a suspiciously short document as "that's everything." Cuts on a
  *  UTF-8-safe boundary (Buffer, not string length, so a truncated multi-byte char can't corrupt the tail). */
@@ -91,6 +134,7 @@ const REFERENCES_READ_CAP = 1 * 1024;
 const SKILL_MD_CAP = 16 * 1024;
 const REFERENCE_LIST_CAP = 1 * 1024;
 const TRANSCRIPT_CAP = 16 * 1024;
+const ATTACHED_INPUTS_CAP = 1 * 1024;
 /** The overall package hard cap — the whole assembled document is trimmed to this even if every
  *  per-section budget above was individually respected (their sum is deliberately a bit under this, but a
  *  belt-and-suspenders final trim means a future per-section budget change can never silently blow the
@@ -200,6 +244,7 @@ export function packageEvidence(runDir, boundary, skillDir, isResume = false) {
             turn1ResultDegradedNote, bound(referencesRead.length ? referencesRead.join("\n") : "(none)", REFERENCES_READ_CAP)),
         sec(skillMdSectionTitle, bound(skillMdSectionBody, SKILL_MD_CAP)),
         sec("references/ available (filenames only, NOT content — presence, not coverage)", bound(referenceFiles.length ? referenceFiles.join("\n") : "(none)", REFERENCE_LIST_CAP)),
+        sec("Attached inputs (mnt/uploads filenames + sizes, and connected-folder mount names — NOT content)", bound(listAttachedInputs(runDir), ATTACHED_INPUTS_CAP)),
         sec("Transcript (turn 1 only — the reflection turn's own reads/output are excluded by construction)" +
             (turn1SliceDegraded
                 ? " [DEGRADED: the turn-1/turn-2 boundary for this fallback slice could not be verified — treat gaps as unknown, not as evidence of absence]"

package/dist/run/skill-flag-surface.js

@@ -0,0 +1,117 @@
+// THE source of truth for `cowork-harness skill`'s flag surface, and for what `critique` does with each
+// flag.
+//
+// WHY THIS EXISTS. `critique` runs a skill by spawning two `skill` turns (a task turn, then a `--resume`
+// reflection turn), but its own parser was a hand-rolled SUBSET of `skill`'s flags. That subset drifts
+// silently — a `skill` flag added tomorrow is simply unavailable to `critique`, with nothing failing. This
+// repo has shipped that exact "propagate-minus-one" shape repeatedly, so a design that requires manually
+// mirroring a flag list is wrong even when it is momentarily correct.
+//
+// The fix is structural, in two halves:
+//   1. `critique` field below is REQUIRED, so an entry cannot be added without deciding its disposition.
+//   2. `test/critique-skill-flag-parity.test.ts` extracts the flag literals the `skill` lane actually
+//      accepts and fails if any is missing here — so a NEW skill flag is red CI, not a silent gap.
+//
+// Half 2 is the load-bearing half: the required field only gives totality over entries already present.
+const forwardBoth = () => ({ kind: "forward", turns: "both" });
+const forwardTask = () => ({ kind: "forward", turns: "task" });
+export const SKILL_FLAG_SURFACE = [
+    // ---- session SOURCES — must reach BOTH turns or the resume throws on an origin-key mismatch ----
+    { flag: "--upload", arity: 1, repeatable: true, critique: forwardBoth() },
+    { flag: "--folder", arity: 1, repeatable: true, critique: forwardBoth() },
+    { flag: "--plugin", arity: 1, repeatable: true, critique: forwardBoth() },
+    { flag: "--marketplace", arity: 1, repeatable: true, critique: forwardBoth() },
+    { flag: "--enable", arity: 1, repeatable: true, critique: forwardBoth() },
+    // ---- session shape that both turns must agree on ----
+    // The reflection must run on the SAME model as the task turn: the skill lane rebuilds its inline session
+    // per invocation, so an unforwarded resume would reflect using the DEFAULT model — a self-report from a
+    // different model than the one that did the work.
+    { flag: "--model", arity: 1, critique: forwardBoth() },
+    // Without this a lean-image capability gap makes the task turn error, and the critique harvests a fact
+    // about the rig instead of the skill — the same failure class as a missing upload.
+    { flag: "--allow-missing-capability", arity: 0, critique: forwardBoth() },
+    // ---- the GRADED run only ----
+    // TASK-only deliberately: forwarding to the reflection turn would inject a near-always-green row into the
+    // labelled generation group, inflating passRate and breaking the `runLabel` filter docs/debugging.md
+    // documents as the escape hatch for exactly that dilution. Not in the origin key, so nothing forces both.
+    { flag: "--label", arity: 1, critique: forwardTask() },
+    // Parsed as well as forwarded: critique's own spawn kill-switch is fixed, so a longer --timeout would be
+    // killed by the INSTRUMENT and misreported as an infra failure instead of a gradeable timeout.
+    { flag: "--timeout", arity: 1, critique: forwardTask() },
+    // Makes GATED skills critiquable for the first time: the inner spawn has no TTY, so an unscripted gate
+    // otherwise resolves to `fail` and the task turn dies before anything can be graded.
+    { flag: "--answer", arity: 1, repeatable: true, critique: forwardTask() },
+    { flag: "--answer-policy", arity: 1, critique: forwardTask() },
+    // `prompt` is rejected at parse time — no TTY inside the spawn, so it would resolve differently than the
+    // caller expects. Gates belong to the graded run; the reflection turn stays pinned deterministic.
+    { flag: "--on-unanswered", arity: 1, critique: forwardTask() },
+    { flag: "--decider-llm", arity: 0, critique: forwardTask() },
+    { flag: "--intent", arity: 1, critique: forwardTask() },
+    { flag: "--decider-model", arity: 1, critique: forwardTask() },
+    { flag: "--decider-cmd", arity: 1, critique: forwardTask() },
+    // HARD invariant: the file channel requires a fresh, empty dir per run. Reaching the reflection turn
+    // would break it.
+    { flag: "--decider-dir", arity: 1, critique: forwardTask() },
+    // ---- refused ----
+    {
+        flag: "--session-id",
+        arity: 1,
+        critique: {
+            kind: "reject",
+            reason: "critique mints and manages its own session (the reflection turn IS a resume of it)",
+        },
+    },
+    {
+        flag: "--resume",
+        arity: 0,
+        critique: {
+            kind: "reject",
+            reason: "critique mints and manages its own session (the reflection turn IS a resume of it)",
+        },
+    },
+    ...["--repeat", "--min-pass-rate", "--stop-on-diverge", "--max-budget-usd", "--allow-budget-stop"].map((flag) => ({
+        flag,
+        arity: flag === "--stop-on-diverge" || flag === "--allow-budget-stop" ? 0 : 1,
+        critique: {
+            kind: "reject",
+            reason: "critique is a fixed two-turn protocol — loop `critique` itself and pair generations by fingerprint.skillHash",
+        },
+    })),
+    {
+        flag: "--ablate-skill",
+        arity: 0,
+        critique: { kind: "reject", reason: "grading a skill you removed is incoherent (and ablate+resume is rejected anyway)" },
+    },
+    ...["--quiet", "-q", "--verbose", "--compact", "--demo"].map((flag) => ({
+        flag,
+        arity: 0,
+        critique: {
+            kind: "reject",
+            reason: "critique produces its own report; inner-turn rendering flags have no effect on it",
+        },
+    })),
+    {
+        flag: "--dry-run",
+        arity: 0,
+        critique: { kind: "reject", reason: "there is no meaningful two-turn preview — use `skill --dry-run` directly" },
+    },
+    // ---- critique implements or pins these itself ----
+    { flag: "--prompt-file", arity: 1, critique: { kind: "owned", note: "critique's probe prompt, read from a file" } },
+    { flag: "--fidelity", arity: 1, critique: { kind: "owned", note: "pinned container — resume continuity is verified only there" } },
+    {
+        flag: "--output-format",
+        arity: 1,
+        critique: { kind: "owned", note: "critique's REPORT format; the inner turns always speak json internally" },
+    },
+    { flag: "--keep", arity: 0, critique: { kind: "owned", note: "accepted as a no-op — critique always keeps its runs" } },
+];
+/** Flags `critique` defines that the `skill` lane does not have. Kept separate so the parity guard can
+ *  treat them as legitimately-unknown-to-skill rather than drift. */
+// `--prompt` is here, not in the surface above: the `skill` lane takes its prompt POSITIONALLY
+// (`skill <folder> "<prompt>"`), so there is no `--prompt` flag to have a disposition about. The parity
+// guard caught this modelling error on its first run.
+export const CRITIQUE_ONLY_FLAGS = ["--evaluator-model", "--dotenv", "--prompt"];
+const BY_FLAG = new Map(SKILL_FLAG_SURFACE.map((s) => [s.flag, s]));
+export function lookupSkillFlag(name) {
+    return BY_FLAG.get(name);
+}

package/docs/critique.md

@@ -63,6 +63,83 @@ evidence going into it trustworthy.
 **One naming collision to know about:** `hostloop` in this repo is a **fidelity tier** — where the agent
 process runs. It has nothing to do with loop engineering's "loops".
 
+## Flags
+
+`critique` accepts the `skill` flags that make sense for a graded run, under the **same names** — what you
+know from `skill` transfers. Anything that cannot work is refused with a reason rather than silently
+ignored.
+
+**Probe** (one required)
+
+| Flag | |
+|---|---|
+| `--prompt "<text>"` | the task to run the skill against |
+| `--prompt-file <path>` | read the probe verbatim from a file — for probes containing quotes, `$`, or newlines |
+
+**Files and sources** — forwarded to the graded run. **Required for "analyze this document" skills.**
+
+| Flag | |
+|---|---|
+| `--upload <path>` | mount a file at `mnt/uploads/<name>` (repeatable) |
+| `--folder <dir>` | connect a folder at `mnt/<name>` (repeatable) |
+| `--plugin <dir>`, `--marketplace <dir>` + `--enable <name@mkt>` | extra skill sources |
+
+**Session shape** — both turns must agree on these, so they reach the reflection turn too.
+
+| Flag | |
+|---|---|
+| `--model <id>` | session model for the agent doing the work *and* reflecting |
+| `--allow-missing-capability` | don't fail either turn when the lean image omits a capability |
+
+**Graded-run tuning** — the task turn only; the reflection turn stays pinned deterministic.
+
+| Flag | |
+|---|---|
+| `--timeout <ms>` | wall-clock budget for the task turn (critique's own kill-switch stretches to fit) |
+| `--label <tag>` | generation tag in the run index, for pairing critiques across fixes |
+| `--answer "<q-regex>=<choice>"`, `--answer-policy <yaml>` | pre-answer the skill's gates — **this is what makes gated skills critiquable at all** |
+| `--on-unanswered fail\|first` | unscripted-gate policy (`prompt` is refused — there is no TTY inside) |
+| `--decider-llm` / `--intent` / `--decider-model` / `--decider-cmd` / `--decider-dir` | answer live gates in the graded run |
+
+**Critique's own**
+
+| Flag | |
+|---|---|
+| `--evaluator-model <id>` | the grading model (env: `COWORK_HARNESS_EVALUATOR_MODEL`) |
+| `--output-format json\|text` | critique's *report* format — the inner turns always speak JSON internally |
+| `--fidelity container` | container tier only |
+| `--keep` | accepted as a no-op; runs are always kept |
+| `--dotenv <path>` | credentials — works **before** `critique` (the global form) or **after** it |
+| `--run-dir <path>` | **global, unlike `--dotenv`** — must still PRECEDE the subcommand; a trailing `critique … --run-dir` is rejected |
+
+**Refused, and why**
+
+| Flag | Reason |
+|---|---|
+| `--session-id` / `--resume` | critique mints and manages its own session — the reflection turn *is* a resume of it |
+| `--repeat` + companions | fixed two-turn protocol; loop `critique` itself and pair by `fingerprint.skillHash` |
+| `--ablate-skill` | grading a skill you removed is incoherent |
+| `--quiet`/`-q` / `--verbose` / `--compact` / `--demo` / `--dry-run` | inner-turn rendering or preview — no effect on the report |
+
+**Repeating a flag.** `--upload`, `--folder`, `--plugin`, `--marketplace`, `--enable` and `--answer` accumulate,
+so repeating them is how you pass several. Every other value-taking flag is single-valued and repeating it is
+a **usage error** (exit `2`) rather than a silent last-wins — `--prompt a --prompt b` would otherwise discard
+a probe you typed. Boolean flags may be repeated harmlessly.
+
+### Skills that need an attached file
+
+```bash
+cowork-harness critique ./captable-skill \
+  --prompt "Analyze this cap table and flag anything unusual" \
+  --upload ./acme-captable.xlsx
+```
+
+Both internal turns receive the source flags — they have to, or the reflection turn's resume computes a
+different session identity and fails. The evidence package records **which files were attached** (names and
+sizes), so the evaluator can tell "the agent said there was no file, and correctly so" from a confabulation.
+
+It does **not** record their contents — see Known limitations.
+
 ## Cost and prerequisites
 
 - **Four model workloads per critique**: two container runs (task + reflection) and two evaluator passes.
@@ -109,6 +186,13 @@ Changing the evaluator model invalidates that verification.
 - **SKILL.md is capped at 16KB**; a larger one degrades toward "not adjudicable".
 - **English-only prompts.**
 - The evidence package is not persisted; the report is written to stdout.
+- **Attached-file content usually stays out of the evidence — but that is the common case, not a
+  guarantee.** "Attached inputs" lists names and sizes only, never bytes, and the primary transcript
+  source is assistant prose. But packaging falls back to a raw slice of `events.jsonl` when the archived
+  transcript is missing, and that stream carries full tool results — so if the agent read the attached
+  file, its content can enter the Transcript section (bounded, still armor-fenced) and a content-level
+  citation would resolve. Claims about a document's *contents* are therefore usually NOT ADJUDICABLE, not
+  always.
 - **Citation seams.** Armor inserts a marker line between each section heading and its body. A quote that
   spans that seam *without* including the marker does not resolve and is DROPPED. Quotes wholly inside one
   section are unaffected. **Measured:** on a benign package, 9 findings across 5 live pass-1 runs produced

package/docs/debugging.md

@@ -135,6 +135,9 @@ built on top of the harness before any of it shipped — the commands now replac
 
 ```bash
 SKILL=./my-skill
+# Skill needs an attached input (cap table, deck, transcript)? Add `--upload <path>` / `--folder <dir>`
+# to BOTH step 1 and step 3 — critique forwards them to its own two turns, and step 3 must reproduce
+# with the same inputs the harvest used. See critique.md → "Skills that need an attached file".
 
 # 1. HARVEST — run the skill against a real input and grade what confused the agent.
 #    `critique` runs the task, asks the agent what was unclear, then verifies every claim against a

package/examples/replays/README.md

@@ -16,7 +16,7 @@ DOES exercise a real gate exchange, see `example-multiselect-gate.cassette.json`
 
 Run it with:
 
-> Assumes the `cowork-harness` CLI is available — from a source checkout run `npm ci && npm run build && npm link` first, or `npm i -g "cowork-harness@>=1.5.0"`. (`replay` itself needs nothing else — no token, no Docker.)
+> Assumes the `cowork-harness` CLI is available — from a source checkout run `npm ci && npm run build && npm link` first, or `npm i -g "cowork-harness@>=1.6.0"`. (`replay` itself needs nothing else — no token, no Docker.)
 
 ```sh
 cowork-harness replay examples/replays/example-pdf-skill.cassette.json

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cowork-harness",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "description": "Scriptable, CI-friendly harness for Claude Cowork's runtime contract for testing skills across scenarios \u2014 same agent, mounts, egress allowlist, permission protocol, and sandbox limitations.",
   "license": "MIT",
   "type": "module",