cowork-harness 1.6.0 → 1.7.0

package/.claude/skills/cowork-harness/SKILL.md

@@ -3,8 +3,8 @@ name: cowork-harness
 description: Test or debug a Claude Code skill/plugin under Claude Cowork's runtime — sandboxed agent, default-deny egress, the can_use_tool permission/question protocol — using the cowork-harness CLI. Use when validating or regression-testing a skill, authoring or debugging a scenario YAML (prompt + scripted answers + assert:), choosing a fidelity tier, scripting AskUserQuestion / tool-permission answers, or asserting artifacts, egress, or sub-agent dispatch. Especially when a harness run no-ops an assertion, fails on an unanswered gate, false-greens, a steered answer never reaches the model, or a web_fetch is unexpectedly denied or gated. Also when iterating or hardening a skill across fixes, or grounding a skill's self-critique against its own run evidence — including a document-analysis skill (cap table, deck, financial model, transcript) that needs an uploaded file attached to be critiqued at all. NOT for generic unit testing (pytest/vitest of your own scripts) or non-Cowork CI. Covers the skill / run / chat / record / replay / trace / decide / assertions / scaffold commands and the session-vs-scenario split.
 metadata:
   author: cowork-harness
-  version: 1.6.0
-  tracks-harness: cowork-harness 1.6.0 (baseline desktop-1.22209.3)
+  version: 1.7.0
+  tracks-harness: cowork-harness 1.7.0 (baseline desktop-1.24012.1)
 ---
 
 # cowork-harness
@@ -22,8 +22,8 @@ flagged with a loud `::warning::`, not silent — auto-answer a gate, observe an
 allowlist). This skill exists mostly to keep you out of those traps — the Gotchas section below is
 the highest-value part. Read it.
 
-> **Version note:** the facts and `file:line` pointers here track `cowork-harness 1.6.0` (baseline
-> `desktop-1.22209.3`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
+> **Version note:** the facts and `file:line` pointers here track `cowork-harness 1.7.0` (baseline
+> `desktop-1.24012.1`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
 > `SPEC.md` / `docs/*.md` over this snapshot, and re-run the bundled linter.
 
 ## Preflight — make sure the harness can actually run
@@ -39,9 +39,30 @@ Before the first command, confirm the CLI is reachable and **fail loud** (never
 
 - **One-shot check.** Run `cowork-harness doctor [--tier <tier>]` first — a read-only prerequisite check that inspects Docker, the staged agent, the token, and the baseline in one pass. The bullets below explain each thing it checks (and how to fix it).
 - **Replay-only? Skip `doctor`.** Replaying committed cassettes needs no Docker, no staged agent, and no token — and every tier's `doctor` validates the auth token (the live tiers also Docker + the staged agent), so a ✗ there is expected, not a blocker. Go straight to `cowork-harness replay <cassette>`.
-- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 1.6.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@>=1.6.0" <cmd>` (Node ≥ 20), or install once with `npm i -g "cowork-harness@>=1.6.0"`. **Pin `@>=1.6.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
-
-  What the ≥ 1.6.0 floor gates, by release:
+- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 1.7.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@>=1.7.0" <cmd>` (Node ≥ 20), or install once with `npm i -g "cowork-harness@>=1.7.0"`. **Pin `@>=1.7.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
+
+  What the ≥ 1.7.0 floor gates, by release:
+
+  - **1.7.0 (per-turn run-directory layout, single shape):** every run dir — `run`/`skill`/`chat`,
+    single-turn or multi-turn (any `--session-id` + `--resume`, and **every `critique`**: task turn +
+    reflection turn) — writes each turn's `result.json` / `run.jsonl` / `trace.json` / `resources.jsonl`
+    into **`turns/<N>/`**, written once and never renamed. **There is no root compat copy of anything —
+    `<run-dir>/result.json` does not exist.** **When a user asks about a run, point them at
+    `turns/1/result.json`** (the only completion on a single-turn dir) — or on a `critique` dir, better yet
+    at `result.graded.json` / `trace.graded.json`, the role-stable aliases `critique` writes (the graded
+    task turn, never the reflection one). `events.jsonl` / `timeline.jsonl` stay cumulative at the run-dir
+    root, always. A dir written before this layout existed is refused LOUD, by name, naming the shape found
+    — never silently misread as if it were `turns/1/`. **Convert it in place with
+    `cowork-harness migrate-run-dir` (dry-run by default); do NOT tell the user to re-run or re-record,
+    which throws away history the migrator recovers.** Its `events.jsonl` still fully supports `trace`,
+    which is why every refusal points there. `verify-run` REFUSES a multi-turn dir rather than certifying
+    the wrong turn, and `trace` shows the latest turn with a `::notice::` when earlier turns exist.
+
+  - **1.7.0 (limitation provenance):** every `critique` limitation in `critique --help` and
+    docs/critique.md is tagged with WHY it exists — `[structural]` (permanent), `[unverified]` (unproven,
+    **not** known-impossible), `[deliberate]`, `[not-built]`. **Read the tag before telling a user to
+    design around a limitation.** In particular `critique`'s container-tier pin is `[unverified]`, not
+    permanent: do not advise building a second hostloop test lane on the assumption it can never lift.
 
   - **1.6.0 (`critique`'s skill-flag parity):** `critique` accepts most `skill` flags under the same names,
     which is what makes a document-analysis skill (cap table, deck, financial model, transcript)
@@ -81,7 +102,7 @@ Before the first command, confirm the CLI is reachable and **fail loud** (never
 - **Agent binary (sandboxed live tiers — `container`/`microvm`/`hostloop`/`cowork`).** The staged Claude Code agent is **bind-mounted** from a local Claude Desktop install, or point `COWORK_AGENT_BINARY` at a `claude-code-vm/<ver>/claude` ELF. Nothing is bundled. `protocol` (L0) and `replay` need no staged agent; for the sandboxed tiers, no agent → no run; report that, don't skip silently.
 - **Docker / Lima.** Only `--fidelity protocol` (L0) runs without them. `container` / `microvm` / `hostloop` / `cowork` need Docker (Lima for L2). If they're absent, drop to `--fidelity protocol` and **say so** — a green that never exercised the sandbox is not a sandbox pass.
 - **Auth.** `CLAUDE_CODE_OAUTH_TOKEN` (preferred), or `ANTHROPIC_API_KEY` / `ANTHROPIC_AUTH_TOKEN`, via env or `.env`. Minting an OAuth token needs the **`claude` CLI** (`npm i -g @anthropic-ai/claude-code`, then `claude setup-token`).
-- **`--dotenv` is a GLOBAL flag — put it BEFORE the subcommand.** `cowork-harness --dotenv .env record …`, never `cowork-harness record … --dotenv .env`. Every *other* flag is subcommand-level, so muscle memory fights this one; the harness rejects the misplaced form with an exact-fix error, but placing it first avoids the round-trip. **One exception: `critique` also accepts `--dotenv` per-command** (`critique <folder> --prompt "…" --dotenv <path>`) — UNRELEASED, see the floor list; `--run-dir` stays global-only everywhere.
+- **`--dotenv` is a GLOBAL flag — put it BEFORE the subcommand.** `cowork-harness --dotenv .env record …`, never `cowork-harness record … --dotenv .env`. Every *other* flag is subcommand-level, so muscle memory fights this one; the harness rejects the misplaced form with an exact-fix error, but placing it first avoids the round-trip. **One exception: `critique` also accepts `--dotenv` per-command** (`critique <folder> --prompt "…" --dotenv <path>`) — available as of **1.6.0** (documented but unreachable before then); `--run-dir` stays global-only everywhere.
 
 ## Orient — the three loops
 
@@ -113,7 +134,7 @@ reproducible regression (Part II), and **debug** a run that misbehaved or greene
 > `node_modules/cowork-harness/docs/<name>.md` before assuming a pointer dangles. A **plugin**
 > install loads a trimmed source-only cache where those pointers genuinely do dangle.
 
-Full command set: `skill · run · chat · record · replay · verify-cassettes · rehash · prune · lint ·
+Full command set: `skill · run · chat · record · replay · verify-cassettes · rehash · prune · migrate-run-dir · lint ·
 lint-skill · analyze-skill · probe-dispatch ·
 verify-run · trace · inspect · diff · critique · stats · decide · gates · answer · scaffold · assertions --list · sync ·
 list · boundary-check · status · vm <init|status|delete|prune> · doctor · init-redact`. Always check `cowork-harness <cmd> --help`.
@@ -155,7 +176,7 @@ the folder basename (collision-resolved); there is no `to:` override. See `refer
 > is your **working tree**, so an uncommitted edit to an already-tracked file *is* tested — you needn't
 > commit to iterate. Only brand-new (untracked) files must be `git add`-ed to appear. Commit before you
 > record the **locking cassette**, though: real Cowork ships the *committed* tree, so a green on
-> uncommitted edits isn't yet a green on what installs. An **all-untracked** skill folder used to mount *empty* and the agent reported "the skill isn't
+> uncommitted edits isn't yet a green on what installs. An **all-untracked** skill folder mounts *empty* and the agent reports "the skill isn't
 > installed" then did the work itself — a green-looking run where the skill never loaded. That now
 > **hard-fails** (`BoundaryError`, exit 3) naming the dir, and a partially-tracked folder emits a loud
 > `::notice:: [stage]` listing the excluded files. Fix: `git add` the skill, or `COWORK_HARNESS_GITSET=0`
@@ -372,7 +393,7 @@ cassette — has its own recipe:
    "<q>=Israeli company"` binds whichever option starts with `Israeli company`. It is uniqueness-guarded and
    **fails loud** if the anchor ever matches two options (the documented trade: drift-tolerance, not strict
    CI reproducibility — for that, pin a full exact label or a free-text `answer:`).
-3. **Budget ~1 re-run per file.** If a gate whiffs, the run no longer vanishes — it exits non-zero but
+3. **Budget ~1 re-run per file.** If a gate whiffs, the run does not vanish — it exits non-zero but
    **salvages a PARTIAL run** (the extraction the agent already did is written to disk). So the cost of a
    missed gate is one re-run with a better `--intent` or a scripted answer, not a lost paid run.
 4. **Inspect the outputs to judge correctness.** `cowork-harness inspect <run-dir>` shows what the run
@@ -435,6 +456,14 @@ Recognize these before "fixing" a non-bug:
   `transcript_no_host_path`. At `fidelity: cowork` the skip follows the **resolved** tier, so a `cowork`
   run that lands on `container` is armed. Author `transcript_no_host_path` to enforce cleanliness where
   it's valid.
+- **`exec_infra_error`** (`WARN`, host-loop) — one or more container `exec` calls failed for
+  infrastructure reasons (daemon/container-level), so those tool calls returned an error to the agent
+  rather than the command's own output. Warn-severity because the run's other evidence is intact — unlike
+  the fail-severity `infra_error`, where a **supervising process** died and contaminated everything. Note
+  a model-requested `timeout_ms` expiry is *not* this: it returns the command's partial output with
+  `Command timed out after <duration>` in stderr, matching production. Known gap: if **every** exec
+  failed, the agent ran nothing yet the run still only warns — read `result.infraErrors` when a run looks
+  suspiciously empty.
 - **`scan_unavailable`** (`WARN`) — emitted only on the live lane: `events.jsonl` was missing/corrupt, so
   `RunResult.scan` is undefined and the host-path + outputs-delete guards **did not run this run**. Not a
   pass or a defect — assert `no_delete_in_outputs` / `transcript_no_host_path` to hard-fail on it instead.
@@ -638,12 +667,14 @@ repeats the assertion/replay-relevant ones alongside the schema (a scoped subset
    `mcp__workspace__bash` alias, so a "sub-agent used no shell" check must glob **both** `Bash` and
    `mcp__workspace__*` to hold across every tier.
 
-6. **`dispatch_count_max` is an author-chosen budget, not a production cap.** It's a post-hoc count
-   assertion: passing means "happened to dispatch ≤N this run," nothing more. Cowork imposes **no**
-   in-conversation `Task`-dispatch cap — gate `1648655587`'s `{perTask:1, global:3}` governs the
-   separate scheduled/cron-task session scheduler, not the `Task` tool (binary-verified; details in
-   `SPEC.md` §10 — repo-only). So there is no "skip-on-cap" for the harness to reproduce; use this key
-   only to catch a fan-out you don't want.
+6. **`dispatch_count_max` is your author-chosen budget UNDER Cowork's production cap, not a
+   reproduction of it.** It's a post-hoc count assertion: passing means "happened to dispatch ≤N this
+   run." Cowork DOES cap `Task` fan-out **agent-side** (`taskRegistry`: concurrent **20** /
+   per-session **200**, landed 2.1.212/2.1.217) — SEPARATE from the scheduled-task session limiter
+   (gate `1648655587`'s `{perTask:1, global:3}`, a different mechanism; binary-verified, `SPEC.md` §10
+   — repo-only). The harness **inherits** the production cap by spawning the real agent binary, so a
+   `dispatch_count_max` pass means "your tighter budget held," not "near a real limit"; use it to catch
+   a fan-out you don't want.
 
 7. **`protocol` is rejected (not silently passed) if the scenario asserts egress** — boundary
    assertions need a sandboxed tier (`container`+). Good: this one fails loud by design.
@@ -727,7 +758,7 @@ repeats the assertion/replay-relevant ones alongside the schema (a scoped subset
 
 17. **Editing `scenarios/*.yaml` `assert:` does NOT change a plain `replay`.** *Why:* `replay` evaluates the
     assertions **frozen in the cassette** by default — it is byte-deterministic and ignores the working tree (so
-    a committed cassette can't silently re-interpret against an uncommitted YAML). This used to be a *silent*
+    a committed cassette can't silently re-interpret against an uncommitted YAML). This is *loud* rather than a *silent*
     no-op; now plain `replay` prints a `::notice::` when a sibling's `assert:` differs and points you at the fix.
     *Fix:* to re-check token-free against the edited block, `replay --assert-from <scenario.yaml>` (or
     `--reassert`). That opt-in path is safe by construction for the authored fields — it **hard-fails** if

package/.claude/skills/cowork-harness/references/ci-recipe.md

@@ -1,6 +1,6 @@
 # CI recipe — replay vs live lanes
 
-Self-contained reference. Tracks `cowork-harness 1.6.0` (baseline `desktop-1.20186.1`).
+Self-contained reference. Tracks `cowork-harness 1.7.0` (baseline `desktop-1.20186.1`).
 
 **Fastest path: the packaged Action.** One step gets you `replay`/`lint`/`verify-cassettes` plus a PR
 job-summary reporter (verdict table, staleness findings, cost/turns when available):
@@ -13,7 +13,7 @@ job-summary reporter (verdict table, staleness findings, cost/turns when availab
 ```
 
 The Action's `version` input defaults to `latest` — intentional so a copy-pasted recipe tracks the current
-release; pin an exact version (e.g. `version: "1.6.0"`) for reproducible CI.
+release; pin an exact version (e.g. `version: "1.7.0"`) for reproducible CI.
 
 Reach for the manual multi-step form below only when you need per-step control the Action's inputs don't
 cover (a custom flag combination, a different runner matrix per step, or `lint`/`verify-cassettes` gated
@@ -32,7 +32,7 @@ jobs:
       - uses: actions/checkout@v4
       - name: Stage the agent binary (official channel, sha256-verified — see docs/maintenance.md)
         run: |
-          V=2.1.215   # match your scenario's pinned baseline's agentVersion
+          V=2.1.217   # match your scenario's pinned baseline's agentVersion
           curl -fSL "https://downloads.claude.ai/claude-code-releases/$V/linux-arm64/claude" -o "$RUNNER_TEMP/claude-$V"
           chmod +x "$RUNNER_TEMP/claude-$V"
           # verify against the committed baseline's sha256 (baselines/desktop-*.json → agentBinary.sha256)
@@ -57,7 +57,7 @@ sha256-*checked* but not hard-blocking on mismatch — it's advisory for an inte
 GitHub-hosted runners, no token/Docker/agent:
 
 ```yaml
-- run: npm i -g "cowork-harness@>=1.6.0"
+- run: npm i -g "cowork-harness@>=1.7.0"
 - run: cowork-harness lint scenarios/*.yaml          # no silent false-greens
 - run: cowork-harness verify-cassettes cassettes/    # privacy + staleness
 - run: cowork-harness replay cassettes/              # token-free content/structure
@@ -197,7 +197,7 @@ jobs:
         with: { node-version: '20' }
       - uses: actions/setup-python@v5
         with: { python-version: '3.x' }                                       # python3 only — PyYAML is bundled with the linter
-      - run: npm i -g "cowork-harness@>=1.6.0"
+      - run: npm i -g "cowork-harness@>=1.7.0"
       - run: cowork-harness lint scenarios/*.yaml                              # no-silent-false-green (needs python3; PyYAML bundled)
       - run: cowork-harness verify-cassettes cassettes/ --output-format json   # privacy + staleness gate
       - run: cowork-harness replay cassettes/ --output-format json             # token-free content/structure
@@ -226,7 +226,7 @@ jobs:
             echo "live=true" >> "$GITHUB_OUTPUT"
           fi
       - if: steps.guard.outputs.live == 'true'
-        run: npm i -g "cowork-harness@>=1.6.0"
+        run: npm i -g "cowork-harness@>=1.7.0"
       - if: steps.guard.outputs.live == 'true'
         run: cowork-harness run scenarios/ --output-format json
         env:
@@ -263,8 +263,9 @@ JSON, not the human-readable text (which is explicitly NOT stable).
 
 A run writes to `~/.cowork-harness/runs/<name>/<sessionId>/` by default — outside any working tree. In CI,
 set `COWORK_HARNESS_RUNS_DIR` (or pass `--run-dir`) to a workspace-relative path (e.g. `runs`) so an
-artifact-upload step can collect them. Each run dir holds `events.jsonl`, `control-out.jsonl`, `run.jsonl`,
-`trace.json`, `egress.log`, `result.json`. Digest one with `cowork-harness trace <run-id | dir>`.
+artifact-upload step can collect them. Each run dir holds `events.jsonl`, `control-out.jsonl` and
+`egress.log` at the root, plus each turn's `run.jsonl` / `trace.json` / `result.json` under `turns/<N>/`
+(a single-turn run has just `turns/1/`; there is no root compat copy of any of these). Digest one with `cowork-harness trace <run-id | dir>`.
 Secrets are scrubbed from every persisted log by value.
 
 ## Don't assume a fixed assertion count across lanes
@@ -293,7 +294,7 @@ does **not** imply the recording is still valid. Each replay result carries `sta
 (A pre-`effectiveFidelity` cassette with an **explicit** tier is statically knowable — it passes the tier
 check with a non-failing informational note in the `verify-cassettes` envelope's per-file `notes[]`, a
 `·`-prefixed row in text output. On `verify-cassettes` every staleness *finding* above still fails the
-gate (`ok:false`) — but it's no longer class-blind on the EXIT CODE: a `baseline`/`skill`/`shared-root`/
+gate (`ok:false`) — but it is class-AWARE on the EXIT CODE: a `baseline`/`skill`/`shared-root`/
 `format`/`resolved-tier` class lands in the envelope's `staleness[]` (verified & failed — exit `1`),
 while an `unverifiable-*` class lands in `unverifiable[]` (could not verify — exit `3`). Notes never
 fail it either way.)

package/.claude/skills/cowork-harness/references/fidelity-and-answers.md

@@ -1,6 +1,6 @@
 # Fidelity tiers & answer paths
 
-Self-contained reference. Tracks `cowork-harness 1.6.0` (baseline `desktop-1.20186.1`).
+Self-contained reference. Tracks `cowork-harness 1.7.0` (baseline `desktop-1.20186.1`).
 
 ## Fidelity tiers (`fidelity:` in the scenario)
 
@@ -122,7 +122,7 @@ hands `fn` exactly this dict.
 
 - On `skill`: `fail | prompt | first`.
 - On `run`: `fail | first` (`prompt` rejected — it would break determinism).
-- On `critique` (UNRELEASED): `fail | first` (`prompt` rejected — there is no TTY inside the spawned turn).
+- On `critique`: `fail | first` (`prompt` rejected — there is no TTY inside the spawned turn).
 - **`llm` is NOT an `--on-unanswered` value.** The bare flag `--on-unanswered llm` is rejected; use
   `--decider-llm` (CLI) or `on_unanswered: llm` (YAML).
 - `agent` is **retired** — `on_unanswered: agent` is rejected by the schema. The enum is

package/.claude/skills/cowork-harness/references/scenario-schema.md

@@ -1,6 +1,6 @@
 # Scenario & session schema, assertion catalog, web_fetch, full gotchas
 
-Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 1.6.0`
+Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 1.7.0`
 (baseline `desktop-1.20186.1`). If your checkout is newer, prefer the live `docs/scenario.md`,
 `docs/session.md`, and `SPEC.md`.
 
@@ -269,7 +269,7 @@ same set live from the schema.
 | `subagent_dispatched: <regex>` | a sub-agent whose `dispatchAgentType`, binary-*resolved* `resolvedAgentType`, **or dispatch description** matches |
 | `subagent_declared_but_unused: <Tool>` | a sub-agent declared the tool but never used **that** tool (even if it used others) |
 | `subagent_output_contains: {match?, contains}` | a dispatched sub-agent's own output contains the substring `contains` — `match` (optional regex over `dispatchAgentType`/`resolvedAgentType`/`description`) narrows to specific dispatch(es); omitted, checks whether ANY dispatch's output contains it (existence check, not "all"); a miss against an output that was **truncated at the assert cap** reports evidence-unavailable instead of a proven absence — the substring could lie past the cut |
-| `dispatch_count_max: <N>` | at most N sub-agents dispatched — an author-chosen budget (Cowork imposes no in-conversation Task-dispatch cap; records only, enforces nothing — see gotcha 12) |
+| `dispatch_count_max: <N>` | at most N sub-agents dispatched — your author-chosen budget under Cowork's agent-side fan-out cap (concurrent 20 / per-session 200, inherited by the harness); records only, does not itself enforce — see gotcha 12 |
 | `skill_triggered: <regex>` | a skill matching the regex (invoked id, e.g. `"plugin:skill"`) was invoked via the `Skill` tool — evidence-unavailable (not a normal fail) if the agent's init tools have no `Skill` tool |
 | `no_skill_triggered: <regex>` | no invoked skill id matched — the negative-control / description-collision catcher; evidence-unavailable (never a vacuous pass) if invocation data is absent or the `Skill` tool is unobservable |
 | `skill_available: <regex>` | a staged skill's id matched the regex (offered, not necessarily invoked — see `skill_triggered` for invocation) — content-class: the id list comes from the agent's init `skills` listing, so it replays from the frozen init event (id-only; the `whenToUse` enrichment is live-disk and thus absent on replay, but the id is what's matched); evidence-unavailable only if `RunResult.context.availableSkills` is absent entirely (an older cassette recorded before the available-skills listing was captured) |
@@ -348,16 +348,17 @@ codes (`VerdictSignal["code"]` in `src/run/verdict.ts`):
 | `host_path_leak` | fail | A host path leaked into model-visible text (opt out: author `transcript_no_host_path`) |
 | `l0_plugin_divergence` | fail | L0/protocol plugin loading diverged from Cowork (opt out: `allow_l0_plugin_divergence`) |
 | `missing_capability` | fail | A `requires_capabilities` need was unmet, or the skill used a capability the image omits (opt out: `allow_missing_capability`, or `skill --allow-missing-capability` on an open-ended run) |
-| `infra_error` | fail | A VM/egress sidecar crashed mid-run — not author-suppressible |
+| `infra_error` | fail | A supervising process died mid-run (VM/egress sidecar) — the run's evidence is contaminated, not author-suppressible |
 | `stalled` | fail | The run ended on an unanswered question, or on a trailing-`?` final turn with no tool work after the last gate (opt out: `allow_stall`) |
 | `non_deterministic` | warn | The run was LLM/external/human-decided — not reproducible |
 | `prompt_asset_missing` | warn | The run proceeded with a missing prompt asset (`COWORK_HARNESS_ALLOW_MISSING_PROMPT=1`); fidelity is degraded |
 | `scan_unavailable` | warn | Post-run scan evidence unavailable (`RunResult.scan` undefined) — the host-path and outputs-delete guards did not run this run |
 | `ended_with_question` | warn | Live-lane heuristic: the final answer contains a question and the run wrote no deliverable to `outputs/` — the lenient sibling of `stalled` (covers a mid-message `?`, or tool work after the last gate that still ended asking). Opt out: `allow_stall` |
+| `exec_infra_error` | warn | Host-loop: one or more container `exec` calls failed for infrastructure reasons, so those tool calls returned an error to the agent. Warns rather than fails because the run's other evidence is intact — unlike `infra_error`, where a dead supervisor contaminates everything. Caveat: if *every* exec failed, the agent ran nothing and this still only warns — check `result.infraErrors` |
 
 A **fail**-severity signal does not change `result.result` (still `"success"`), but it DOES fail the
 overall run verdict and exit code — `assert result: success` alone won't catch it; check
-`result.verdict.signals[].severity` or the run's exit code. Only the four **warn** codes are truly benign.
+`result.verdict.signals[].severity` or the run's exit code. Only the five **warn** codes are truly benign.
 
 ## Replay class
 
@@ -417,7 +418,7 @@ skill-source drift; every replay result also reports it class-tagged in `stalene
 **Mixed assertions on replay:** before evaluating, `replay` strips each assertion to its replay-checkable
 keys and drops any left empty. So `{result, egress_denied}` evaluates on replay as `{result}` alone — its
 `egress_denied` half is removed (not AND-ed against an unreadable value); with a manifest, `file_exists`/
-`artifact_json` are no longer stripped. The harness is **loud in two classes**: a *full skip* (`::warning::`
+`artifact_json` are not stripped. The harness is **loud in two classes**: a *full skip* (`::warning::`
 with the count of pure live-only assertions not evaluated) and a *partial skip* (`::warning::` when a mixed
 assertion's live-only half was dropped).
 Two CI consequences: skipped assertions are **absent** from `results[].assertions[]` (not
@@ -529,11 +530,12 @@ reference omits). Neither list is a strict superset of the other — reach for t
 11. **`subagent_declared_but_unused` fires on declared-but-didn't-use-THAT-tool**, even if the
     sub-agent used other tools.
 
-12. **`dispatch_count_max` is an author-chosen budget, not a production cap.** It records the count
-    and asserts on it; passing means "dispatched ≤N this run," not "the harness capped it." Cowork
-    imposes no in-conversation Task-dispatch cap to reproduce — gate `1648655587`'s
-    `{perTask:1, global:3}` is the scheduled/cron-task session limiter, a different mechanism
-    (binary-verified; SPEC §10).
+12. **`dispatch_count_max` is your author-chosen budget under Cowork's production cap, not a
+    reproduction of it.** It records the count and asserts on it; passing means "dispatched ≤N this
+    run," not "the harness capped it." Cowork DOES cap `Task` fan-out agent-side (`taskRegistry`:
+    concurrent 20 / per-session 200, landed 2.1.212/2.1.217), which the harness inherits by spawning the
+    real agent binary — SEPARATE from gate `1648655587`'s `{perTask:1, global:3}` scheduled/cron-task
+    session limiter, a different mechanism (binary-verified; SPEC §10).
 
 13. **`protocol` is rejected (not silently passed) if the scenario asserts egress** — boundary
     assertions need `container`+. Fails loud by design.

package/.claude/skills/cowork-harness/references/task-recipes.md

@@ -182,7 +182,7 @@ Hardening a skill is a loop: run → read what it did → fix → run again. Two
    (blinded evaluator + mechanical citation checking). **Critiquing a document-analysis skill?** The probe
    attaches nothing on its own — pass `--upload <path>` (repeatable) or `--folder <dir>` exactly as you
    would to `skill`, or the graded run has no file and "there was no file attached" is the correct finding,
-   not a skill defect. Source flags reach both spawned turns automatically. UNRELEASED — see SKILL.md's
+   not a skill defect. Source flags reach both spawned turns automatically — see SKILL.md's
    floor list. See docs/critique.md for the full flag table, cost and limits. If you
    prefer to build your own grader, the substrate is still here:
    - `result.json` → `finalMessage` (the skill's own answer/critique) + `toolResults[]` (tool outputs).

package/CHANGELOG.md

@@ -6,6 +6,256 @@ All notable changes to this project are documented here. The format is based on
 
 ## [Unreleased]
 
+## [1.7.0] — 2026-07-22
+
+### Added
+
+- **`migrate-run-dir` — convert pre-layout run dirs to the per-turn `turns/<N>/` layout, in place.**
+  A run dir written before the per-turn layout keeps `result.json` / `run.jsonl` / `trace.json` /
+  `resources.jsonl` at its root. Once the legacy read layer is removed, those dirs become unreadable to
+  `verify-run` / `diff` / `inspect` / `stats`; this command converts them so the history survives the
+  change instead of having to be re-run.
+
+  **Dry-run by default** — `--write` applies, and `--scenario <name>` scopes the run to a single
+  scenario so a rollout can be staged: migrate one, verify it, then do the rest. It renames rather than copies, so file mtimes (the recency
+  signal `stats` and `status --latest-for` rank by) survive untouched, and it restores directory mtimes
+  afterwards. An interrupted run records a journal outside the run dir and is finished by re-running the
+  command. Anything it cannot resolve unambiguously — a root artifact that is neither a duplicate nor
+  placeable, telemetry whose turn boundary cannot be dated or that spans more than two turns or whose
+  samples would land in a turn no transcript or result evidences, a dir with
+  no transcript at all — is **refused and named**. The one inference it makes is positional: an EMPTY file
+  has no content to attribute, so it follows its position to an EVIDENCED turn (its own, by name or by
+  rootArtifactTurn when a root transcript or result exists to move there) — never one it would mint. The
+  same never-mint rule holds on the content path: a stray `resources.turn-N.jsonl` cannot manufacture
+  `turns/N/` whether it is empty or carries samples, and a fully-archived dir's trailing telemetry cannot
+  manufacture the next turn out of arithmetic alone. Exit `1` when anything was refused, so a CI caller sees unfinished work.
+  After a `--write` that migrated or recovered anything, it prints a reminder to rebuild the index
+  (`cowork-harness stats --reindex`), since the index keys a row's timestamp off `result.json`'s mtime and
+  the files have moved.
+
+- **`prune` skips scenarios with a migration in flight.** Between an interrupted migration and its
+  recovery a run dir's mtime reflects the migration, not the run — and `prune` ranks keep-slots by that
+  mtime, so it could evict a newer run in favour of a half-migrated older one. It now defers those
+  scenarios and says so.
+
+- **`critique` surfaces the GRADED turn's `outcome` and `skillHash` in its own report**
+  (`gradedOutcome` / `gradedSkillHash` in JSON, and in the text header), and writes the graded result
+  under the stable name **`result.graded.json`**. `critique` runs two turns into one run directory, so
+  after the resume `result.json` is the *reflection* turn's and the graded turn is archived as
+  `result.turn-1.json` — the correct file to read was the *lower* number, the opposite of every other
+  multi-run convention. A harvester reading `result.json` silently ingested the reflection turn's numbers:
+  valid-looking, wrong, and unsignalled. Reported by a consumer building exactly that harvester; a
+  documentation-only fix would have helped only readers who already knew to look.
+
+- **`exec_infra_error` verdict signal (`WARN`)** — a container `exec` that failed for infrastructure
+  reasons, as distinct from the fail-severity `infra_error` (a supervising process died). One failed
+  command no longer contaminates a whole run's evidence.
+- **`RunResult.infraErrors[].source` is now an enum** — `hostloop-sidecar` / `hostloop-exec` /
+  `egress-sidecar`. The origin is what drives severity, and it is carried through the frozen cassette so
+  replay reaches the same verdict as the live run.
+- **Capability use-scan health** — an unreadable or partially unparseable `events.jsonl` is now reported
+  as a degraded scan instead of being indistinguishable from a complete scan that found nothing.
+
+- **Every `critique` limitation is now tagged with WHY it exists**, not just what it is — `structural`
+  (permanent, architect around it), `unverified` (unproven, **not** known-impossible), `deliberate` (a
+  design choice), `not-built` (simply absent). The distinction a reader needs is rarely "what can't it
+  do" but "should I design around this forever, or wait for it?" **Container-tier-only is `unverified`**:
+  the resume-continuity proof was run against the container tier's Linux ELF, and hostloop runs a
+  different (native) agent binary, so the proof does not transfer — nothing suggests hostloop would fail,
+  nobody has run it. **Lifting the pin needs BOTH** a live resume-continuity proof at hostloop against its
+  native binary AND the follow-on work that proof unblocks (unpinning three hard-coded container sites,
+  stamping the tier on the session manifest so a cross-tier resume fails loud, and plumbing host-write
+  consent) — evidence alone is not sufficient. A consumer read that pin as permanent and built a second
+  test lane around it. The tags appear in `critique --help` and [docs/critique.md](./docs/critique.md),
+  generated from one source.
+- **`critique --help`'s KNOWN LIMITATIONS block is generated** from that source, and CI asserts the
+  shipped binary's output, the docs bullets, and their tags all agree.
+
+### Changed
+
+- ⚠️ **BREAKING: per-turn run-directory layout, single shape — the root-level `result.json` compatibility
+  copy is REMOVED.** A run directory that holds several turns (any `--resume`, and every `critique`) writes
+  each turn's `result.json`, `run.jsonl`, `trace.json` and `resources.jsonl` into **`turns/<N>/`**, once,
+  under its final name — nothing is renamed or overwritten as later turns arrive. `chat` now goes through
+  the same layout too (always `turns/1/` — a `chat` session mints a fresh dir per invocation and never
+  resumes). **`<outDir>/result.json` no longer exists — there is no root compat copy of any per-turn
+  artifact, on ANY run dir.** Read `turns/<N>/result.json` directly (`turns/1/` for a single-turn run), or
+  — for `critique` — the unchanged `result.graded.json` / `trace.graded.json` role aliases. Cumulative
+  streams (`events.jsonl`, `timeline.jsonl`) and session state are unchanged, so `critique`'s byte-offset
+  turn-isolation proof and cassette capture are unaffected.
+
+  **Two prior shapes are now REFUSED, loudly, by name, instead of being silently misread:**
+  - a **pre-layout** run dir (written before `turns/<N>/` existed: root `result.json`/`run.jsonl`, or a
+    name-mangled `result.turn-<N>.json` archive, no `turns/`);
+  - a **mixed** run dir (a pre-layout dir resumed under CURRENT code before this release — `turns/` present
+    *and* a stray root/archived file).
+
+  `verify-run`, `inspect`, `scaffold`, `diff`, `status --latest-for`, and a resumed `--session-id` all
+  refuse these with a message naming the shape found and pointing at `trace <dir>` — which still works
+  fully, since every one of its views derives from `events.jsonl`, which never moves. `stats --reindex`
+  counts them as skipped and names the remedy rather than dropping them from the index quietly.
+
+  **Migration: `cowork-harness migrate-run-dir`** converts a pre-layout dir in place (dry-run by default),
+  preserving the file timestamps `stats` and `status --latest-for` rank by. `diff` and
+  `status --latest-for` are called out because their pre-refusal behaviour was the dangerous kind: `diff`
+  reported two genuinely different runs as `identical` and exited 0, and `status --latest-for` could
+  select a *different* run than the newest and report its verdict — a CI script reading `.verdict.pass`
+  got a green light for a red run.
+
+  Previously the latest turn lived at the root while earlier ones were name-mangled archives, so a file's
+  name depended on whether a later turn ever happened; that shape produced a wrong-turn read, a destroyed
+  trace, and a dropped index row — this release's read-side (`turnArtifactPath` / `listTurns` in
+  `turn-layout.ts`, with the old `readTurnResult` deleted for having zero production callers) no longer has
+  a legacy-resolving branch at all, so that class of bug is now unrepresentable rather than merely fixed. The Python SDK's `_latest_run_jsonl` likewise now raises loudly
+  on a pre-layout dir instead of silently falling back to a root `run.jsonl` that (for any current-layout
+  dir) is a path to nowhere.
+
+- **Platform baseline synced to Desktop 1.24012.1** (`baselines/desktop-1.24012.1.json`, now what
+  `baseline: latest` resolves to). The staged **agent binary is `2.1.217`** (native app + VM ELF, new
+  sha256 for each). The baseline moved in two steps this release — an earlier sync to **1.24012.0** (agent
+  `2.1.215`), then to 1.24012.1 — with **no prompt, spawn-env, or egress-allowlist drift across either**:
+  `spawn.env` is byte-identical to 1.22209.3, the same 15-domain allowlist and `gvisor` mode carry over
+  (the effort map is the one spawn field that changed — see the sonnet-5 delta below), and the
+  `deriveSpawnEnv` / `checkSpawnContractFacts` oracles stay green against the live asar. The
+  substantive deltas all came from the 1.24012.0 step and carry forward unchanged: `claude-sonnet-5` joins
+  the per-model effort map (`low|medium|high|xhigh|max`, recommended `medium`, modes `auto`); the
+  `coworkRuntimeConfig` gate drops its `pluginsFullSyncStalenessMs` key (never modeled here, inert); and
+  the dormant `autoModeOverridesAlwaysAllow` sentinel fired — see below. 1.24012.1 itself adds only the
+  agent bump: the `2.1.217` binary can emit the VCS SDK events `code_change_published` /
+  `vcs_state_changed` (SDK floor `2.1.216`), which the harness surfaces as a `system_event` (its existing
+  graceful degradation of an unmodeled system event, unchanged), and the binary's native skill-discovery
+  enable predicate widened to three branches — still inert here, since real Cowork's model-visible surface
+  is the Desktop SDK-MCP discovery servers, not the native tools. The example cassettes'
+  `fingerprint.baseline` tracks the new baseline.
+- **The `autoModeOverridesAlwaysAllow` gate (`4200321681`) flipped absent → on** (`source: force`) and was
+  revisited as its pin intended. It stays **unmodeled, deliberately**: binary-verified in 1.24012.0, both
+  call sites only override an *already-existing* always-allow decision — the session rule cache
+  (`approvedToolNames`) and scheduled-task auto-approval — each further gated on `permissionMode` and
+  `isDestructiveConnectorTool`. The harness persists neither, so it already prompts wherever the gate makes
+  Cowork prompt; enabling it moves real Cowork *toward* harness behavior rather than away. Revisit only if
+  the harness gains a persistent per-tool approval cache.
+- **The staged agent (`2.1.217`) enforces sub-agent fan-out caps, so `dispatch_count_max` is now framed as
+  a budget UNDER Cowork's cap, not a reproduction of it.** Because the harness spawns the real binary, a
+  run that fans out past the agent's caps now errors from the binary itself: a **concurrent** cap
+  (`CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS`, default 20; error `subagent_concurrency_cap`, new in 2.1.217)
+  and a **per-session** cap (`CLAUDE_CODE_MAX_SUBAGENTS_PER_SESSION`, default 200; error
+  `subagent_count_cap`, present since ≤2.1.215). The scenario schema's `dispatch_count_max` description,
+  the `assert` over-budget message, and SPEC §10 no longer claim "Cowork imposes no in-conversation
+  Task-dispatch cap" — that claim was stale. The harness does not reproduce the caps; it inherits them by
+  running the binary.
+- **A host-loop `exec` infrastructure failure now WARNS instead of failing the run.** ⚠️ **Upgrade note:**
+  a run that previously exited `1` because one `docker exec` failed will now exit `0`. A dead sidecar
+  still hard-fails. Known residual, documented in `docs/scenario.md`: if *every* exec failed the agent ran
+  nothing and the run still only warns — inspect `result.infraErrors` when a run looks suspiciously empty.
+- **A model-requested bash `timeout_ms` expiry is no longer classified as an infrastructure failure.**
+  The model now receives its command's own partial output with `Command timed out after <duration>`
+  merged into stderr — matching real Cowork, verified against the staged agent binary — instead of an
+  opaque `[infrastructure error: see run log for details]`.
+- **The agent's spawn env now always carries a normalized IANA `TZ`** — matching Desktop, which injects
+  `Intl.DateTimeFormat().resolvedOptions().timeZone` unconditionally. Previously `TZ` was forwarded only
+  when the host shell exported it, and forwarded raw, so a host with no `TZ` set — or a legacy/non-IANA
+  export (`US/Eastern`, `EST5EDT`) — diverged from real Cowork's date/"today" rendering inside the agent.
+- **The `tool_available` assertion now names its evidence limit.** It evaluates against the run's
+  *eagerly-loaded* tool set (the SDK init manifest in `result.json`); a factory-deferred tool — e.g. the
+  skill-discovery MCP tools, loaded on demand via a `ToolSearch` round-trip — can be genuinely available in
+  the run yet miss here, a false negative. The assertion still fails on a miss; the failure message now
+  states that eagerly-loaded scope rather than implying provable unavailability.
+- **An explicitly requested `--dotenv` file now fails loud.** ⚠️ **Upgrade note:** an unreadable file, or
+  a path that is a directory, previously fell through to lower-precedence `.env` sources *while still
+  printing a success line* — so a typo'd path silently ran against the wrong credentials. It is now a
+  usage error. Automatic `.env` discovery is unchanged (still best-effort).
+- **`diff` no longer reports `identical` when only one side has an artifact manifest.** ⚠️ **Upgrade
+  note:** such a comparison previously exited `0`; it now exits `1`, because unavailable evidence is not
+  evidence of equality. Both-sides-missing still does not veto identity. The `--output-format json`
+  envelope gained an `artifactsAvailability` key.
+- **`stats --reindex` merges rows by per-completion identity** (`outDir` + a new `turn` field) rather than
+  by `outDir` alone, and reports rejected symlinked run directories.
+
+### Fixed
+
+- **`verify-run` now REFUSES a multi-turn run directory** instead of certifying the wrong turn. Root
+  `result.json` is the latest turn; on a `critique` directory that is the *reflection* turn while the
+  scenario describes the *graded* one. Previously the cumulative gate scan false-FAILED on the other
+  turn's gates — wrong, but loud. The refusal names `result.graded.json` / `turns/1/result.json` so the
+  caller can still reach the graded turn.
+- **`trace` no longer mixes turn scopes.** After timeline reads became turn-scoped, `--view
+  tool-durations` showed the latest turn while the tools/questions/dispatches views still showed every
+  turn — two views of one run directory describing different scopes. All views are now the latest turn,
+  and a `::notice::` reports when earlier turns exist rather than hiding them. Its cache-read footer and
+  gate-provenance (`answeredBy`) views also now say when a result is not turn-addressable (a pre-layout
+  dir) instead of silently omitting the cache-read ratio / labels.
+- **`prune` no longer demotes an unmigrated pre-layout run dir to the junk tier.** Its real-run predicate
+  keyed on `hasTurnDirs || events.jsonl`, reasoning only about what current writers produce — but `prune`
+  ranks *history*, including the legacy dirs `migrate-run-dir` exists to preserve, so a legacy dir with no
+  `events.jsonl` could be evicted ahead of an empty scaffold. It now also counts a `legacy` / `mixed` shape
+  as a real run. (Distinct from the in-flight-migration deferral above — this is about which dirs count as
+  real at all.)
+
+- **A resumed turn was judged on the PRIOR turn's evidence — three wrong-verdict paths.** `events.jsonl`
+  is append-only across turns with no per-turn marker, and three whole-file scanners decide a run's
+  outcome: `scanEvents` (outputs-delete / host-path-leak → fail signals, and an authored
+  `no_delete_in_outputs`), `findUngatedPathToolCalls` (→ a run-level `error` at hostloop), and
+  `detectCapabilityUse` (→ `missing_capability`, a fail signal, which fires on the default lean image).
+  So on any `--resume` — and every `critique` reflection turn — turn 1's delete, gated tool call, or
+  capability use FAILED turn 2. A turn-start marker now scopes all three to the current turn.
+  `resources.jsonl` had the same shape (turn 1's peak RSS judged against turn 2's `max_peak_rss_bytes`)
+  and is archived per turn. Single-turn runs write no marker, so their `events.jsonl` is byte-identical
+  and no cassette is affected. Missing marker ⇒ whole-file scan, i.e. fail-closed.
+
+- **A resumed turn's telemetry included the PRIOR turn's events, and could produce a false PASS.**
+  `timeline.jsonl` is append-mode with a fresh header per turn, but `readTimeline` returned every line
+  after the first as an event — so on any `--resume` (and every `critique` reflection turn) the current
+  turn's `toolDurations`/`skillActivity`/`subagents` folded in the previous turn's tool calls. Because
+  the **`skill_tool_used` assertion** evaluates against that same `skillActivity`, a turn-1 skill window
+  could satisfy a turn-2 assertion. The reader now returns only the current turn's segment. The file
+  stays one append-only stream, so `critique`'s byte-offset turn-isolation proof is unaffected.
+
+- **A resumed turn destroyed the prior turn's `trace.json`.** Because it is rebuilt and overwritten on
+  every completion, the earlier turn's trace was deleted rather than preserved, so a `critique` lost the
+  graded turn's trace entirely. Each turn now owns its own `turns/<N>/trace.json`, written once and never
+  overwritten, and `critique` additionally writes **`trace.graded.json`** beside `result.graded.json`.
+- **`stats --reindex` dropped every non-latest turn when rebuilding from the runs tree.** It read only the
+  root `result.json` per run directory, so a resumed session's earlier turns vanished — and on a
+  `critique` directory the root file is the *reflection* turn, so it was the **graded** rows that were
+  lost. Every turn under `turns/<N>/` is now indexed as its own completion; `result.graded.json` — a
+  root-level copy of the graded turn — is deliberately not matched, so it cannot double-count. A dir that
+  has not been migrated is counted as `skippedLegacy` and reported with the remedy, never dropped
+  silently.
+
+- **An ambient `GIT_DIR` silently computed the wrong skill file set.** Git hooks export `GIT_DIR` (and
+  `GIT_INDEX_FILE`) into every child process, and with `GIT_DIR` set but no `GIT_WORK_TREE` git stops
+  inferring the work tree from `cwd` and treats `cwd` as the repo root. `gitTrackedSet`'s
+  `rev-parse --show-toplevel` probe therefore still succeeded — so the not-a-repo raw-walk fallback never
+  fired — while `git ls-files -- .` returned the **entire repo index as root-relative paths** instead of
+  the directory-relative ones. Measured on this repo: 2 tracked files became 625 wrong ones. That set
+  feeds both `skillHash` and the mount-copy filter, so any run invoked from a git hook (or from CI that
+  exports `GIT_DIR`) got a wrong hash and a mount filter pointed at paths that do not exist under the
+  skill dir. The visible symptom was the repo's own pre-commit hook reporting committed example cassettes
+  as `[stale] skill files changed since record` on every parity sync. `skillCommit` had the same defect:
+  `git -C <dir>` is overridden by an ambient `GIT_DIR`, so every skill dir resolved to that foreign repo's
+  HEAD — recording a foreign commit as the skill's provenance and masking dirs that are genuinely in
+  different repos. Both call sites now spawn git with `GIT_DIR` / `GIT_WORK_TREE` / `GIT_INDEX_FILE`
+  stripped, via one shared helper so they cannot drift. `run-index`'s `gitInfo` and `doctor`'s worktree
+  probe deliberately keep inheriting — they are asking about the *ambient* repo.
+- **`stats --reindex` destroyed multi-turn history.** Every `--resume` turn — and `critique`'s task +
+  reflection pair — writes to one `outDir`, so keying by directory collapsed N completions into one,
+  silently changing run counts, pass rates and costs.
+- **Host-loop sidecar failures never reached the verdict.** They were appended straight to `events.jsonl`,
+  which no live drive re-reads, so a dying sidecar left the run green; a signal-only termination (OOM,
+  `SIGKILL`) was recorded nowhere at all.
+- **`result.json` was written non-atomically** at all three producers, so an interrupted write could leave
+  the canonical record truncated.
+- **Corrupt index rows were blind-cast**, letting one malformed row crash `stats` or fabricate a
+  pass/cost value; `reindex` also followed symlinks out of the runs root.
+- **`scaffold` turned unavailable artifact evidence into "no artifacts"**, permanently encoding a false
+  "this run produced nothing" claim into a generated scenario.
+- **`critique` treated a vanished turn-1 evidence file as genuinely empty evidence** rather than an
+  integrity failure. A stream that was legitimately zero bytes at capture is still reported clean.
+- **`critique`'s exit-code table omitted `1`.** Exit `1` is reachable on operator interrupt
+  (SIGINT/SIGTERM); a sweep wrapper treating it as impossible misreads a cancelled run as a crash.
+- Documented that after critique's resume, `result.json` is the **reflection** turn's result — the graded
+  turn is archived as `result.turn-1.json`. Reading the wrong one yields a valid-looking wrong number.
+
 ## [1.6.0] — 2026-07-20
 
 ### Added

package/CONTRIBUTING.md

@@ -44,6 +44,9 @@ src/
   decide/             Decider — answer policy (scripted / LLM / external-channel deciders)
   run/                Run — turn loop + RunRecord (run.ts); executeScenario (execute.ts); cassette replay
   runtime/            protocol (L0) / container (L1) / microvm (L2) / hostloop / lima
+  hostloop/           Cowork host-loop handlers — can_use_tool gate, web_fetch dedup, workspace/path hooks
+  critique/           critique — run a skill, then grade its self-report against a frozen run record
+  staging/            agent-binary resolution + mount naming for the sandboxed live tiers
   egress/             default-deny allowlist proxy
   boundary.ts         sandbox self-test probes
   assert.ts           synchronous assertion evaluator