cowork-harness 1.6.0 → 1.8.0

package/.claude/skills/cowork-harness/SKILL.md

@@ -3,8 +3,8 @@ name: cowork-harness
 description: Test or debug a Claude Code skill/plugin under Claude Cowork's runtime — sandboxed agent, default-deny egress, the can_use_tool permission/question protocol — using the cowork-harness CLI. Use when validating or regression-testing a skill, authoring or debugging a scenario YAML (prompt + scripted answers + assert:), choosing a fidelity tier, scripting AskUserQuestion / tool-permission answers, or asserting artifacts, egress, or sub-agent dispatch. Especially when a harness run no-ops an assertion, fails on an unanswered gate, false-greens, a steered answer never reaches the model, or a web_fetch is unexpectedly denied or gated. Also when iterating or hardening a skill across fixes, or grounding a skill's self-critique against its own run evidence — including a document-analysis skill (cap table, deck, financial model, transcript) that needs an uploaded file attached to be critiqued at all. NOT for generic unit testing (pytest/vitest of your own scripts) or non-Cowork CI. Covers the skill / run / chat / record / replay / trace / decide / assertions / scaffold commands and the session-vs-scenario split.
 metadata:
   author: cowork-harness
-  version: 1.6.0
-  tracks-harness: cowork-harness 1.6.0 (baseline desktop-1.22209.3)
+  version: 1.8.0
+  tracks-harness: cowork-harness 1.8.0 (baseline desktop-1.24012.1)
 ---
 
 # cowork-harness
@@ -22,8 +22,8 @@ flagged with a loud `::warning::`, not silent — auto-answer a gate, observe an
 allowlist). This skill exists mostly to keep you out of those traps — the Gotchas section below is
 the highest-value part. Read it.
 
-> **Version note:** the facts and `file:line` pointers here track `cowork-harness 1.6.0` (baseline
-> `desktop-1.22209.3`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
+> **Version note:** the facts and `file:line` pointers here track `cowork-harness 1.8.0` (baseline
+> `desktop-1.24012.1`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
 > `SPEC.md` / `docs/*.md` over this snapshot, and re-run the bundled linter.
 
 ## Preflight — make sure the harness can actually run
@@ -39,9 +39,52 @@ Before the first command, confirm the CLI is reachable and **fail loud** (never
 
 - **One-shot check.** Run `cowork-harness doctor [--tier <tier>]` first — a read-only prerequisite check that inspects Docker, the staged agent, the token, and the baseline in one pass. The bullets below explain each thing it checks (and how to fix it).
 - **Replay-only? Skip `doctor`.** Replaying committed cassettes needs no Docker, no staged agent, and no token — and every tier's `doctor` validates the auth token (the live tiers also Docker + the staged agent), so a ✗ there is expected, not a blocker. Go straight to `cowork-harness replay <cassette>`.
-- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 1.6.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@>=1.6.0" <cmd>` (Node ≥ 20), or install once with `npm i -g "cowork-harness@>=1.6.0"`. **Pin `@>=1.6.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
-
-  What the ≥ 1.6.0 floor gates, by release:
+- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 1.8.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@>=1.8.0" <cmd>` (Node ≥ 20), or install once with `npm i -g "cowork-harness@>=1.8.0"`. **Pin `@>=1.8.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
+
+  What the ≥ 1.8.0 floor gates, by release:
+
+  - **1.8.0 (critique hardening + hostloop unpin):** `critique --skill <name>` (multi-skill-plugin
+    grading — a plugin root with no `--skill` is refused pre-spend; the evidence package gains the
+    invoked skill's `agents/<name>.md` + bounded `references/*.md` CONTENT), run-dir artifacts
+    (`critique-report.json` always, `critique-evidence-package.txt` when the evaluator ran,
+    `critique-salvage.json` on exit 2) + `--out <path>`, per-critique `costUsd` across all four
+    workloads, `findingFingerprint` per item (cross-INPUT clustering; skillHash stays the cross-FIX
+    key), gate-answer `--answer` echo in the report, per-item-tolerant evaluator parse
+    (`droppedEvaluatorItems`), `skillMdTruncated` (a readable-but-oversized SKILL.md is flagged
+    "graded a cut copy" — distinct from missing/unreadable), `subagents[].webSearches` +
+    `trace --view subagent-research` (live/record lane), and the hostloop uploads-bullet fix (Read of
+    an uploaded file at the advertised path works — no copy-into-outputs workaround needed). Also:
+    **`critique --fidelity hostloop`** (the container-tier pin is lifted — resume-continuity proven
+    live on the native binary; `microvm`/`protocol`/`cowork` stay refused, each with a tagged reason),
+    **`skill --allow-host-writes`** (hostloop writable-folder consent; `critique` forwards it to both
+    turns), `verdictProvenance` stamped on every critique report (advisory self-run, not an
+    attestation), evidence caps 64KB SKILL.md / 32KB transcript / 144KB package (a flagship-sized
+    SKILL.md grades untruncated; ~2–2.5× evaluator cost on large skills), pinned sessions stamp their
+    fidelity and a cross-tier `--resume` fails loud pre-spawn, and `doctor`'s advisory
+    `image-freshness` check (pulled agent image behind the published GHCR one → warn + re-pull
+    remedy).
+
+  - **1.7.0 (per-turn run-directory layout, single shape):** every run dir — `run`/`skill`/`chat`,
+    single-turn or multi-turn (any `--session-id` + `--resume`, and **every `critique`**: task turn +
+    reflection turn) — writes each turn's `result.json` / `run.jsonl` / `trace.json` / `resources.jsonl`
+    into **`turns/<N>/`**, written once and never renamed. **There is no root compat copy of anything —
+    `<run-dir>/result.json` does not exist.** **When a user asks about a run, point them at
+    `turns/1/result.json`** (the only completion on a single-turn dir) — or on a `critique` dir, better yet
+    at `result.graded.json` / `trace.graded.json`, the role-stable aliases `critique` writes (the graded
+    task turn, never the reflection one). `events.jsonl` / `timeline.jsonl` stay cumulative at the run-dir
+    root, always. A dir written before this layout existed is refused LOUD, by name, naming the shape found
+    — never silently misread as if it were `turns/1/`. **Convert it in place with
+    `cowork-harness migrate-run-dir` (dry-run by default); do NOT tell the user to re-run or re-record,
+    which throws away history the migrator recovers.** Its `events.jsonl` still fully supports `trace`,
+    which is why every refusal points there. `verify-run` REFUSES a multi-turn dir rather than certifying
+    the wrong turn, and `trace` shows the latest turn with a `::notice::` when earlier turns exist.
+
+  - **1.7.0 (limitation provenance):** every `critique` limitation in `critique --help` and
+    docs/critique.md is tagged with WHY it exists — `[structural]` (permanent), `[unverified]` (unproven,
+    **not** known-impossible), `[deliberate]`, `[not-built]`. **Read the tag before telling a user to
+    design around a limitation.** Worked example of why the tag matters: `critique`'s container-tier pin
+    was tagged `[unverified]`, not permanent — and 1.8.0 lifted it (hostloop allowed, see above) exactly
+    as the tag predicted a proof could.
 
   - **1.6.0 (`critique`'s skill-flag parity):** `critique` accepts most `skill` flags under the same names,
     which is what makes a document-analysis skill (cap table, deck, financial model, transcript)
@@ -81,7 +124,7 @@ Before the first command, confirm the CLI is reachable and **fail loud** (never
 - **Agent binary (sandboxed live tiers — `container`/`microvm`/`hostloop`/`cowork`).** The staged Claude Code agent is **bind-mounted** from a local Claude Desktop install, or point `COWORK_AGENT_BINARY` at a `claude-code-vm/<ver>/claude` ELF. Nothing is bundled. `protocol` (L0) and `replay` need no staged agent; for the sandboxed tiers, no agent → no run; report that, don't skip silently.
 - **Docker / Lima.** Only `--fidelity protocol` (L0) runs without them. `container` / `microvm` / `hostloop` / `cowork` need Docker (Lima for L2). If they're absent, drop to `--fidelity protocol` and **say so** — a green that never exercised the sandbox is not a sandbox pass.
 - **Auth.** `CLAUDE_CODE_OAUTH_TOKEN` (preferred), or `ANTHROPIC_API_KEY` / `ANTHROPIC_AUTH_TOKEN`, via env or `.env`. Minting an OAuth token needs the **`claude` CLI** (`npm i -g @anthropic-ai/claude-code`, then `claude setup-token`).
-- **`--dotenv` is a GLOBAL flag — put it BEFORE the subcommand.** `cowork-harness --dotenv .env record …`, never `cowork-harness record … --dotenv .env`. Every *other* flag is subcommand-level, so muscle memory fights this one; the harness rejects the misplaced form with an exact-fix error, but placing it first avoids the round-trip. **One exception: `critique` also accepts `--dotenv` per-command** (`critique <folder> --prompt "…" --dotenv <path>`) — UNRELEASED, see the floor list; `--run-dir` stays global-only everywhere.
+- **`--dotenv` is a GLOBAL flag — put it BEFORE the subcommand.** `cowork-harness --dotenv .env record …`, never `cowork-harness record … --dotenv .env`. Every *other* flag is subcommand-level, so muscle memory fights this one; the harness rejects the misplaced form with an exact-fix error, but placing it first avoids the round-trip. **One exception: `critique` also accepts `--dotenv` per-command** (`critique <folder> --prompt "…" --dotenv <path>`) — available as of **1.6.0** (documented but unreachable before then); `--run-dir` stays global-only everywhere.
 
 ## Orient — the three loops
 
@@ -113,7 +156,7 @@ reproducible regression (Part II), and **debug** a run that misbehaved or greene
 > `node_modules/cowork-harness/docs/<name>.md` before assuming a pointer dangles. A **plugin**
 > install loads a trimmed source-only cache where those pointers genuinely do dangle.
 
-Full command set: `skill · run · chat · record · replay · verify-cassettes · rehash · prune · lint ·
+Full command set: `skill · run · chat · record · replay · verify-cassettes · rehash · prune · migrate-run-dir · lint ·
 lint-skill · analyze-skill · probe-dispatch ·
 verify-run · trace · inspect · diff · critique · stats · decide · gates · answer · scaffold · assertions --list · sync ·
 list · boundary-check · status · vm <init|status|delete|prune> · doctor · init-redact`. Always check `cowork-harness <cmd> --help`.
@@ -155,7 +198,7 @@ the folder basename (collision-resolved); there is no `to:` override. See `refer
 > is your **working tree**, so an uncommitted edit to an already-tracked file *is* tested — you needn't
 > commit to iterate. Only brand-new (untracked) files must be `git add`-ed to appear. Commit before you
 > record the **locking cassette**, though: real Cowork ships the *committed* tree, so a green on
-> uncommitted edits isn't yet a green on what installs. An **all-untracked** skill folder used to mount *empty* and the agent reported "the skill isn't
+> uncommitted edits isn't yet a green on what installs. An **all-untracked** skill folder mounts *empty* and the agent reports "the skill isn't
 > installed" then did the work itself — a green-looking run where the skill never loaded. That now
 > **hard-fails** (`BoundaryError`, exit 3) naming the dir, and a partially-tracked folder emits a loud
 > `::notice:: [stage]` listing the excluded files. Fix: `git add` the skill, or `COWORK_HARNESS_GITSET=0`
@@ -372,7 +415,7 @@ cassette — has its own recipe:
    "<q>=Israeli company"` binds whichever option starts with `Israeli company`. It is uniqueness-guarded and
    **fails loud** if the anchor ever matches two options (the documented trade: drift-tolerance, not strict
    CI reproducibility — for that, pin a full exact label or a free-text `answer:`).
-3. **Budget ~1 re-run per file.** If a gate whiffs, the run no longer vanishes — it exits non-zero but
+3. **Budget ~1 re-run per file.** If a gate whiffs, the run does not vanish — it exits non-zero but
    **salvages a PARTIAL run** (the extraction the agent already did is written to disk). So the cost of a
    missed gate is one re-run with a better `--intent` or a scripted answer, not a lost paid run.
 4. **Inspect the outputs to judge correctness.** `cowork-harness inspect <run-dir>` shows what the run
@@ -435,6 +478,14 @@ Recognize these before "fixing" a non-bug:
   `transcript_no_host_path`. At `fidelity: cowork` the skip follows the **resolved** tier, so a `cowork`
   run that lands on `container` is armed. Author `transcript_no_host_path` to enforce cleanliness where
   it's valid.
+- **`exec_infra_error`** (`WARN`, host-loop) — one or more container `exec` calls failed for
+  infrastructure reasons (daemon/container-level), so those tool calls returned an error to the agent
+  rather than the command's own output. Warn-severity because the run's other evidence is intact — unlike
+  the fail-severity `infra_error`, where a **supervising process** died and contaminated everything. Note
+  a model-requested `timeout_ms` expiry is *not* this: it returns the command's partial output with
+  `Command timed out after <duration>` in stderr, matching production. Known gap: if **every** exec
+  failed, the agent ran nothing yet the run still only warns — read `result.infraErrors` when a run looks
+  suspiciously empty.
 - **`scan_unavailable`** (`WARN`) — emitted only on the live lane: `events.jsonl` was missing/corrupt, so
   `RunResult.scan` is undefined and the host-path + outputs-delete guards **did not run this run**. Not a
   pass or a defect — assert `no_delete_in_outputs` / `transcript_no_host_path` to hard-fail on it instead.
@@ -638,19 +689,27 @@ repeats the assertion/replay-relevant ones alongside the schema (a scoped subset
    `mcp__workspace__bash` alias, so a "sub-agent used no shell" check must glob **both** `Bash` and
    `mcp__workspace__*` to hold across every tier.
 
-6. **`dispatch_count_max` is an author-chosen budget, not a production cap.** It's a post-hoc count
-   assertion: passing means "happened to dispatch ≤N this run," nothing more. Cowork imposes **no**
-   in-conversation `Task`-dispatch cap — gate `1648655587`'s `{perTask:1, global:3}` governs the
-   separate scheduled/cron-task session scheduler, not the `Task` tool (binary-verified; details in
-   `SPEC.md` §10 — repo-only). So there is no "skip-on-cap" for the harness to reproduce; use this key
-   only to catch a fan-out you don't want.
+6. **`dispatch_count_max` is your author-chosen budget UNDER Cowork's production cap, not a
+   reproduction of it.** It's a post-hoc count assertion: passing means "happened to dispatch ≤N this
+   run." Cowork DOES cap `Task` fan-out **agent-side** (`taskRegistry`: concurrent **20** /
+   per-session **200**, landed 2.1.212/2.1.217) — SEPARATE from the scheduled-task session limiter
+   (gate `1648655587`'s `{perTask:1, global:3}`, a different mechanism; binary-verified, `SPEC.md` §10
+   — repo-only). The harness **inherits** the production cap by spawning the real agent binary, so a
+   `dispatch_count_max` pass means "your tighter budget held," not "near a real limit"; use it to catch
+   a fan-out you don't want.
 
 7. **`protocol` is rejected (not silently passed) if the scenario asserts egress** — boundary
    assertions need a sandboxed tier (`container`+). Good: this one fails loud by design.
 
-8. **Read-only mounts are enforced; delete-deny is not.** `mode:r` mounts get a real `:ro` bind
-   (a write fails in-guest). But `rw` vs `rwd` (write-but-no-delete on `outputs/` / connected folders) is
-   *not* mount-enforced — `rm` succeeds and is only caught post-hoc by `no_delete_in_outputs`.
+8. **Read-only mounts are enforced; delete-deny is a HARNESS gap — production DOES enforce it.**
+   `mode:r` mounts get a real `:ro` bind (a write fails in-guest). But `rw` vs `rwd`
+   (write-but-no-delete on `outputs/` / connected folders) is *not* mount-enforced **in the harness** —
+   `rm` succeeds and is only caught post-hoc by `no_delete_in_outputs`. **Real Cowork enforces it live:**
+   `rm` under `outputs/` fails `Operation not permitted`, and a skill must request approval via
+   `allow_cowork_file_delete` to delete. Two consequences: a skill should not stage disposable scratch
+   under `outputs/` (in production, cleanup there costs an approval prompt), and a skill's
+   "catch-EPERM-then-request-approval" branch cannot be exercised at any harness tier (the `rm` just
+   succeeds here). Do not read this gotcha as "delete-deny may not be real in production" — it is real.
 
 9. **Keep `.env` out of any mounted folder** — it is copied into the sandbox and the token could
    leak. Put it at a working-dir or install root (token resolution: env > `--dotenv` > `./.env` >
@@ -727,7 +786,7 @@ repeats the assertion/replay-relevant ones alongside the schema (a scoped subset
 
 17. **Editing `scenarios/*.yaml` `assert:` does NOT change a plain `replay`.** *Why:* `replay` evaluates the
     assertions **frozen in the cassette** by default — it is byte-deterministic and ignores the working tree (so
-    a committed cassette can't silently re-interpret against an uncommitted YAML). This used to be a *silent*
+    a committed cassette can't silently re-interpret against an uncommitted YAML). This is *loud* rather than a *silent*
     no-op; now plain `replay` prints a `::notice::` when a sibling's `assert:` differs and points you at the fix.
     *Fix:* to re-check token-free against the edited block, `replay --assert-from <scenario.yaml>` (or
     `--reassert`). That opt-in path is safe by construction for the authored fields — it **hard-fails** if

package/.claude/skills/cowork-harness/references/ci-recipe.md

@@ -1,6 +1,6 @@
 # CI recipe — replay vs live lanes
 
-Self-contained reference. Tracks `cowork-harness 1.6.0` (baseline `desktop-1.20186.1`).
+Self-contained reference. Tracks `cowork-harness 1.8.0` (baseline `desktop-1.24012.1`).
 
 **Fastest path: the packaged Action.** One step gets you `replay`/`lint`/`verify-cassettes` plus a PR
 job-summary reporter (verdict table, staleness findings, cost/turns when available):
@@ -13,7 +13,7 @@ job-summary reporter (verdict table, staleness findings, cost/turns when availab
 ```
 
 The Action's `version` input defaults to `latest` — intentional so a copy-pasted recipe tracks the current
-release; pin an exact version (e.g. `version: "1.6.0"`) for reproducible CI.
+release; pin an exact version (e.g. `version: "1.8.0"`) for reproducible CI.
 
 Reach for the manual multi-step form below only when you need per-step control the Action's inputs don't
 cover (a custom flag combination, a different runner matrix per step, or `lint`/`verify-cassettes` gated
@@ -32,7 +32,7 @@ jobs:
       - uses: actions/checkout@v4
       - name: Stage the agent binary (official channel, sha256-verified — see docs/maintenance.md)
         run: |
-          V=2.1.215   # match your scenario's pinned baseline's agentVersion
+          V=2.1.217   # match your scenario's pinned baseline's agentVersion
           curl -fSL "https://downloads.claude.ai/claude-code-releases/$V/linux-arm64/claude" -o "$RUNNER_TEMP/claude-$V"
           chmod +x "$RUNNER_TEMP/claude-$V"
           # verify against the committed baseline's sha256 (baselines/desktop-*.json → agentBinary.sha256)
@@ -57,7 +57,7 @@ sha256-*checked* but not hard-blocking on mismatch — it's advisory for an inte
 GitHub-hosted runners, no token/Docker/agent:
 
 ```yaml
-- run: npm i -g "cowork-harness@>=1.6.0"
+- run: npm i -g "cowork-harness@>=1.8.0"
 - run: cowork-harness lint scenarios/*.yaml          # no silent false-greens
 - run: cowork-harness verify-cassettes cassettes/    # privacy + staleness
 - run: cowork-harness replay cassettes/              # token-free content/structure
@@ -197,7 +197,7 @@ jobs:
         with: { node-version: '20' }
       - uses: actions/setup-python@v5
         with: { python-version: '3.x' }                                       # python3 only — PyYAML is bundled with the linter
-      - run: npm i -g "cowork-harness@>=1.6.0"
+      - run: npm i -g "cowork-harness@>=1.8.0"
       - run: cowork-harness lint scenarios/*.yaml                              # no-silent-false-green (needs python3; PyYAML bundled)
       - run: cowork-harness verify-cassettes cassettes/ --output-format json   # privacy + staleness gate
       - run: cowork-harness replay cassettes/ --output-format json             # token-free content/structure
@@ -226,7 +226,7 @@ jobs:
             echo "live=true" >> "$GITHUB_OUTPUT"
           fi
       - if: steps.guard.outputs.live == 'true'
-        run: npm i -g "cowork-harness@>=1.6.0"
+        run: npm i -g "cowork-harness@>=1.8.0"
       - if: steps.guard.outputs.live == 'true'
         run: cowork-harness run scenarios/ --output-format json
         env:
@@ -263,8 +263,9 @@ JSON, not the human-readable text (which is explicitly NOT stable).
 
 A run writes to `~/.cowork-harness/runs/<name>/<sessionId>/` by default — outside any working tree. In CI,
 set `COWORK_HARNESS_RUNS_DIR` (or pass `--run-dir`) to a workspace-relative path (e.g. `runs`) so an
-artifact-upload step can collect them. Each run dir holds `events.jsonl`, `control-out.jsonl`, `run.jsonl`,
-`trace.json`, `egress.log`, `result.json`. Digest one with `cowork-harness trace <run-id | dir>`.
+artifact-upload step can collect them. Each run dir holds `events.jsonl`, `control-out.jsonl` and
+`egress.log` at the root, plus each turn's `run.jsonl` / `trace.json` / `result.json` under `turns/<N>/`
+(a single-turn run has just `turns/1/`; there is no root compat copy of any of these). Digest one with `cowork-harness trace <run-id | dir>`.
 Secrets are scrubbed from every persisted log by value.
 
 ## Don't assume a fixed assertion count across lanes
@@ -293,7 +294,7 @@ does **not** imply the recording is still valid. Each replay result carries `sta
 (A pre-`effectiveFidelity` cassette with an **explicit** tier is statically knowable — it passes the tier
 check with a non-failing informational note in the `verify-cassettes` envelope's per-file `notes[]`, a
 `·`-prefixed row in text output. On `verify-cassettes` every staleness *finding* above still fails the
-gate (`ok:false`) — but it's no longer class-blind on the EXIT CODE: a `baseline`/`skill`/`shared-root`/
+gate (`ok:false`) — but it is class-AWARE on the EXIT CODE: a `baseline`/`skill`/`shared-root`/
 `format`/`resolved-tier` class lands in the envelope's `staleness[]` (verified & failed — exit `1`),
 while an `unverifiable-*` class lands in `unverifiable[]` (could not verify — exit `3`). Notes never
 fail it either way.)

package/.claude/skills/cowork-harness/references/fidelity-and-answers.md

@@ -1,6 +1,6 @@
 # Fidelity tiers & answer paths
 
-Self-contained reference. Tracks `cowork-harness 1.6.0` (baseline `desktop-1.20186.1`).
+Self-contained reference. Tracks `cowork-harness 1.8.0` (baseline `desktop-1.24012.1`).
 
 ## Fidelity tiers (`fidelity:` in the scenario)
 
@@ -24,6 +24,22 @@ Self-contained reference. Tracks `cowork-harness 1.6.0` (baseline `desktop-1.201
   `skill` (any tier) and `chat` (`protocol`/`container`/`hostloop`; only `microvm`/`cowork` unsupported); `run` rejects an extra `--fidelity`
   positional ("Fidelity is set by the scenario's `fidelity:` field, not a flag").
 
+### hostloop paths: what Read sees vs what bash sees (uploads included)
+
+At `hostloop` the native file tools (Read/Write/Edit/Glob/Grep) run **on the host** and are gated by a
+path-containment hook (production's own model), while `mcp__workspace__bash` runs **in the VM sidecar**
+and sees `/sessions/<id>/...` paths. Consequences an agent (or a debugging author) must know:
+
+- A `/sessions/...` path handed to `Read` fails ("is a VM path") — that split is **production-faithful**,
+  not a harness bug. Translate via the prompt's path-mapping table.
+- **Uploads ARE Read-able at hostloop**: the staged uploads dir on the host is in the containment
+  allowlist (read-only — writes/edits there are blocked, matching production). If a Read of an uploads
+  path fails "outside this session's connected folders", the path *form* is wrong (e.g. a relative
+  `mnt/uploads/...`, which resolves against the outputs cwd) — the file itself is reachable at the
+  staged host uploads dir; it does not need to be copied into `outputs/` first.
+- In real Cowork an upload is a **hardlink** in the session's uploads dir; the harness **copies** it
+  instead. Read-reachability is the same; only the advertised parent dir can differ.
+
 ### `microvm` prerequisites & lifecycle
 
 Requires macOS on arm64 and Lima (`brew install lima`; binary expected at
@@ -122,7 +138,7 @@ hands `fn` exactly this dict.
 
 - On `skill`: `fail | prompt | first`.
 - On `run`: `fail | first` (`prompt` rejected — it would break determinism).
-- On `critique` (UNRELEASED): `fail | first` (`prompt` rejected — there is no TTY inside the spawned turn).
+- On `critique`: `fail | first` (`prompt` rejected — there is no TTY inside the spawned turn).
 - **`llm` is NOT an `--on-unanswered` value.** The bare flag `--on-unanswered llm` is rejected; use
   `--decider-llm` (CLI) or `on_unanswered: llm` (YAML).
 - `agent` is **retired** — `on_unanswered: agent` is rejected by the schema. The enum is

package/.claude/skills/cowork-harness/references/scenario-schema.md

@@ -1,7 +1,7 @@
 # Scenario & session schema, assertion catalog, web_fetch, full gotchas
 
-Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 1.6.0`
-(baseline `desktop-1.20186.1`). If your checkout is newer, prefer the live `docs/scenario.md`,
+Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 1.8.0`
+(baseline `desktop-1.24012.1`). If your checkout is newer, prefer the live `docs/scenario.md`,
 `docs/session.md`, and `SPEC.md`.
 
 **Minimal scenario** — `prompt` is the only required field:
@@ -269,7 +269,7 @@ same set live from the schema.
 | `subagent_dispatched: <regex>` | a sub-agent whose `dispatchAgentType`, binary-*resolved* `resolvedAgentType`, **or dispatch description** matches |
 | `subagent_declared_but_unused: <Tool>` | a sub-agent declared the tool but never used **that** tool (even if it used others) |
 | `subagent_output_contains: {match?, contains}` | a dispatched sub-agent's own output contains the substring `contains` — `match` (optional regex over `dispatchAgentType`/`resolvedAgentType`/`description`) narrows to specific dispatch(es); omitted, checks whether ANY dispatch's output contains it (existence check, not "all"); a miss against an output that was **truncated at the assert cap** reports evidence-unavailable instead of a proven absence — the substring could lie past the cut |
-| `dispatch_count_max: <N>` | at most N sub-agents dispatched — an author-chosen budget (Cowork imposes no in-conversation Task-dispatch cap; records only, enforces nothing — see gotcha 12) |
+| `dispatch_count_max: <N>` | at most N sub-agents dispatched — your author-chosen budget under Cowork's agent-side fan-out cap (concurrent 20 / per-session 200, inherited by the harness); records only, does not itself enforce — see gotcha 12 |
 | `skill_triggered: <regex>` | a skill matching the regex (invoked id, e.g. `"plugin:skill"`) was invoked via the `Skill` tool — evidence-unavailable (not a normal fail) if the agent's init tools have no `Skill` tool |
 | `no_skill_triggered: <regex>` | no invoked skill id matched — the negative-control / description-collision catcher; evidence-unavailable (never a vacuous pass) if invocation data is absent or the `Skill` tool is unobservable |
 | `skill_available: <regex>` | a staged skill's id matched the regex (offered, not necessarily invoked — see `skill_triggered` for invocation) — content-class: the id list comes from the agent's init `skills` listing, so it replays from the frozen init event (id-only; the `whenToUse` enrichment is live-disk and thus absent on replay, but the id is what's matched); evidence-unavailable only if `RunResult.context.availableSkills` is absent entirely (an older cassette recorded before the available-skills listing was captured) |
@@ -348,16 +348,17 @@ codes (`VerdictSignal["code"]` in `src/run/verdict.ts`):
 | `host_path_leak` | fail | A host path leaked into model-visible text (opt out: author `transcript_no_host_path`) |
 | `l0_plugin_divergence` | fail | L0/protocol plugin loading diverged from Cowork (opt out: `allow_l0_plugin_divergence`) |
 | `missing_capability` | fail | A `requires_capabilities` need was unmet, or the skill used a capability the image omits (opt out: `allow_missing_capability`, or `skill --allow-missing-capability` on an open-ended run) |
-| `infra_error` | fail | A VM/egress sidecar crashed mid-run — not author-suppressible |
+| `infra_error` | fail | A supervising process died mid-run (VM/egress sidecar) — the run's evidence is contaminated, not author-suppressible |
 | `stalled` | fail | The run ended on an unanswered question, or on a trailing-`?` final turn with no tool work after the last gate (opt out: `allow_stall`) |
 | `non_deterministic` | warn | The run was LLM/external/human-decided — not reproducible |
 | `prompt_asset_missing` | warn | The run proceeded with a missing prompt asset (`COWORK_HARNESS_ALLOW_MISSING_PROMPT=1`); fidelity is degraded |
 | `scan_unavailable` | warn | Post-run scan evidence unavailable (`RunResult.scan` undefined) — the host-path and outputs-delete guards did not run this run |
 | `ended_with_question` | warn | Live-lane heuristic: the final answer contains a question and the run wrote no deliverable to `outputs/` — the lenient sibling of `stalled` (covers a mid-message `?`, or tool work after the last gate that still ended asking). Opt out: `allow_stall` |
+| `exec_infra_error` | warn | Host-loop: one or more container `exec` calls failed for infrastructure reasons, so those tool calls returned an error to the agent. Warns rather than fails because the run's other evidence is intact — unlike `infra_error`, where a dead supervisor contaminates everything. Caveat: if *every* exec failed, the agent ran nothing and this still only warns — check `result.infraErrors` |
 
 A **fail**-severity signal does not change `result.result` (still `"success"`), but it DOES fail the
 overall run verdict and exit code — `assert result: success` alone won't catch it; check
-`result.verdict.signals[].severity` or the run's exit code. Only the four **warn** codes are truly benign.
+`result.verdict.signals[].severity` or the run's exit code. Only the five **warn** codes are truly benign.
 
 ## Replay class
 
@@ -417,7 +418,7 @@ skill-source drift; every replay result also reports it class-tagged in `stalene
 **Mixed assertions on replay:** before evaluating, `replay` strips each assertion to its replay-checkable
 keys and drops any left empty. So `{result, egress_denied}` evaluates on replay as `{result}` alone — its
 `egress_denied` half is removed (not AND-ed against an unreadable value); with a manifest, `file_exists`/
-`artifact_json` are no longer stripped. The harness is **loud in two classes**: a *full skip* (`::warning::`
+`artifact_json` are not stripped. The harness is **loud in two classes**: a *full skip* (`::warning::`
 with the count of pure live-only assertions not evaluated) and a *partial skip* (`::warning::` when a mixed
 assertion's live-only half was dropped).
 Two CI consequences: skipped assertions are **absent** from `results[].assertions[]` (not
@@ -529,11 +530,12 @@ reference omits). Neither list is a strict superset of the other — reach for t
 11. **`subagent_declared_but_unused` fires on declared-but-didn't-use-THAT-tool**, even if the
     sub-agent used other tools.
 
-12. **`dispatch_count_max` is an author-chosen budget, not a production cap.** It records the count
-    and asserts on it; passing means "dispatched ≤N this run," not "the harness capped it." Cowork
-    imposes no in-conversation Task-dispatch cap to reproduce — gate `1648655587`'s
-    `{perTask:1, global:3}` is the scheduled/cron-task session limiter, a different mechanism
-    (binary-verified; SPEC §10).
+12. **`dispatch_count_max` is your author-chosen budget under Cowork's production cap, not a
+    reproduction of it.** It records the count and asserts on it; passing means "dispatched ≤N this
+    run," not "the harness capped it." Cowork DOES cap `Task` fan-out agent-side (`taskRegistry`:
+    concurrent 20 / per-session 200, landed 2.1.212/2.1.217), which the harness inherits by spawning the
+    real agent binary — SEPARATE from gate `1648655587`'s `{perTask:1, global:3}` scheduled/cron-task
+    session limiter, a different mechanism (binary-verified; SPEC §10).
 
 13. **`protocol` is rejected (not silently passed) if the scenario asserts egress** — boundary
     assertions need `container`+. Fails loud by design.

package/.claude/skills/cowork-harness/references/task-recipes.md

@@ -1,8 +1,8 @@
 # Task recipes — end-to-end paths for the jobs consumers actually do
 
 Each recipe composes facts that live scattered across SKILL.md and the other references into one
-decision path. Every one answers a question a real fleet owner had to work out the hard way. Facts track the harness version in SKILL.md's
-front-matter (currently 1.5.0). Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
+decision path. Every one answers a question a real fleet owner had to work out the hard way.
+Tracks `cowork-harness 1.8.0` (baseline `desktop-1.24012.1`), same as SKILL.md's front-matter. Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
 Recipe 3's `init-redact` shipped in 0.24.0 and are part of the current feature set — no version gate
 needed if your CLI meets SKILL.md's version floor.
 
@@ -182,7 +182,7 @@ Hardening a skill is a loop: run → read what it did → fix → run again. Two
    (blinded evaluator + mechanical citation checking). **Critiquing a document-analysis skill?** The probe
    attaches nothing on its own — pass `--upload <path>` (repeatable) or `--folder <dir>` exactly as you
    would to `skill`, or the graded run has no file and "there was no file attached" is the correct finding,
-   not a skill defect. Source flags reach both spawned turns automatically. UNRELEASED — see SKILL.md's
+   not a skill defect. Source flags reach both spawned turns automatically — see SKILL.md's
    floor list. See docs/critique.md for the full flag table, cost and limits. If you
    prefer to build your own grader, the substrate is still here:
    - `result.json` → `finalMessage` (the skill's own answer/critique) + `toolResults[]` (tool outputs).