cowork-harness 1.7.0 → 1.8.0

package/.claude/skills/cowork-harness/SKILL.md

@@ -3,8 +3,8 @@ name: cowork-harness
 description: Test or debug a Claude Code skill/plugin under Claude Cowork's runtime — sandboxed agent, default-deny egress, the can_use_tool permission/question protocol — using the cowork-harness CLI. Use when validating or regression-testing a skill, authoring or debugging a scenario YAML (prompt + scripted answers + assert:), choosing a fidelity tier, scripting AskUserQuestion / tool-permission answers, or asserting artifacts, egress, or sub-agent dispatch. Especially when a harness run no-ops an assertion, fails on an unanswered gate, false-greens, a steered answer never reaches the model, or a web_fetch is unexpectedly denied or gated. Also when iterating or hardening a skill across fixes, or grounding a skill's self-critique against its own run evidence — including a document-analysis skill (cap table, deck, financial model, transcript) that needs an uploaded file attached to be critiqued at all. NOT for generic unit testing (pytest/vitest of your own scripts) or non-Cowork CI. Covers the skill / run / chat / record / replay / trace / decide / assertions / scaffold commands and the session-vs-scenario split.
 metadata:
   author: cowork-harness
-  version: 1.7.0
-  tracks-harness: cowork-harness 1.7.0 (baseline desktop-1.24012.1)
+  version: 1.8.0
+  tracks-harness: cowork-harness 1.8.0 (baseline desktop-1.24012.1)
 ---
 
 # cowork-harness
@@ -22,7 +22,7 @@ flagged with a loud `::warning::`, not silent — auto-answer a gate, observe an
 allowlist). This skill exists mostly to keep you out of those traps — the Gotchas section below is
 the highest-value part. Read it.
 
-> **Version note:** the facts and `file:line` pointers here track `cowork-harness 1.7.0` (baseline
+> **Version note:** the facts and `file:line` pointers here track `cowork-harness 1.8.0` (baseline
 > `desktop-1.24012.1`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
 > `SPEC.md` / `docs/*.md` over this snapshot, and re-run the bundled linter.
 
@@ -39,9 +39,30 @@ Before the first command, confirm the CLI is reachable and **fail loud** (never
 
 - **One-shot check.** Run `cowork-harness doctor [--tier <tier>]` first — a read-only prerequisite check that inspects Docker, the staged agent, the token, and the baseline in one pass. The bullets below explain each thing it checks (and how to fix it).
 - **Replay-only? Skip `doctor`.** Replaying committed cassettes needs no Docker, no staged agent, and no token — and every tier's `doctor` validates the auth token (the live tiers also Docker + the staged agent), so a ✗ there is expected, not a blocker. Go straight to `cowork-harness replay <cassette>`.
-- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 1.7.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@>=1.7.0" <cmd>` (Node ≥ 20), or install once with `npm i -g "cowork-harness@>=1.7.0"`. **Pin `@>=1.7.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
-
-  What the ≥ 1.7.0 floor gates, by release:
+- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 1.8.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@>=1.8.0" <cmd>` (Node ≥ 20), or install once with `npm i -g "cowork-harness@>=1.8.0"`. **Pin `@>=1.8.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
+
+  What the ≥ 1.8.0 floor gates, by release:
+
+  - **1.8.0 (critique hardening + hostloop unpin):** `critique --skill <name>` (multi-skill-plugin
+    grading — a plugin root with no `--skill` is refused pre-spend; the evidence package gains the
+    invoked skill's `agents/<name>.md` + bounded `references/*.md` CONTENT), run-dir artifacts
+    (`critique-report.json` always, `critique-evidence-package.txt` when the evaluator ran,
+    `critique-salvage.json` on exit 2) + `--out <path>`, per-critique `costUsd` across all four
+    workloads, `findingFingerprint` per item (cross-INPUT clustering; skillHash stays the cross-FIX
+    key), gate-answer `--answer` echo in the report, per-item-tolerant evaluator parse
+    (`droppedEvaluatorItems`), `skillMdTruncated` (a readable-but-oversized SKILL.md is flagged
+    "graded a cut copy" — distinct from missing/unreadable), `subagents[].webSearches` +
+    `trace --view subagent-research` (live/record lane), and the hostloop uploads-bullet fix (Read of
+    an uploaded file at the advertised path works — no copy-into-outputs workaround needed). Also:
+    **`critique --fidelity hostloop`** (the container-tier pin is lifted — resume-continuity proven
+    live on the native binary; `microvm`/`protocol`/`cowork` stay refused, each with a tagged reason),
+    **`skill --allow-host-writes`** (hostloop writable-folder consent; `critique` forwards it to both
+    turns), `verdictProvenance` stamped on every critique report (advisory self-run, not an
+    attestation), evidence caps 64KB SKILL.md / 32KB transcript / 144KB package (a flagship-sized
+    SKILL.md grades untruncated; ~2–2.5× evaluator cost on large skills), pinned sessions stamp their
+    fidelity and a cross-tier `--resume` fails loud pre-spawn, and `doctor`'s advisory
+    `image-freshness` check (pulled agent image behind the published GHCR one → warn + re-pull
+    remedy).
 
   - **1.7.0 (per-turn run-directory layout, single shape):** every run dir — `run`/`skill`/`chat`,
     single-turn or multi-turn (any `--session-id` + `--resume`, and **every `critique`**: task turn +
@@ -61,8 +82,9 @@ Before the first command, confirm the CLI is reachable and **fail loud** (never
   - **1.7.0 (limitation provenance):** every `critique` limitation in `critique --help` and
     docs/critique.md is tagged with WHY it exists — `[structural]` (permanent), `[unverified]` (unproven,
     **not** known-impossible), `[deliberate]`, `[not-built]`. **Read the tag before telling a user to
-    design around a limitation.** In particular `critique`'s container-tier pin is `[unverified]`, not
-    permanent: do not advise building a second hostloop test lane on the assumption it can never lift.
+    design around a limitation.** Worked example of why the tag matters: `critique`'s container-tier pin
+    was tagged `[unverified]`, not permanent — and 1.8.0 lifted it (hostloop allowed, see above) exactly
+    as the tag predicted a proof could.
 
   - **1.6.0 (`critique`'s skill-flag parity):** `critique` accepts most `skill` flags under the same names,
     which is what makes a document-analysis skill (cap table, deck, financial model, transcript)
@@ -679,9 +701,15 @@ repeats the assertion/replay-relevant ones alongside the schema (a scoped subset
 7. **`protocol` is rejected (not silently passed) if the scenario asserts egress** — boundary
    assertions need a sandboxed tier (`container`+). Good: this one fails loud by design.
 
-8. **Read-only mounts are enforced; delete-deny is not.** `mode:r` mounts get a real `:ro` bind
-   (a write fails in-guest). But `rw` vs `rwd` (write-but-no-delete on `outputs/` / connected folders) is
-   *not* mount-enforced — `rm` succeeds and is only caught post-hoc by `no_delete_in_outputs`.
+8. **Read-only mounts are enforced; delete-deny is a HARNESS gap — production DOES enforce it.**
+   `mode:r` mounts get a real `:ro` bind (a write fails in-guest). But `rw` vs `rwd`
+   (write-but-no-delete on `outputs/` / connected folders) is *not* mount-enforced **in the harness** —
+   `rm` succeeds and is only caught post-hoc by `no_delete_in_outputs`. **Real Cowork enforces it live:**
+   `rm` under `outputs/` fails `Operation not permitted`, and a skill must request approval via
+   `allow_cowork_file_delete` to delete. Two consequences: a skill should not stage disposable scratch
+   under `outputs/` (in production, cleanup there costs an approval prompt), and a skill's
+   "catch-EPERM-then-request-approval" branch cannot be exercised at any harness tier (the `rm` just
+   succeeds here). Do not read this gotcha as "delete-deny may not be real in production" — it is real.
 
 9. **Keep `.env` out of any mounted folder** — it is copied into the sandbox and the token could
    leak. Put it at a working-dir or install root (token resolution: env > `--dotenv` > `./.env` >

package/.claude/skills/cowork-harness/references/ci-recipe.md

@@ -1,6 +1,6 @@
 # CI recipe — replay vs live lanes
 
-Self-contained reference. Tracks `cowork-harness 1.7.0` (baseline `desktop-1.20186.1`).
+Self-contained reference. Tracks `cowork-harness 1.8.0` (baseline `desktop-1.24012.1`).
 
 **Fastest path: the packaged Action.** One step gets you `replay`/`lint`/`verify-cassettes` plus a PR
 job-summary reporter (verdict table, staleness findings, cost/turns when available):
@@ -13,7 +13,7 @@ job-summary reporter (verdict table, staleness findings, cost/turns when availab
 ```
 
 The Action's `version` input defaults to `latest` — intentional so a copy-pasted recipe tracks the current
-release; pin an exact version (e.g. `version: "1.7.0"`) for reproducible CI.
+release; pin an exact version (e.g. `version: "1.8.0"`) for reproducible CI.
 
 Reach for the manual multi-step form below only when you need per-step control the Action's inputs don't
 cover (a custom flag combination, a different runner matrix per step, or `lint`/`verify-cassettes` gated
@@ -57,7 +57,7 @@ sha256-*checked* but not hard-blocking on mismatch — it's advisory for an inte
 GitHub-hosted runners, no token/Docker/agent:
 
 ```yaml
-- run: npm i -g "cowork-harness@>=1.7.0"
+- run: npm i -g "cowork-harness@>=1.8.0"
 - run: cowork-harness lint scenarios/*.yaml          # no silent false-greens
 - run: cowork-harness verify-cassettes cassettes/    # privacy + staleness
 - run: cowork-harness replay cassettes/              # token-free content/structure
@@ -197,7 +197,7 @@ jobs:
         with: { node-version: '20' }
       - uses: actions/setup-python@v5
         with: { python-version: '3.x' }                                       # python3 only — PyYAML is bundled with the linter
-      - run: npm i -g "cowork-harness@>=1.7.0"
+      - run: npm i -g "cowork-harness@>=1.8.0"
       - run: cowork-harness lint scenarios/*.yaml                              # no-silent-false-green (needs python3; PyYAML bundled)
       - run: cowork-harness verify-cassettes cassettes/ --output-format json   # privacy + staleness gate
       - run: cowork-harness replay cassettes/ --output-format json             # token-free content/structure
@@ -226,7 +226,7 @@ jobs:
             echo "live=true" >> "$GITHUB_OUTPUT"
           fi
       - if: steps.guard.outputs.live == 'true'
-        run: npm i -g "cowork-harness@>=1.7.0"
+        run: npm i -g "cowork-harness@>=1.8.0"
       - if: steps.guard.outputs.live == 'true'
         run: cowork-harness run scenarios/ --output-format json
         env:

package/.claude/skills/cowork-harness/references/fidelity-and-answers.md

@@ -1,6 +1,6 @@
 # Fidelity tiers & answer paths
 
-Self-contained reference. Tracks `cowork-harness 1.7.0` (baseline `desktop-1.20186.1`).
+Self-contained reference. Tracks `cowork-harness 1.8.0` (baseline `desktop-1.24012.1`).
 
 ## Fidelity tiers (`fidelity:` in the scenario)
 
@@ -24,6 +24,22 @@ Self-contained reference. Tracks `cowork-harness 1.7.0` (baseline `desktop-1.201
   `skill` (any tier) and `chat` (`protocol`/`container`/`hostloop`; only `microvm`/`cowork` unsupported); `run` rejects an extra `--fidelity`
   positional ("Fidelity is set by the scenario's `fidelity:` field, not a flag").
 
+### hostloop paths: what Read sees vs what bash sees (uploads included)
+
+At `hostloop` the native file tools (Read/Write/Edit/Glob/Grep) run **on the host** and are gated by a
+path-containment hook (production's own model), while `mcp__workspace__bash` runs **in the VM sidecar**
+and sees `/sessions/<id>/...` paths. Consequences an agent (or a debugging author) must know:
+
+- A `/sessions/...` path handed to `Read` fails ("is a VM path") — that split is **production-faithful**,
+  not a harness bug. Translate via the prompt's path-mapping table.
+- **Uploads ARE Read-able at hostloop**: the staged uploads dir on the host is in the containment
+  allowlist (read-only — writes/edits there are blocked, matching production). If a Read of an uploads
+  path fails "outside this session's connected folders", the path *form* is wrong (e.g. a relative
+  `mnt/uploads/...`, which resolves against the outputs cwd) — the file itself is reachable at the
+  staged host uploads dir; it does not need to be copied into `outputs/` first.
+- In real Cowork an upload is a **hardlink** in the session's uploads dir; the harness **copies** it
+  instead. Read-reachability is the same; only the advertised parent dir can differ.
+
 ### `microvm` prerequisites & lifecycle
 
 Requires macOS on arm64 and Lima (`brew install lima`; binary expected at

package/.claude/skills/cowork-harness/references/scenario-schema.md

@@ -1,7 +1,7 @@
 # Scenario & session schema, assertion catalog, web_fetch, full gotchas
 
-Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 1.7.0`
-(baseline `desktop-1.20186.1`). If your checkout is newer, prefer the live `docs/scenario.md`,
+Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 1.8.0`
+(baseline `desktop-1.24012.1`). If your checkout is newer, prefer the live `docs/scenario.md`,
 `docs/session.md`, and `SPEC.md`.
 
 **Minimal scenario** — `prompt` is the only required field:

package/.claude/skills/cowork-harness/references/task-recipes.md

@@ -1,8 +1,8 @@
 # Task recipes — end-to-end paths for the jobs consumers actually do
 
 Each recipe composes facts that live scattered across SKILL.md and the other references into one
-decision path. Every one answers a question a real fleet owner had to work out the hard way. Facts track the harness version in SKILL.md's
-front-matter (currently 1.5.0). Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
+decision path. Every one answers a question a real fleet owner had to work out the hard way.
+Tracks `cowork-harness 1.8.0` (baseline `desktop-1.24012.1`), same as SKILL.md's front-matter. Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
 Recipe 3's `init-redact` shipped in 0.24.0 and are part of the current feature set — no version gate
 needed if your CLI meets SKILL.md's version floor.
 

package/CHANGELOG.md

@@ -6,6 +6,176 @@ All notable changes to this project are documented here. The format is based on
 
 ## [Unreleased]
 
+## [1.8.0] — 2026-07-23
+
+### Added
+
+- **`check:versions` closes the stale-pin gap a docs audit found.** Three new enforcement surfaces:
+  every companion-skill `references/*.md` `(baseline desktop-X.Y.Z)` pin must match SKILL.md's
+  `tracks-harness` baseline; `task-recipes.md` now carries the same guarded
+  `` Tracks `cowork-harness X.Y.Z` `` stamp as the other references (and is a `bump-version` target);
+  DESIGN.md's one present-tense "currently **X**, per `baselines/desktop-Y.json`" sentence must name the
+  max committed baseline + its `agentVersion` (its dated verification-pass notes stay exempt). A new
+  docs-index sync test keeps README's Documentation table and docs/README.md's Guides table from
+  drifting apart (that drift is how `critique.md` went missing from the README table).
+
+- **`doctor` warns when a *pulled* agent image is behind the published one.** For the
+  `container`/`hostloop`/`cowork` tiers, a new advisory `image-freshness` check compares the local agent
+  image's registry digest against the current published `ghcr.io/yaniv-golan/cowork-agent-base:2` (or
+  `-full`) and warns — with a re-pull + retag remedy — when they diverge. Best-effort and never blocking:
+  a locally-built image (no registry digest), an offline host, `docker buildx` being unavailable, or a
+  custom `COWORK_AGENT_IMAGE` is a quiet skip, never a false "stale"; only a pulled image incurs a network
+  probe. The `doctor --output-format json` envelope gains an `image-freshness` entry (the open
+  `checks[].id` set — SPEC §12 — already permits this).
+- `critique` now stamps `verdictProvenance` on every report (JSON key + text "verdict scope" line): the
+  verdict is an advisory self-run, not an independent attestation.
+- **`critique --skill <name>` — plugin-aware grading.** A multi-skill plugin root (`skills/<name>/SKILL.md`,
+  no root SKILL.md) previously graded a missing file, downgrading every coverage finding to "not
+  adjudicable". `--skill` selects the invoked skill's folder for the packager (selection only — the
+  positional folder is still what both turns mount, and `fingerprint.skillHash` is unchanged: per-plugin,
+  not per-skill); a multi-skill root with no `--skill` is refused **before any model spend**, naming the
+  available skills; a single-skill plugin auto-selects with a notice. The evidence package now also
+  carries the invoked skill's `agents/<name>.md` body and bounded `references/*.md` **content** (not just
+  filenames), and the report carries an advisory `skillInvocationObserved` (false = the graded run's own
+  `skillActivity` never mentions the selected skill).
+- **`critique` persists run-dir artifacts.** Every critique writes `critique-report.json` (the
+  machine-readable report); when the evaluator ran, `critique-evidence-package.txt` (the exact armored
+  corpus it graded against — re-grade a disputed finding offline); on an instrument failure (exit 2),
+  `critique-salvage.json` (the self-report + each evaluator pass's RAW reply captured **pre-parse**).
+  New `--out <path>` also writes the selected-format report to a file. The two `not-built` limitations
+  these close (`evidence-not-persisted`, `report-stdout-only`) are removed from the registry.
+- **Per-critique cost across all four workloads.** The report's `costUsd` sums the task turn, reflection
+  turn, and BOTH evaluator passes (whose usage the transport previously discarded), marked `INCOMPLETE`
+  whenever any workload is unpriced. The header also carries the pinned `fidelity` plus the graded turn's
+  recorded `gradedEffectiveFidelity`/`gradedBaseline`, and the graded run's resolved gate answers are
+  echoed as copy-pasteable `--answer` lines (JSON: `gateAnswers`).
+- **`critique` evaluator parse is per-item tolerant.** One malformed item in an `{"items":[...]}` reply
+  previously discarded the whole document ("no valid JSON found", a broken discovery run). Valid items now
+  survive; malformed ones are dropped AND counted (`droppedEvaluatorItems`, surfaced in both report
+  formats). The integrity canary is recognized by its `idea` alone (a mutated echo still proves
+  instruction-following) and stripped before dedup, so a full-document + canary-only-restatement reply no
+  longer trips the ambiguity throw. Fail-loud preserved: garbage, or all-malformed-with-no-canary, still
+  throws — now naming which field check failed.
+- **Sub-agent research is observable end-to-end.** A sub-agent's WebSearch never enters the main
+  `toolCounts`/`webSearches[]`; its query + result are now captured from the child session transcript as
+  `subagents[].webSearches` (bounded, live/record lane only — absent on replay, and absence is never
+  evidence of no research), surfaced by the new **`trace --view subagent-research`**, and packaged into
+  critique's evidence as a "Sub-agent research" section so "researched" claims are groundable.
+- Each critique item now carries a **`findingFingerprint`** (sha16 over the normalized
+  idea + classification + recommendedAction, deliberately excluding the input-specific evidence excerpt) —
+  clusters the SAME finding across DIFFERENT inputs, complementing `skillHash` (same skill across fixes).
+  docs/critique.md gains a "Reproduction" section documenting the ≥2-run discipline.
+- SKILL.md truncation is now reported distinctly: a readable-but-oversized SKILL.md marks the report
+  `skillMdTruncated` ("the evaluator graded a cut copy") instead of being indistinguishable from a fully
+  packaged one; only missing/unreadable still forces the mechanical "already-covered" downgrade — the
+  `--help`/docs limitation wording now says so.
+
+### Changed
+
+- **Published agent images (`cowork-agent-base` / `cowork-agent-full`) now carry OCI metadata labels**
+  (`org.opencontainers.image.{title,description,source,documentation,licenses}`), so their GHCR package
+  pages render a description, repo link, license, and the "contains no Anthropic binary" provenance note
+  instead of appearing bare. The `publish-image` workflow sets the `full` variant's title/description via
+  `--label` so its page isn't mislabeled by the base image's baked-in defaults.
+- `critique` evidence caps raised: SKILL.md 16KB→64KB, transcript 16KB→32KB, overall package 48KB→144KB
+  (the overall cap sits above the worst-case per-section sum, agents/references/research sections included), so
+  a flagship-sized (~51KB) SKILL.md no longer grades permanently truncated. Increases per-critique evaluator
+  token cost on large skills (~2–2.5×).
+- `sync`'s two code-tripwire warnings (the `getMcpSkillSources` caller-count and MCP-skills-capability
+  checks) now carry a self-contained instruction — re-verify whether MCP servers can contribute skills and
+  whether the harness must model MCP-contributed skill sources — instead of pointing at a reference the
+  published repo does not carry.
+- **Pinned sessions stamp their fidelity tier on `session.json`, and a cross-tier `--resume` fails loud**
+  (pre-spawn, with a "re-run at `--fidelity <stamped>`" remedy). The agent's native conversation store is
+  tier-LOCAL — container persists it under the work tree, hostloop under the host config dir — so resuming
+  a session at a different tier would hand the binary a `--resume` for a conversation its store has never
+  seen. Legacy stampless manifests (pre-dating the stamp) are let through with a warning; every manifest
+  written from now on carries the stamp. `readSessionManifest` gains a required `expectedFidelity`
+  argument.
+
+### Docs
+
+- README documents that the agent images are **published to GHCR** and can be pulled + retagged instead of
+  built from scratch (`:2` floats to the latest release; `:2-<version>` pins an immutable per-release
+  build), and that the harness resolves the *local* tag — so a stale local image shadows the published one;
+  re-pull after upgrading. The `doctor` command row notes the new freshness warning.
+
+### Fixed
+
+- **hostloop uploads bullet advertised a non-readable path.** The dynamic "## Shell access" section
+  rendered the uploads mapping's file-tool side as `dirname(upload.hostPath)` — the user's original
+  source dir, which the path-containment gate does not allow — while the base prompt pointed at the
+  correct staged dir. An agent following the bullet got "outside this session's connected folders" and
+  worked around it via copy-into-outputs + `rm`, tripping a spurious `outputs-delete` fail. The bullet
+  now advertises the staged uploads dir — the SAME hoisted value the path gate allows, so the prompt and
+  the gate cannot disagree. (Live-verified: hostloop `--upload` + Read-tool read succeeds at the
+  advertised path.)
+- The task-turn timeout kill message now names `--timeout` and the 10-minute default; a "missing"
+  SKILL.md report note now points at `--skill` / the invoked skill's folder (the multi-skill-plugin-root
+  cause) instead of only stating the symptom.
+- Shipped-doc corrections that induced field misdiagnoses: the cowork-harness skill's gotcha #8 now states
+  that **production enforces** outputs delete-deny (EPERM + approval) and the harness gap is
+  detection-only; docs/critique.md documents that a WebSearch produces **no search-host entries in the
+  container egress.log** (an `api.anthropic.com`-only log is consistent with research working —
+  live-verified with a first-party capture) and that sub-agent searches don't increment the main
+  `toolCounts.WebSearch`; the shipped fidelity reference explains the hostloop Read-vs-bash path split
+  including uploads readability.
+- **`critique` now runs at `--fidelity hostloop` as well as `container` — the container-tier pin is
+  lifted.** The pin existed because the reflection turn *resumes* the task turn and resume-continuity was
+  only proven for the container Linux ELF; a live two-turn proof at hostloop's **native** agent binary
+  (`test/live-contract.test.ts`, "resume-continuity proof at hostloop") cleared it, and a live
+  `critique --fidelity hostloop` e2e validates the full protocol there. `microvm`/`protocol`/`cowork` stay
+  refused, each with its own stated reason: the single `container-tier-only` limitation is replaced by
+  three tagged ones — `microvm-tier-refused` `[unverified]` (a resume-continuity proof at the microVM guest
+  would lift it), `protocol-tier-refused` `[not-built]` (protocol never plumbs a session id/`--resume`),
+  and `cowork-tier-refused` `[deliberate]` (the synced loop gate would make the graded tier
+  baseline-dependent, adding noise to skillHash-paired generation comparisons).
+- **`skill` accepts `--allow-host-writes`** (and `critique` forwards it to BOTH turns) — the
+  hostloop writable-connected-folder consent that previously only `chat` (its own flag) and `run` (the
+  `allow_host_writes: true` scenario field) could grant; a plain `skill --fidelity hostloop --folder X`
+  was refused with no way to consent at all. Folder-less runs (skill dir + uploads) still need no consent —
+  uploads and skill/plugin mounts are read-only.
+- **`critique`'s spaced flag parser no longer silently grabs the next flag as a value.** `critique
+  <folder> --prompt --output-format json` (a forgotten `--prompt` value) swallowed `--output-format` as the
+  prompt AND dropped the real flag, then ran a four-workload critique on the wrong input. The spaced form
+  now fails loud and points at the equals escape hatch (`--prompt=<value>`) for a value that intentionally
+  starts with `-`.
+- **`critique`'s subprocess byte cap is now one combined stdout+stderr budget.** `boundedSpawn` kept two
+  independent per-stream counters, so a looping or hostile child splitting output across both streams could
+  buffer ~2× the documented cap before either tripped. It now charges both streams against a single budget
+  and slices the terminal chunk to the remaining room, so captured output never exceeds the cap.
+- **`critique`'s verbatim citation-grounding is now case-sensitive.** The mechanical check that drops any
+  finding whose cited evidence is not a verbatim excerpt normalized whitespace AND folded case — so a
+  case-altered (paraphrased) citation resolved as "grounded," weakening the principal defense against
+  evaluator hallucination. It now matches case-exact; whitespace reflow stays tolerated (models reflow
+  spacing when quoting — they don't change case).
+- **critique's "Attached inputs" evidence no longer reports `(none)` when the uploads dir is unreadable.**
+  `listAttachedInputs` caught every `readdirSync` failure identically, so an unreadable uploads dir
+  (`EACCES`/`ENOTDIR`/…) collapsed to the same `(none)` as a legitimately-absent one — telling the
+  evaluator "the agent correctly saw no file" when attachment presence was actually UNKNOWN. It now
+  distinguishes `ENOENT` (absent) from a genuine read fault and surfaces the uncertainty loudly.
+- **critique flags a partly-corrupt archived turn-1 transcript instead of grading it as clean.**
+  `readTurn1Transcript` skipped malformed JSONL rows (resilient) but returned `degraded: false` on the
+  first valid transcript record regardless — so archive corruption vanished from evidence health and the
+  evaluator graded a silently-incomplete transcript as solid ground truth. It now scans the whole
+  (turn-1-only) archive and sets `turn1SliceDegraded` when a malformed row was skipped or the archive
+  doesn't hold exactly one transcript record; the transcript is still delivered, just flagged.
+- **critique flags a crashed task turn instead of grading evidence from it.** `taskTurnInfraFailure` only
+  treated a *killed* (timed-out / byte-capped) task turn as an instrument failure — a task that exited
+  nonzero without ever printing a parseable result envelope (a crash after the early `[status]` line)
+  slipped through, and its `[status]`-recovered run dir was reflected on and graded as a legitimate task.
+  It now also flags a nonzero exit with no parseable envelope. Deliberately narrow: a completed run that
+  reported a failing verdict (`ok:false` / `result:"error"` with a valid envelope) stays gradeable.
+- **A nested unreadable output subtree no longer persists a partial file list as complete.** The
+  `workspaceFiles` / `artifacts` list was recorded as UNAVAILABLE (`undefined`, the evidence-unavailable
+  convention) only when the workspace ROOT was unobservable; a nested `EACCES`/`EIO` subtree left the walk
+  partial (`walkComplete: false`) but still persisted the incompletely-enumerated list as if complete. An
+  authored file inside the unreadable subtree then vanished with no signal, so an absence-sensitive
+  consumer (`delivered_clean` / `ended_with_question`, the replay `diff`, `scaffold`, `file_exists`) could
+  read it as absent — a silent false-clean. All three RunResult producers (run, partial-salvage, chat) now
+  route through one shared `trustedWorkspaceFiles` gate that collapses a missing root OR any incomplete
+  walk to `undefined`, and the run lanes emit a `::warning::` naming the unreadable subtree.
+
 ## [1.7.0] — 2026-07-22
 
 ### Added

package/CONTRIBUTING.md

@@ -12,7 +12,7 @@ npm run format:check  # prettier over src/ + test/ .ts — the most common first
 npm run typecheck     # tsc --noEmit
 npm test              # vitest
 npm run build         # -> dist/
-npm run ci            # typecheck + build + test — the core TS gate (CI's `unit` job runs more; see below)
+npm run ci            # typecheck + build + test — the core TS gate (CI's `build` + `test` jobs run more; see below)
 ```
 
 Before pushing: `npm run format:check` and `npm run ci` (see RELEASING.md's release checklist for the full pre-tag list).
@@ -25,10 +25,11 @@ Extra prerequisites for specific stages:
 - **Docker (arm64)** — required for `boundary-check` and the **L1 `container`** + `hostloop` fidelity tiers (the container sandbox + agent image).
 - **Lima (`limactl`, macOS arm64)** — required only for the **L2 `microvm`** tier and the `vm` commands; the guest runs on Apple Virtualization.framework (`vmType: vz`). `microvm` does **not** use Docker. (`cowork-harness doctor --tier microvm` checks for Lima, not Docker.)
 
-CI Stage 1 (the `unit` job in `.github/workflows/ci.yml`) does **not** invoke `npm run ci`. It runs the
-gate steps individually — e.g. `check:versions`, `format:check`, `typecheck`, `npm test`, `build`, a CLI
-smoke (`node dist/cli.js list`), three token-free `replay` gate fixtures, `verify-cassettes`, `lint`, and
-source-guard checks (see `ci.yml` for the authoritative list). Only `release.yml` calls `npm run ci`.
+CI Stage 1 (the `build` job in `.github/workflows/ci.yml`) does **not** invoke `npm run ci`. It runs the
+gate steps individually — e.g. `check:versions`, `format:check`, `typecheck`, `build`, a CLI smoke
+(`node dist/cli.js list`), three token-free `replay` gate fixtures, `verify-cassettes`, `lint`, and
+source-guard checks — while the unit suite runs separately as the 4-shard `test` job (see `ci.yml` for
+the authoritative list). Only `release.yml` calls `npm run ci`.
 
 > **Cutting a release?** See [RELEASING.md](./RELEASING.md) for the branch → PR → tag → publish flow.
 
@@ -85,7 +86,7 @@ When a Desktop release moves something `sync` doesn't read, it reports an `unkno
 ## Commit & PR
 
 - Conventional, imperative commit subjects (`add …`, `fix …`, `parity: sync to <ver>`).
-- Open PRs against `main`. CI runs a six-stage pipeline (`unit`, `action-self-test`, `python`, `boundary`, `scenarios`, `parity-drift` — see `ci.yml`) on every PR including forks (no secrets needed) except `scenarios`; live scenarios only run on same-repo PRs/pushes with `ANTHROPIC_API_KEY` set.
+- Open PRs against `main`. CI runs a seven-stage pipeline (`build`, `test`, `action-self-test`, `python`, `boundary`, `scenarios`, `parity-drift` — see `ci.yml`) on every PR including forks (no secrets needed) except `scenarios`; live scenarios only run on same-repo PRs/pushes with `ANTHROPIC_API_KEY` set.
 - Describe *what changed and why*; link issues.
 
 ## Reporting issues

package/DESIGN.md

@@ -38,7 +38,7 @@ flowchart TB
 A Cowork session is the Desktop app driving an agent that runs **inside an Apple Virtualization.framework microVM**:
 
 - VM bundle: `~/Library/Application Support/Claude/vm_bundles/claudevm.bundle/` (`rootfs.img`, `sessiondata.img`, `efivars.fd`, `machineIdentifier`, `gvisorMacAddress`, `vmIP`); a warm pool at `vm_bundles/warm/<sha>/`.
-- In-VM agent: `~/Library/Application Support/Claude/claude-code-vm/<ver>/claude` (currently **2.1.205**, per `baselines/desktop-1.20186.1.json`, an **ELF aarch64** binary), spawned by the host **in cowork mode via the `CLAUDE_CODE_IS_COWORK=1` env var** — *not* a `--cowork` flag (that flag is plugin-scope and the staged agent rejects it; see the control-protocol note below). Each baseline records this ELF's `sha256` (`agentBinary.sha256`/`shaProvenance`), and the resolver integrity-checks the binary it's about to run against that hash by default (opt out `COWORK_HARNESS_VERIFY_AGENT_SHA=0`), so "the same pinned agent" is enforced, not just asserted. Old versions are re-downloadable + verifiable from the official release channel (see `docs/maintenance.md`).
+- In-VM agent: `~/Library/Application Support/Claude/claude-code-vm/<ver>/claude` (currently **2.1.217**, per `baselines/desktop-1.24012.1.json`, an **ELF aarch64** binary), spawned by the host **in cowork mode via the `CLAUDE_CODE_IS_COWORK=1` env var** — *not* a `--cowork` flag (that flag is plugin-scope and the staged agent rejects it; see the control-protocol note below). Each baseline records this ELF's `sha256` (`agentBinary.sha256`/`shaProvenance`), and the resolver integrity-checks the binary it's about to run against that hash by default (opt out `COWORK_HARNESS_VERIFY_AGENT_SHA=0`), so "the same pinned agent" is enforced, not just asserted. Old versions are re-downloadable + verifiable from the official release channel (see `docs/maintenance.md`).
 - Network: `vm_network_mode: "gvisor"`, egress through a userspace netstack with a **compiled domain allowlist**; off-list partners rejected (`partner rejected: entry not on compiled allowlist`).
 - Control plane: Electron renderer→main typed IPC on channels named `$eipc_message$_<per-build-UUID>_$_claude.web_$_<Class>_$_<method>`, every handler validating `event.senderFrame.url` against a trusted-origin allowlist. The session manager is `LocalAgentModeSessions` (80 methods: `start`, `sendMessage`, `setDraftSessionFolders`, `onToolPermissionRequest`, `respondToToolPermission`, `getTranscript`, `onEvent`, …), bridged to the renderer as `window.cowork`.
 

package/README.md

@@ -91,7 +91,7 @@ node dist/cli.js replay examples/replays/example-pdf-skill.cassette.json
 
 > **Installed globally instead?** Once linked/installed, the same command is `cowork-harness replay
 > <cassette>` — but the relative path above only resolves from a source checkout's `examples/replays/`.
-> From a global install (`npm i -g "cowork-harness@>=1.7.0"`), point at the package root instead:
+> From a global install (`npm i -g "cowork-harness@>=1.8.0"`), point at the package root instead:
 > `cowork-harness replay "$(npm root -g)/cowork-harness/examples/replays/example-pdf-skill.cassette.json"`
 > (or copy the cassette into your own project and pass that path).
 
@@ -101,7 +101,7 @@ Live `run`/`skill` need the prerequisites in the next section — note the `prot
 > - **Replay only (zero setup):** `cowork-harness replay <cassette>` — no token, no Docker, no agent. The command above.
 > - **`protocol` (real model, no Docker):** needs only the auth token (item 3 below).
 > - **Live `container` / `microvm` / `hostloop` / `cowork`:** needs Docker (or Lima for `microvm`), a staged agent, and the token — run `cowork-harness doctor` first.
-> - **Invocation:** from a source checkout, `node dist/cli.js <cmd>` (or `npm link` to get the `cowork-harness` command); from a global install, `cowork-harness <cmd>`; the companion skill falls back to `npx "cowork-harness@>=1.7.0"`.
+> - **Invocation:** from a source checkout, `node dist/cli.js <cmd>` (or `npm link` to get the `cowork-harness` command); from a global install, `cowork-harness <cmd>`; the companion skill falls back to `npx "cowork-harness@>=1.8.0"`.
 
 Two more worked examples worth knowing about: `examples/scenarios/protocol-smoke.yaml` (zero-Docker smoke
 test) and `examples/scenarios/skill-loads.yaml` (container-tier acceptance check) — see
@@ -126,7 +126,7 @@ claude plugin marketplace add yaniv-golan/cowork-harness
 claude plugin install cowork-harness@cowork-harness
 ```
 
-The skill **self-bootstraps the CLI**: if `cowork-harness` isn't on your PATH it falls back to `npx "cowork-harness@>=1.7.0"` (a version floor that fails loud rather than silently fetching a too-old CLI; Node ≥ 20). Tiers above `protocol` still need Docker/Lima and a Claude Desktop agent binary — see the prerequisites below.
+The skill **self-bootstraps the CLI**: if `cowork-harness` isn't on your PATH it falls back to `npx "cowork-harness@>=1.8.0"` (a version floor that fails loud rather than silently fetching a too-old CLI; Node ≥ 20). Tiers above `protocol` still need Docker/Lima and a Claude Desktop agent binary — see the prerequisites below.
 
 It also follows the open [Agent Skills](https://agentskills.io) spec, so it installs cross-editor (Cursor, Codex, OpenCode, …) via [`npx skills`](https://github.com/vercel-labs/skills) (Vercel Labs' CLI implementation of that spec):
 
@@ -147,7 +147,7 @@ A global install is enough for CI `lint`, reading the teaching skill, and replay
 To `run` the worked examples live or copy them as a starting point, use a source checkout. (The marketplace
 skill install itself only pulls `.claude/skills/cowork-harness/` — SKILL.md + `references/` + `scenario.py`/
 assertion keys, per `.claude-plugin/marketplace.json`'s `source` — not the rest of this table; the full set
-above becomes available once the skill's first command self-bootstraps `npx "cowork-harness@>=1.7.0"` — see
+above becomes available once the skill's first command self-bootstraps `npx "cowork-harness@>=1.8.0"` — see
 [above](#drive-it-from-claude-code-companion-skill) — which pulls the same npm package as the global-install row.)
 
 ### Prerequisites for anything above `protocol` fidelity
@@ -190,7 +190,11 @@ So **Linux live == `container` only**: `microvm` is Apple-VZ (macOS), and `hostl
 
 > The `pytest` lane (`python/README.md`) has its own, slightly different prerequisite list (adds `pytest`
 > + package importability) — see there if you're driving tests via `pytest` instead of the CLI directly.
-3. **An auth token** — either `export CLAUDE_CODE_OAUTH_TOKEN=$(claude setup-token)` (the `claude setup-token` step needs the **`claude` CLI**: `npm i -g @anthropic-ai/claude-code`) or a **`.env`** file (copy `.env.example` → `.env`; gitignored). (`.env.example` lists all three accepted vars — `CLAUDE_CODE_OAUTH_TOKEN`, then `ANTHROPIC_API_KEY`, then `ANTHROPIC_AUTH_TOKEN` — in that precedence order.) The token resolves in priority order: exported env > `--dotenv <path>` > `./.env` (cwd) > `<install>/.env` (the package root), so a `npm link`ed install works from any directory. That chain is about *precedence*, not error recovery: a `--dotenv` path you passed explicitly must be readable — if it is missing, unreadable, or a directory, the run stops with a usage error rather than quietly falling through to `./.env` and running against different credentials. The automatic `./.env` / `<install>/.env` locations remain best-effort. Keep `.env` at a working-dir or install root, never inside a mounted skill/project folder. (Use `--dotenv`, not `--env-file` — Node reserves the latter.) For a global `npm install -g` install, find the package root with `` `$(npm root -g)/cowork-harness` `` (e.g. `$(npm root -g)/cowork-harness/.env`) — or simpler, just use `--dotenv <path>` / `./.env` in your working directory, which take priority over the package root anyway.
+3. **An auth token** — either `export CLAUDE_CODE_OAUTH_TOKEN=$(claude setup-token)` (the `claude setup-token` step needs the **`claude` CLI**: `npm i -g @anthropic-ai/claude-code`) or a **`.env`** file (copy `.env.example` → `.env`; gitignored). `.env.example` lists all three accepted vars — `CLAUDE_CODE_OAUTH_TOKEN`, then `ANTHROPIC_API_KEY`, then `ANTHROPIC_AUTH_TOKEN` — in that precedence order.
+   - **Resolution order:** exported env > `--dotenv <path>` > `./.env` (cwd) > `<install>/.env` (the package root) — so a `npm link`ed install works from any directory. (Use `--dotenv`, not `--env-file` — Node reserves the latter.)
+   - **Explicit beats best-effort:** that chain is about *precedence*, not error recovery. A `--dotenv` path you passed explicitly must be readable — if it is missing, unreadable, or a directory, the run stops with a usage error rather than quietly falling through to `./.env` and running against different credentials. The automatic `./.env` / `<install>/.env` locations remain best-effort.
+   - **Placement:** keep `.env` at a working-dir or install root, never inside a mounted skill/project folder.
+   - **Global install:** find the package root with `` `$(npm root -g)/cowork-harness` `` (e.g. `$(npm root -g)/cowork-harness/.env`) — or simpler, just use `--dotenv <path>` / `./.env` in your working directory, which take priority over the package root anyway.
 
 > `sync` (below) is **optional for a first run** — the repo ships `baselines/desktop-*.json`, so `baseline: latest` already resolves. Run `sync` only to refresh the platform baseline after Claude Desktop updates. (`sync` is **macOS-only** today; on Linux/Windows use the committed baselines — they work cross-platform.)
 
@@ -398,7 +402,7 @@ Skill testing is the headline use, but the tool is a general harness over the Co
 | `record` / `replay` | **Record a live run once → replay it token-free, Docker-free thereafter** (key flags below; `replay --explain` prints the evidence behind every passing assert) | **token-free, Docker-free CI** from a once-recorded run |
 | `verify-cassettes <file\|dir>` | Token-free CI gate over committed cassettes: a privacy scan (email/currency/domain/path/machine-inventory) + a staleness check (allowlist and skip flags below); a dir argument scans `*.cassette.json` non-recursively | gating **committed cassettes** against PII leaks + "edited the skill, forgot to re-record" |
 | `verify-run <run-dir> <scenario.yaml>` | Re-evaluate a scenario's `assert:` (and, when the scenario declares `answers:`, whether they still match the run's actual gates) against an already-kept run dir — **no live agent, no tokens, no Docker** (~1s) | iterating on a wrong assertion or a drifted `answer` without a full live re-record |
-| `trace <run-id>` | Digest a run's `events.jsonl` (`--view tools\|questions\|dispatches\|tool-durations\|tool-errors\|files\|usage`; `--translate-paths` rewrites VM paths to host paths in the text `tools`/default views; `--full-results` captures the full input + result of every tool call — successful ones too, not just errors — so an external grader can ground a self-critique finding against the call it cites) | "how many sub-agents *actually* dispatched, and which?" — per-tool call/timing stats with `--view tool-durations`, full stderr per failed call with `--view tool-errors`, a workspace-file diff with `--view files`, or per-model token/cost with `--view usage` |
+| `trace <run-id>` | Digest a run's `events.jsonl` (`--view tools\|questions\|dispatches\|tool-durations\|tool-errors\|files\|usage\|subagent-research`; `--translate-paths` rewrites VM paths to host paths in the text `tools`/default views; `--full-results` captures the full input + result of every tool call — successful ones too, not just errors — so an external grader can ground a self-critique finding against the call it cites) | "how many sub-agents *actually* dispatched, and which?" — per-tool call/timing stats with `--view tool-durations`, full stderr per failed call with `--view tool-errors`, a workspace-file diff with `--view files`, per-model token/cost with `--view usage`, or each dispatch's own WebSearch query+result with `--view subagent-research` (live/record lane) |
 | `inspect <run-id>` | Show what a run **produced**: the artifacts + a shallow field preview of each JSON artifact (`--output-format json` for a digest). Works on a salvaged partial run too | "did it do the job?" — without hand-parsing `…/mnt/outputs/…` |
 | `scaffold <run-id>` | Turn a kept run into a starter scenario YAML (gates→answers, artifacts→`file_exists`) | authoring a scenario from a real run instead of guessing |
 | `python3 …/scenario.py scaffold --name <name> --skill <dir>` | Generate a starter scenario skeleton from scratch (the `…` is `.claude/skills/cowork-harness/scripts/`) | starting a new scenario when you have no prior run |
@@ -415,8 +419,8 @@ Skill testing is the headline use, but the tool is a general harness over the Co
 | `boundary-check [baseline] [--session <file>]` | Prove the **L1 Docker** sandbox enforces Cowork's limitations (sealed FS + default-deny egress; `container`/`hostloop` share this sandbox — `microvm`'s guest firewall is not probed here); `--session` folds a session's `egress.extra_allow` into the probe allowlist | verifying the harness's own fidelity |
 | `sync` / `list` | Derive/refresh (`sync [--diff] [--allow-empty\|--force]`) & list platform baselines from the Desktop install | after Claude Desktop updates (baselines ship, so it's optional otherwise) |
 | `diff <a> <b>` | Compare two baselines, two runs, two cassettes, or a run+cassette — kind auto-detected by content (view/normalization flags below). Token-free, no live Desktop/Docker needed | "what changed between two runs/cassettes/baselines?" |
-| `critique <skill-folder>` | **EXPERIMENTAL.** Run a skill, ask the agent what confused it, then grade that self-report against a frozen record of the run — blinded evaluator, mechanical citation checking. Accepts the `skill` flags a graded run needs — `--upload`/`--folder`/`--plugin` reach both spawned turns, `--answer`/`--decider-*` the graded turn only; anything that can't work is refused with a reason (full table in `critique --help`). Discovery instrument, never a gate (findings always exit 0). Costs four model workloads; see [docs/critique.md](./docs/critique.md) | "what confused the agent about my skill?" — including "does it even see the attached document?" |
-| `doctor [--tier <t>]` | Read-only prerequisite check, per tier (Docker + agent image for `container`/`hostloop`/`cowork`; **Lima** for `microvm`; plus staged agent, token, baseline); prints the exact `docker build` line if the agent image is missing | "can I run the live tiers — what's missing?" before a first live run |
+| `critique <skill-folder>` | **EXPERIMENTAL.** Run a skill, ask the agent what confused it, then grade that self-report against a frozen record of the run — blinded evaluator, mechanical citation checking. Accepts the `skill` flags a graded run needs — `--upload`/`--folder`/`--plugin` reach both spawned turns, `--answer`/`--decider-*` the graded turn only; anything that can't work is refused with a reason (full table in `critique --help`). Runs at `--fidelity container` (default) or `hostloop` (a writable `--folder` there additionally needs `--allow-host-writes`); `microvm`/`protocol`/`cowork` are refused, each with a stated reason. A multi-skill plugin needs `--skill <name>` (refused pre-spend otherwise). Persists `critique-report.json` + the armored evidence package to the run dir (`--out` copies the report; a salvage file lands on exit 2), reports per-critique cost across all four workloads, and stamps each finding with a cross-input `findingFingerprint`. Discovery instrument, never a gate (findings always exit 0). Advisory — a discovery lead, not an independent attestation (the skill under review can steer the grade). See [docs/critique.md](./docs/critique.md) | "what confused the agent about my skill?" — including "does it even see the attached document?" |
+| `doctor [--tier <t>]` | Read-only prerequisite check, per tier (Docker + agent image for `container`/`hostloop`/`cowork`; **Lima** for `microvm`; plus staged agent, token, baseline); prints the exact `docker build` line if the agent image is missing, and — for a **pulled** agent image — warns (advisory, best-effort) when its digest doesn't match the current published GHCR `:2`, so you can re-pull | "can I run the live tiers — what's missing?" before a first live run |
 | `migrate-run-dir [<runs-dir>] [--scenario <name>] [--write]` | Convert pre-layout run dirs (artifacts at the run-dir root) to the per-turn `turns/<N>/` layout, in place — **dry-run by default**, preserving the mtimes `stats`/`--latest-for` rank by, and refusing any dir it cannot resolve rather than guessing | upgrading a runs root written by an older version, so `verify-run`/`diff`/`inspect` can read it again; `--scenario` scopes it so you can migrate one, verify, then do the rest |
 | `prune [<runs-dir>] [--keep-last <n>] [--pinned-older-than <N>d\|h\|m]` | Prune accumulated run dirs (keeps the N most recent per scenario; pinned `--session-id` runs are never pruned unless `--pinned-older-than` opts in to reclaiming stale ones by last-activity age); the optional positional overrides the runs root; `--dry-run` | the machine-global runs root has grown and you want space back |
 | `rehash <dir/>` | Migrate cassette fingerprints to the current format version when the content is provably unchanged (`--dry-run`); no re-record needed | a cassette-format bump flagged committed fixtures as stale |
@@ -686,13 +690,14 @@ jobs:
           anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
 ```
 
-Every run writes a Markdown verdict table (scenario, pass/fail, signals, cost/turns when available, staleness findings, and the replay-skipped-assertions honesty line) to the job summary. Inputs: `command`, `path` (required), `version` (npm dist-tag/version, default `latest` — intentional so recipes track the current release; pin an exact version for reproducible CI. The companion skill's `cowork-harness@>=1.7.0` floor guidance applies to ad-hoc CLI installs, not this input), `strict` (applies to `replay` (staleness findings), `lint`/`lint-skill` (WARN/INFO), and `analyze-skill` (any advisory finding); IGNORED — not forwarded — for `verify-cassettes`/`run`, which don't accept the flag), `fail-on-skill-drift` (**`replay`-only** — never forwarded to the analyzers), `extra-args`, `summary` (default `true`), `anthropic-api-key` (live lane only). See [`action.yml`](./action.yml) for the full input reference.
+Every run writes a Markdown verdict table (scenario, pass/fail, signals, cost/turns when available, staleness findings, and the replay-skipped-assertions honesty line) to the job summary. Inputs: `command`, `path` (required), `version` (npm dist-tag/version, default `latest` — intentional so recipes track the current release; pin an exact version for reproducible CI. The companion skill's `cowork-harness@>=1.8.0` floor guidance applies to ad-hoc CLI installs, not this input), `strict` (applies to `replay` (staleness findings), `lint`/`lint-skill` (WARN/INFO), and `analyze-skill` (any advisory finding); IGNORED — not forwarded — for `verify-cassettes`/`run`, which don't accept the flag), `fail-on-skill-drift` (**`replay`-only** — never forwarded to the analyzers), `extra-args`, `summary` (default `true`), `anthropic-api-key` (live lane only). See [`action.yml`](./action.yml) for the full input reference.
 
-The provided [GitHub Actions workflow](.github/workflows/ci.yml) runs a **six-stage pipeline**. The **unit** stage is the token-free gate you can copy into your skill repo; the `action-self-test`, `python`, `boundary`, `scenarios`, and `parity-drift` stages are this repo's own fidelity self-tests and are not directly portable (they build the harness's Docker image and run harness-specific e2e scenarios — see [`ci-recipe.md`](./.claude/skills/cowork-harness/references/ci-recipe.md) for the skill-repo template):
+The provided [GitHub Actions workflow](.github/workflows/ci.yml) runs a **seven-stage pipeline**. The **build** + **test** stages are the token-free gate you can copy into your skill repo; the `action-self-test`, `python`, `boundary`, `scenarios`, and `parity-drift` stages are this repo's own fidelity self-tests and are not directly portable (they build the harness's Docker image and run harness-specific e2e scenarios — see [`ci-recipe.md`](./.claude/skills/cowork-harness/references/ci-recipe.md) for the skill-repo template):
 
 | Stage | Runs | Needs | Gates |
 |---|---|---|---|
-| **unit** | format check · typecheck · unit tests · build · CLI smoke · token-free `replay` · `verify-cassettes` · `lint` | nothing | every push/PR |
+| **build** | format check · version-lockstep guard · typecheck · source guards · build · CLI smoke · token-free `replay` · `verify-cassettes` · `lint` | nothing | every push/PR |
+| **test** | the unit suite (vitest), sharded 4-way | nothing | every push/PR |
 | **action-self-test** | packs this commit and runs the packaged `uses: ./` Action against the committed example-pdf-skill cassette (pass case) + a nonexistent path (fail case) | nothing | every push/PR |
 | **python** | `pytest` helper self-checks (`python/`, run with `-m 'not cowork'` — the token-free subset; the Docker/token `@pytest.mark.cowork` tests are excluded) | nothing (token-free assertions only) | every push/PR |
 | **boundary** | builds the pinned agent image, brings up the default-deny network, runs `boundary-check`, then `npm run test:live` (live contract tests that guard the binary-resolution assumptions, no token needed) | Docker, arm64 runner | proves the sandbox enforces Cowork's limits — **no API key** |
@@ -815,6 +820,7 @@ a global install has them locally too, not just on GitHub.
 | [docs/chat.md](./docs/chat.md) | The interactive `chat` REPL — multi-turn debugging, flags, attaching files/folders. |
 | [docs/debugging.md](./docs/debugging.md) | Debugging a run — `inspect`/`trace`/`verify-run`/`diff`/`chat` for a misbehaving skill; the false-green hunt for a green you don't trust; and the **iterate-across-fixes verification loop** (ground findings in run evidence; pair by `fingerprint.skillHash`). |
 | [docs/cassette.md](./docs/cassette.md) | `record`/`replay` cassettes — what replay checks, which assertions are skipped. |
+| [docs/critique.md](./docs/critique.md) | **EXPERIMENTAL** — `critique`: run a skill, ask the agent what confused it, then grade that self-report against a frozen record. Its verdict is an advisory lead, not an attestation. |
 | [docs/run-status.md](./docs/run-status.md) | Checking whether a background run is alive — the `status.json` file + `cowork-harness status [--follow]`. |
 | [docs/stats.md](./docs/stats.md) | The `stats` command + `index.jsonl` — querying pass rate, cost/duration/token/turn percentiles, and last-green across every past run. |
 | [docs/gotchas.md](./docs/gotchas.md) | Troubleshooting FAQ — exit 127, empty skill mount, arm64 Docker issues, git-worktree token traps, scenarioDrift after an edit, plus skill-authoring/host-loop footguns. |

package/RELEASING.md

@@ -104,10 +104,12 @@ tagging `1.0.0`, deliberately review and freeze the surfaces with no machine-rea
    `npx "cowork-harness@>=X.Y.Z"`).
 5. `.claude/skills/cowork-harness/references/scenario-schema.md` → the
    "Tracks `cowork-harness X.Y.Z`" line.
-6. `.claude/skills/cowork-harness/references/fidelity-and-answers.md` → the
-   "Tracks `cowork-harness X.Y.Z`" line.
+6. `.claude/skills/cowork-harness/references/fidelity-and-answers.md` and
+   `.claude/skills/cowork-harness/references/task-recipes.md` → the
+   "Tracks `cowork-harness X.Y.Z`" line in each.
 7. The baseline these track (`tracks-harness … (baseline desktop-<ver>)`) — keep in sync with the
-   newest `baselines/desktop-*.json`.
+   newest `baselines/desktop-*.json`. The `check:versions` guard enforces this for SKILL.md, every
+   `references/*.md` baseline pin, and DESIGN.md's current-state sentence — a lagging pin reds CI.
 8. `.claude/skills/cowork-harness/references/ci-recipe.md` → all `npm i -g "cowork-harness@>=X.Y.Z"` floors
    (currently 3 occurrences).
 9. `examples/replays/README.md` → the `npm i -g "cowork-harness@>=X.Y.Z"` floor.
@@ -185,5 +187,5 @@ tagging `1.0.0`, deliberately review and freeze the surfaces with no machine-rea
   (`git tag -d vX.Y.Z`), re-create it on the correct commit, and push it.
 - The live `scenario suite` CI stage runs on **same-repo** PRs (where the `ANTHROPIC_API_KEY` secret is
   available) and on pushes to `main`; it is skipped only on **fork** PRs (or when the secret is unset). So
-  a same-repo release-branch PR DOES exercise the live suite and spend API budget — the `unit` + `boundary`
-  stages alone are sufficient to gate a release if you'd rather not.
+  a same-repo release-branch PR DOES exercise the live suite and spend API budget — the `build` + `test` +
+  `boundary` stages alone are sufficient to gate a release if you'd rather not.