cowork-harness 1.7.0 → 1.9.0

package/.claude/skills/cowork-harness/SKILL.md

@@ -3,8 +3,8 @@ name: cowork-harness
 description: Test or debug a Claude Code skill/plugin under Claude Cowork's runtime — sandboxed agent, default-deny egress, the can_use_tool permission/question protocol — using the cowork-harness CLI. Use when validating or regression-testing a skill, authoring or debugging a scenario YAML (prompt + scripted answers + assert:), choosing a fidelity tier, scripting AskUserQuestion / tool-permission answers, or asserting artifacts, egress, or sub-agent dispatch. Especially when a harness run no-ops an assertion, fails on an unanswered gate, false-greens, a steered answer never reaches the model, or a web_fetch is unexpectedly denied or gated. Also when iterating or hardening a skill across fixes, or grounding a skill's self-critique against its own run evidence — including a document-analysis skill (cap table, deck, financial model, transcript) that needs an uploaded file attached to be critiqued at all. NOT for generic unit testing (pytest/vitest of your own scripts) or non-Cowork CI. Covers the skill / run / chat / record / replay / trace / decide / assertions / scaffold commands and the session-vs-scenario split.
 metadata:
   author: cowork-harness
-  version: 1.7.0
-  tracks-harness: cowork-harness 1.7.0 (baseline desktop-1.24012.1)
+  version: 1.9.0
+  tracks-harness: cowork-harness 1.9.0 (baseline desktop-1.24012.1)
 ---
 
 # cowork-harness
@@ -22,7 +22,7 @@ flagged with a loud `::warning::`, not silent — auto-answer a gate, observe an
 allowlist). This skill exists mostly to keep you out of those traps — the Gotchas section below is
 the highest-value part. Read it.
 
-> **Version note:** the facts and `file:line` pointers here track `cowork-harness 1.7.0` (baseline
+> **Version note:** the facts and `file:line` pointers here track `cowork-harness 1.9.0` (baseline
 > `desktop-1.24012.1`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
 > `SPEC.md` / `docs/*.md` over this snapshot, and re-run the bundled linter.
 
@@ -39,9 +39,42 @@ Before the first command, confirm the CLI is reachable and **fail loud** (never
 
 - **One-shot check.** Run `cowork-harness doctor [--tier <tier>]` first — a read-only prerequisite check that inspects Docker, the staged agent, the token, and the baseline in one pass. The bullets below explain each thing it checks (and how to fix it).
 - **Replay-only? Skip `doctor`.** Replaying committed cassettes needs no Docker, no staged agent, and no token — and every tier's `doctor` validates the auth token (the live tiers also Docker + the staged agent), so a ✗ there is expected, not a blocker. Go straight to `cowork-harness replay <cassette>`.
-- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 1.7.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@>=1.7.0" <cmd>` (Node ≥ 20), or install once with `npm i -g "cowork-harness@>=1.7.0"`. **Pin `@>=1.7.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
-
-  What the ≥ 1.7.0 floor gates, by release:
+- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 1.9.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@>=1.9.0" <cmd>` (Node ≥ 20), or install once with `npm i -g "cowork-harness@>=1.9.0"`. **Pin `@>=1.9.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
+
+  What the ≥ 1.9.0 floor gates, by release:
+
+  - **1.9.0 (critique report schema + shareable, screenshot-safe output):**
+    `schema/critique-report.json` (descriptive, test-pinned — parse the report against it, not prose;
+    NOT §12-frozen while critique is EXPERIMENTAL), `gradedSkill` in the report (text header + JSON;
+    multi-skill pairing key — pair by `(gradedSkillHash, gradedSkill)`, since the hash alone keys the whole
+    plugin and cross-pairs its skills). Critique's text report and stderr diagnostics now **collapse host
+    paths to `~`** (a shared report or screenshot no longer leaks the username + filesystem layout; the JSON
+    report and persisted-artifact paths stay raw for machine consumers), a **missing or non-directory skill
+    folder is refused pre-spawn** (fast exit 2, no stray run dir left behind), and the report header + stderr
+    prefixes now read **`critique:`** (were `skill-critique:`).
+
+  - **1.8.0 (critique hardening + hostloop unpin):** `critique --skill <name>` (multi-skill-plugin
+    grading — a plugin root with no `--skill` is refused pre-spend; the evidence package gains the
+    invoked skill's `agents/<name>.md` + bounded `references/*.md` CONTENT), run-dir artifacts
+    (`critique-report.json` always, `critique-evidence-package.txt` when the evaluator ran,
+    `critique-salvage.json` on exit 2) + `--out <path>`, per-critique `costUsd` across all four
+    workloads, `findingFingerprint` per item (cross-INPUT clustering; HIGH-precision
+    LOW-recall — a match proves reproduction, a mismatch does NOT prove non-reproduction, the same
+    finding reworded fingerprints differently; skillHash stays the cross-FIX
+    key), gate-answer `--answer` echo in the report, per-item-tolerant evaluator parse
+    (`droppedEvaluatorItems`), `skillMdTruncated` (a readable-but-oversized SKILL.md is flagged
+    "graded a cut copy" — distinct from missing/unreadable), `subagents[].webSearches` +
+    `trace --view subagent-research` (live/record lane), and the hostloop uploads-bullet fix (Read of
+    an uploaded file at the advertised path works — no copy-into-outputs workaround needed). Also:
+    **`critique --fidelity hostloop`** (the container-tier pin is lifted — resume-continuity proven
+    live on the native binary; `microvm`/`protocol`/`cowork` stay refused, each with a tagged reason),
+    **`skill --allow-host-writes`** (hostloop writable-folder consent; `critique` forwards it to both
+    turns), `verdictProvenance` stamped on every critique report (advisory self-run, not an
+    attestation), evidence caps 64KB SKILL.md / 32KB transcript / 144KB package (a flagship-sized
+    SKILL.md grades untruncated; ~2–2.5× evaluator cost on large skills), pinned sessions stamp their
+    fidelity and a cross-tier `--resume` fails loud pre-spawn, and `doctor`'s advisory
+    `image-freshness` check (pulled agent image behind the published GHCR one → warn + re-pull
+    remedy).
 
   - **1.7.0 (per-turn run-directory layout, single shape):** every run dir — `run`/`skill`/`chat`,
     single-turn or multi-turn (any `--session-id` + `--resume`, and **every `critique`**: task turn +
@@ -61,8 +94,9 @@ Before the first command, confirm the CLI is reachable and **fail loud** (never
   - **1.7.0 (limitation provenance):** every `critique` limitation in `critique --help` and
     docs/critique.md is tagged with WHY it exists — `[structural]` (permanent), `[unverified]` (unproven,
     **not** known-impossible), `[deliberate]`, `[not-built]`. **Read the tag before telling a user to
-    design around a limitation.** In particular `critique`'s container-tier pin is `[unverified]`, not
-    permanent: do not advise building a second hostloop test lane on the assumption it can never lift.
+    design around a limitation.** Worked example of why the tag matters: `critique`'s container-tier pin
+    was tagged `[unverified]`, not permanent — and 1.8.0 lifted it (hostloop allowed, see above) exactly
+    as the tag predicted a proof could.
 
   - **1.6.0 (`critique`'s skill-flag parity):** `critique` accepts most `skill` flags under the same names,
     which is what makes a document-analysis skill (cap table, deck, financial model, transcript)
@@ -414,7 +448,9 @@ cassette — has its own recipe:
    input + result are captured, not just errored ones. When iterating, tag generations with `--label` and
    pair a critique only with a `result.json` whose `fingerprint.skillHash` **matches** the skill that
    produced it (`inspect`/the run-index row surface a short `skillHash` prefix; `verify-run` warns when a
-   kept run predates the current skill). **On a pre-1.5.0 CLI the `skill` lane emits no `fingerprint.skillHash` at all**, so a
+   kept run predates the current skill). **Multi-skill plugin caveat (post-1.7.0 CLIs with `--skill`):**
+   skillHash keys the whole MOUNTED plugin, so on a multi-skill plugin the hash alone cross-pairs
+   critiques of DIFFERENT skills — pair by the report's `(gradedSkillHash, gradedSkill)` pair. **On a pre-1.5.0 CLI the `skill` lane emits no `fingerprint.skillHash` at all**, so a
    pairing step there silently groups on an absent key instead of erroring — check the field is present, or
    require ≥ 1.5.0. See `docs/debugging.md`
    (repo-only) for the full loop.
@@ -679,9 +715,15 @@ repeats the assertion/replay-relevant ones alongside the schema (a scoped subset
 7. **`protocol` is rejected (not silently passed) if the scenario asserts egress** — boundary
    assertions need a sandboxed tier (`container`+). Good: this one fails loud by design.
 
-8. **Read-only mounts are enforced; delete-deny is not.** `mode:r` mounts get a real `:ro` bind
-   (a write fails in-guest). But `rw` vs `rwd` (write-but-no-delete on `outputs/` / connected folders) is
-   *not* mount-enforced — `rm` succeeds and is only caught post-hoc by `no_delete_in_outputs`.
+8. **Read-only mounts are enforced; delete-deny is a HARNESS gap — production DOES enforce it.**
+   `mode:r` mounts get a real `:ro` bind (a write fails in-guest). But `rw` vs `rwd`
+   (write-but-no-delete on `outputs/` / connected folders) is *not* mount-enforced **in the harness** —
+   `rm` succeeds and is only caught post-hoc by `no_delete_in_outputs`. **Real Cowork enforces it live:**
+   `rm` under `outputs/` fails `Operation not permitted`, and a skill must request approval via
+   `allow_cowork_file_delete` to delete. Two consequences: a skill should not stage disposable scratch
+   under `outputs/` (in production, cleanup there costs an approval prompt), and a skill's
+   "catch-EPERM-then-request-approval" branch cannot be exercised at any harness tier (the `rm` just
+   succeeds here). Do not read this gotcha as "delete-deny may not be real in production" — it is real.
 
 9. **Keep `.env` out of any mounted folder** — it is copied into the sandbox and the token could
    leak. Put it at a working-dir or install root (token resolution: env > `--dotenv` > `./.env` >

package/.claude/skills/cowork-harness/references/ci-recipe.md

@@ -1,6 +1,6 @@
 # CI recipe — replay vs live lanes
 
-Self-contained reference. Tracks `cowork-harness 1.7.0` (baseline `desktop-1.20186.1`).
+Self-contained reference. Tracks `cowork-harness 1.9.0` (baseline `desktop-1.24012.1`).
 
 **Fastest path: the packaged Action.** One step gets you `replay`/`lint`/`verify-cassettes` plus a PR
 job-summary reporter (verdict table, staleness findings, cost/turns when available):
@@ -13,7 +13,7 @@ job-summary reporter (verdict table, staleness findings, cost/turns when availab
 ```
 
 The Action's `version` input defaults to `latest` — intentional so a copy-pasted recipe tracks the current
-release; pin an exact version (e.g. `version: "1.7.0"`) for reproducible CI.
+release; pin an exact version (e.g. `version: "1.9.0"`) for reproducible CI.
 
 Reach for the manual multi-step form below only when you need per-step control the Action's inputs don't
 cover (a custom flag combination, a different runner matrix per step, or `lint`/`verify-cassettes` gated
@@ -57,7 +57,7 @@ sha256-*checked* but not hard-blocking on mismatch — it's advisory for an inte
 GitHub-hosted runners, no token/Docker/agent:
 
 ```yaml
-- run: npm i -g "cowork-harness@>=1.7.0"
+- run: npm i -g "cowork-harness@>=1.9.0"
 - run: cowork-harness lint scenarios/*.yaml          # no silent false-greens
 - run: cowork-harness verify-cassettes cassettes/    # privacy + staleness
 - run: cowork-harness replay cassettes/              # token-free content/structure
@@ -197,7 +197,7 @@ jobs:
         with: { node-version: '20' }
       - uses: actions/setup-python@v5
         with: { python-version: '3.x' }                                       # python3 only — PyYAML is bundled with the linter
-      - run: npm i -g "cowork-harness@>=1.7.0"
+      - run: npm i -g "cowork-harness@>=1.9.0"
       - run: cowork-harness lint scenarios/*.yaml                              # no-silent-false-green (needs python3; PyYAML bundled)
       - run: cowork-harness verify-cassettes cassettes/ --output-format json   # privacy + staleness gate
       - run: cowork-harness replay cassettes/ --output-format json             # token-free content/structure
@@ -226,7 +226,7 @@ jobs:
             echo "live=true" >> "$GITHUB_OUTPUT"
           fi
       - if: steps.guard.outputs.live == 'true'
-        run: npm i -g "cowork-harness@>=1.7.0"
+        run: npm i -g "cowork-harness@>=1.9.0"
       - if: steps.guard.outputs.live == 'true'
         run: cowork-harness run scenarios/ --output-format json
         env:

package/.claude/skills/cowork-harness/references/fidelity-and-answers.md

@@ -1,6 +1,6 @@
 # Fidelity tiers & answer paths
 
-Self-contained reference. Tracks `cowork-harness 1.7.0` (baseline `desktop-1.20186.1`).
+Self-contained reference. Tracks `cowork-harness 1.9.0` (baseline `desktop-1.24012.1`).
 
 ## Fidelity tiers (`fidelity:` in the scenario)
 
@@ -24,6 +24,22 @@ Self-contained reference. Tracks `cowork-harness 1.7.0` (baseline `desktop-1.201
   `skill` (any tier) and `chat` (`protocol`/`container`/`hostloop`; only `microvm`/`cowork` unsupported); `run` rejects an extra `--fidelity`
   positional ("Fidelity is set by the scenario's `fidelity:` field, not a flag").
 
+### hostloop paths: what Read sees vs what bash sees (uploads included)
+
+At `hostloop` the native file tools (Read/Write/Edit/Glob/Grep) run **on the host** and are gated by a
+path-containment hook (production's own model), while `mcp__workspace__bash` runs **in the VM sidecar**
+and sees `/sessions/<id>/...` paths. Consequences an agent (or a debugging author) must know:
+
+- A `/sessions/...` path handed to `Read` fails ("is a VM path") — that split is **production-faithful**,
+  not a harness bug. Translate via the prompt's path-mapping table.
+- **Uploads ARE Read-able at hostloop**: the staged uploads dir on the host is in the containment
+  allowlist (read-only — writes/edits there are blocked, matching production). If a Read of an uploads
+  path fails "outside this session's connected folders", the path *form* is wrong (e.g. a relative
+  `mnt/uploads/...`, which resolves against the outputs cwd) — the file itself is reachable at the
+  staged host uploads dir; it does not need to be copied into `outputs/` first.
+- In real Cowork an upload is a **hardlink** in the session's uploads dir; the harness **copies** it
+  instead. Read-reachability is the same; only the advertised parent dir can differ.
+
 ### `microvm` prerequisites & lifecycle
 
 Requires macOS on arm64 and Lima (`brew install lima`; binary expected at

package/.claude/skills/cowork-harness/references/scenario-schema.md

@@ -1,7 +1,7 @@
 # Scenario & session schema, assertion catalog, web_fetch, full gotchas
 
-Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 1.7.0`
-(baseline `desktop-1.20186.1`). If your checkout is newer, prefer the live `docs/scenario.md`,
+Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 1.9.0`
+(baseline `desktop-1.24012.1`). If your checkout is newer, prefer the live `docs/scenario.md`,
 `docs/session.md`, and `SPEC.md`.
 
 **Minimal scenario** — `prompt` is the only required field:

package/.claude/skills/cowork-harness/references/task-recipes.md

@@ -1,8 +1,8 @@
 # Task recipes — end-to-end paths for the jobs consumers actually do
 
 Each recipe composes facts that live scattered across SKILL.md and the other references into one
-decision path. Every one answers a question a real fleet owner had to work out the hard way. Facts track the harness version in SKILL.md's
-front-matter (currently 1.5.0). Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
+decision path. Every one answers a question a real fleet owner had to work out the hard way.
+Tracks `cowork-harness 1.9.0` (baseline `desktop-1.24012.1`), same as SKILL.md's front-matter. Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
 Recipe 3's `init-redact` shipped in 0.24.0 and are part of the current feature set — no version gate
 needed if your CLI meets SKILL.md's version floor.
 

package/CHANGELOG.md

@@ -6,6 +6,255 @@ All notable changes to this project are documented here. The format is based on
 
 ## [Unreleased]
 
+## [1.9.0] — 2026-07-24
+
+### Added
+
+- **`schema/critique-report.json`** — a descriptive, test-pinned schema for `critique`'s JSON report /
+  `critique-report.json` artifact, so automation consumers (budget pacers gating on `costUsd.complete`,
+  harvesters) parse field names/shapes from a schema instead of prose. Deliberately **not** a SPEC
+  §12-frozen surface (unlike `doctor.json`) — critique is EXPERIMENTAL and additive field changes are
+  expected; the schema says so in its own description, and a two-way sync test pins it against the
+  actual report builder on every branch (findings / infraFailure / evaluatorError).
+- **`gradedSkill` in the critique report** (text header + JSON): the resolved `skills/<name>` the
+  packager graded under `--skill`/auto-selection. Load-bearing for multi-skill plugins:
+  `gradedSkillHash` keys the whole mounted plugin, so pairing by hash alone cross-pairs critiques of
+  *different* skills — pair by `(gradedSkillHash, gradedSkill)`. Docs updated accordingly.
+
+### Docs
+
+- Truncation→DROPPED mechanics: a finding whose `evidence` quotes SKILL.md text past the packaging cap
+  fails citation-resolution and lands in DROPPED (the check runs against the *cut* copy) — documented
+  next to `skillMdTruncated` so a back-half DROPPED skew on an oversized skill has its cause named.
+- `findingFingerprint` direction-of-inference: high-precision, LOW-RECALL — a match proves
+  reproduction; a mismatch does NOT prove non-reproduction (the same finding reworded fingerprints
+  differently). The Reproduction section says so before anyone concludes "didn't reproduce".
+- Evaluator cost share: the two evaluator passes were ~3/4 of a measured e2e total — the
+  calibrate-then-`--evaluator-model` strategy is now in the cost section and `critique --help`, with
+  the armor-verification-is-default-evaluator-only caveat.
+- SPEC §12 now names the critique report explicitly under **NOT covered**: `schema/critique-report.json`
+  is descriptive (parse against it, not prose) but not the compatibility contract while critique is
+  EXPERIMENTAL — its surface-baseline presence is for change visibility, and it is the promotion
+  candidate on the `doctor.json` template once critique stabilizes. README, llms.txt, and the shipped
+  skill point at the schema and the `(gradedSkillHash, gradedSkill)` pairing rule.
+
+### Fixed
+
+- **critique's "Attached inputs" evidence no longer reports `(none)` when `mounts.json` is corrupt.**
+  `listAttachedInputs` derived connected-folder names from `loadVmPathContext`, which returns `null` for
+  BOTH an absent `mounts.json` (legitimately no mounts) and a present-but-unparseable one (the folder map
+  is UNKNOWN). Uploads already distinguished these (the ENOENT-vs-read-fault split), but folders — which
+  have no fixed-layout fallback — silently collapsed to `[]`, so a corrupt `mounts.json` rendered `(none)`,
+  telling the evaluator "the agent correctly saw no connected folder" when the truth was unknown. It now
+  surfaces a corrupt `mounts.json` as an explicit UNKNOWN note, completing the same
+  confabulation-vs-correct guard the uploads path already applies.
+- **`diff` no longer treats two tool inputs that differ only past the ~2000-char cap as the same call.**
+  `canonicalizeInput` truncated a tool input's canonical JSON to a 2000-char cap and used that truncated
+  string as the tool-sequence equality key, so two `Write`/`Bash` calls sharing a long identical prefix
+  but differing only in the dropped tail compared as `op: "same"` in `diffToolSequence` — a false "no
+  change" that could flip the advisory `diff` exit code to 0. A truncated key now folds in a
+  `#<len>·<sha16>` hash of the full canonical string, so the key depends on the entire content while the
+  visible prefix stays readable in the hunk; both diff sides canonicalize identically, so the comparison
+  stays consistent.
+- **`COWORK_VM_GATEWAY` is now validated as a canonical IPv4 literal.** The L2-microVM gateway override was
+  interpolated verbatim into a root-run guest `iptables -A OUTPUT -d <gateway>` command (via `sh -c`), so a
+  malformed or hostile value could inject shell syntax into privileged provisioning — or, more mundanely,
+  leave the firewall in an unknown state. `vmGatewayIp()` now rejects anything that isn't a canonical IPv4
+  literal (digits-and-dots only, octets 0–255, no leading zeros), failing loud instead of reaching the
+  shell. Operator-set env var, so this is defense-in-depth; no valid gateway value is affected.
+- **The `agent.stderr.log` sink is now flushed before the teardown secret-scrub reads it.** The stderr sink
+  was piped fire-and-forget and never awaited, so bytes still buffered when `scrubRawRunLogs` read the file
+  could land raw *afterwards* — a persisted-secret leak in a narrow teardown window. `LiveAgentSession` now
+  pipes it with `{ end: false }` and ends+awaits it in the same session-teardown drain that already flushes
+  `events.jsonl` / `control-out.jsonl`, so the session generator resolves only after the sink is fully
+  flushed — the scrub always sees the complete log.
+- **`critique` no longer prints raw host paths in its report or diagnostics.** The text report's `run dir:`
+  line, the `inspect <dir>` hints, the write-failure diagnostics, and the echoed skill-folder path all
+  printed absolute `$HOME`-rooted paths, so a shared report or screenshot leaked the username + filesystem
+  layout (it landed in a video frame). critique was the one rendering path in the CLI that never called
+  `tildeify`, while `skill`/`run` scrub unconditionally. Every human-facing path is now collapsed to `~`;
+  the JSON report and persisted-artifact paths stay raw (machine data a consumer feeds back to a tool). The
+  `--demo` rejection is unchanged — it was never the fix — but its reason now notes the report already
+  collapses paths.
+- **`critique` fails fast on a missing or non-directory skill folder.** A typo'd/absent positional folder
+  previously minted a session and spawned the task turn before infra-failing (exit 2), leaving a stray run
+  dir behind. `resolveCritiquedSkillDir` now `existsSync`/`isDirectory`-checks the folder up front — before
+  any session is minted or spawned — so a bad path exits 2 immediately with nothing left on disk. A
+  present-but-`SKILL.md`-less folder still defers to the packager's degraded flow, unchanged.
+- **`critique`'s report header and stderr diagnostics now say `critique:` (were `skill-critique:`).** A
+  leftover label from the `scripts/skill-critique.ts` instrument; the invoked command is `critique`.
+  Cosmetic, no schema change.
+
+## [1.8.0] — 2026-07-23
+
+### Added
+
+- **`check:versions` closes the stale-pin gap a docs audit found.** Three new enforcement surfaces:
+  every companion-skill `references/*.md` `(baseline desktop-X.Y.Z)` pin must match SKILL.md's
+  `tracks-harness` baseline; `task-recipes.md` now carries the same guarded
+  `` Tracks `cowork-harness X.Y.Z` `` stamp as the other references (and is a `bump-version` target);
+  DESIGN.md's one present-tense "currently **X**, per `baselines/desktop-Y.json`" sentence must name the
+  max committed baseline + its `agentVersion` (its dated verification-pass notes stay exempt). A new
+  docs-index sync test keeps README's Documentation table and docs/README.md's Guides table from
+  drifting apart (that drift is how `critique.md` went missing from the README table).
+
+- **`doctor` warns when a *pulled* agent image is behind the published one.** For the
+  `container`/`hostloop`/`cowork` tiers, a new advisory `image-freshness` check compares the local agent
+  image's registry digest against the current published `ghcr.io/yaniv-golan/cowork-agent-base:2` (or
+  `-full`) and warns — with a re-pull + retag remedy — when they diverge. Best-effort and never blocking:
+  a locally-built image (no registry digest), an offline host, `docker buildx` being unavailable, or a
+  custom `COWORK_AGENT_IMAGE` is a quiet skip, never a false "stale"; only a pulled image incurs a network
+  probe. The `doctor --output-format json` envelope gains an `image-freshness` entry (the open
+  `checks[].id` set — SPEC §12 — already permits this).
+- `critique` now stamps `verdictProvenance` on every report (JSON key + text "verdict scope" line): the
+  verdict is an advisory self-run, not an independent attestation.
+- **`critique --skill <name>` — plugin-aware grading.** A multi-skill plugin root (`skills/<name>/SKILL.md`,
+  no root SKILL.md) previously graded a missing file, downgrading every coverage finding to "not
+  adjudicable". `--skill` selects the invoked skill's folder for the packager (selection only — the
+  positional folder is still what both turns mount, and `fingerprint.skillHash` is unchanged: per-plugin,
+  not per-skill); a multi-skill root with no `--skill` is refused **before any model spend**, naming the
+  available skills; a single-skill plugin auto-selects with a notice. The evidence package now also
+  carries the invoked skill's `agents/<name>.md` body and bounded `references/*.md` **content** (not just
+  filenames), and the report carries an advisory `skillInvocationObserved` (false = the graded run's own
+  `skillActivity` never mentions the selected skill).
+- **`critique` persists run-dir artifacts.** Every critique writes `critique-report.json` (the
+  machine-readable report); when the evaluator ran, `critique-evidence-package.txt` (the exact armored
+  corpus it graded against — re-grade a disputed finding offline); on an instrument failure (exit 2),
+  `critique-salvage.json` (the self-report + each evaluator pass's RAW reply captured **pre-parse**).
+  New `--out <path>` also writes the selected-format report to a file. The two `not-built` limitations
+  these close (`evidence-not-persisted`, `report-stdout-only`) are removed from the registry.
+- **Per-critique cost across all four workloads.** The report's `costUsd` sums the task turn, reflection
+  turn, and BOTH evaluator passes (whose usage the transport previously discarded), marked `INCOMPLETE`
+  whenever any workload is unpriced. The header also carries the pinned `fidelity` plus the graded turn's
+  recorded `gradedEffectiveFidelity`/`gradedBaseline`, and the graded run's resolved gate answers are
+  echoed as copy-pasteable `--answer` lines (JSON: `gateAnswers`).
+- **`critique` evaluator parse is per-item tolerant.** One malformed item in an `{"items":[...]}` reply
+  previously discarded the whole document ("no valid JSON found", a broken discovery run). Valid items now
+  survive; malformed ones are dropped AND counted (`droppedEvaluatorItems`, surfaced in both report
+  formats). The integrity canary is recognized by its `idea` alone (a mutated echo still proves
+  instruction-following) and stripped before dedup, so a full-document + canary-only-restatement reply no
+  longer trips the ambiguity throw. Fail-loud preserved: garbage, or all-malformed-with-no-canary, still
+  throws — now naming which field check failed.
+- **Sub-agent research is observable end-to-end.** A sub-agent's WebSearch never enters the main
+  `toolCounts`/`webSearches[]`; its query + result are now captured from the child session transcript as
+  `subagents[].webSearches` (bounded, live/record lane only — absent on replay, and absence is never
+  evidence of no research), surfaced by the new **`trace --view subagent-research`**, and packaged into
+  critique's evidence as a "Sub-agent research" section so "researched" claims are groundable.
+- Each critique item now carries a **`findingFingerprint`** (sha16 over the normalized
+  idea + classification + recommendedAction, deliberately excluding the input-specific evidence excerpt) —
+  clusters the SAME finding across DIFFERENT inputs, complementing `skillHash` (same skill across fixes).
+  docs/critique.md gains a "Reproduction" section documenting the ≥2-run discipline.
+- SKILL.md truncation is now reported distinctly: a readable-but-oversized SKILL.md marks the report
+  `skillMdTruncated` ("the evaluator graded a cut copy") instead of being indistinguishable from a fully
+  packaged one; only missing/unreadable still forces the mechanical "already-covered" downgrade — the
+  `--help`/docs limitation wording now says so.
+
+### Changed
+
+- **Published agent images (`cowork-agent-base` / `cowork-agent-full`) now carry OCI metadata labels**
+  (`org.opencontainers.image.{title,description,source,documentation,licenses}`), so their GHCR package
+  pages render a description, repo link, license, and the "contains no Anthropic binary" provenance note
+  instead of appearing bare. The `publish-image` workflow sets the `full` variant's title/description via
+  `--label` so its page isn't mislabeled by the base image's baked-in defaults.
+- `critique` evidence caps raised: SKILL.md 16KB→64KB, transcript 16KB→32KB, overall package 48KB→144KB
+  (the overall cap sits above the worst-case per-section sum, agents/references/research sections included), so
+  a flagship-sized (~51KB) SKILL.md no longer grades permanently truncated. Increases per-critique evaluator
+  token cost on large skills (~2–2.5×).
+- `sync`'s two code-tripwire warnings (the `getMcpSkillSources` caller-count and MCP-skills-capability
+  checks) now carry a self-contained instruction — re-verify whether MCP servers can contribute skills and
+  whether the harness must model MCP-contributed skill sources — instead of pointing at a reference the
+  published repo does not carry.
+- **Pinned sessions stamp their fidelity tier on `session.json`, and a cross-tier `--resume` fails loud**
+  (pre-spawn, with a "re-run at `--fidelity <stamped>`" remedy). The agent's native conversation store is
+  tier-LOCAL — container persists it under the work tree, hostloop under the host config dir — so resuming
+  a session at a different tier would hand the binary a `--resume` for a conversation its store has never
+  seen. Legacy stampless manifests (pre-dating the stamp) are let through with a warning; every manifest
+  written from now on carries the stamp. `readSessionManifest` gains a required `expectedFidelity`
+  argument.
+
+### Docs
+
+- README documents that the agent images are **published to GHCR** and can be pulled + retagged instead of
+  built from scratch (`:2` floats to the latest release; `:2-<version>` pins an immutable per-release
+  build), and that the harness resolves the *local* tag — so a stale local image shadows the published one;
+  re-pull after upgrading. The `doctor` command row notes the new freshness warning.
+
+### Fixed
+
+- **hostloop uploads bullet advertised a non-readable path.** The dynamic "## Shell access" section
+  rendered the uploads mapping's file-tool side as `dirname(upload.hostPath)` — the user's original
+  source dir, which the path-containment gate does not allow — while the base prompt pointed at the
+  correct staged dir. An agent following the bullet got "outside this session's connected folders" and
+  worked around it via copy-into-outputs + `rm`, tripping a spurious `outputs-delete` fail. The bullet
+  now advertises the staged uploads dir — the SAME hoisted value the path gate allows, so the prompt and
+  the gate cannot disagree. (Live-verified: hostloop `--upload` + Read-tool read succeeds at the
+  advertised path.)
+- The task-turn timeout kill message now names `--timeout` and the 10-minute default; a "missing"
+  SKILL.md report note now points at `--skill` / the invoked skill's folder (the multi-skill-plugin-root
+  cause) instead of only stating the symptom.
+- Shipped-doc corrections that induced field misdiagnoses: the cowork-harness skill's gotcha #8 now states
+  that **production enforces** outputs delete-deny (EPERM + approval) and the harness gap is
+  detection-only; docs/critique.md documents that a WebSearch produces **no search-host entries in the
+  container egress.log** (an `api.anthropic.com`-only log is consistent with research working —
+  live-verified with a first-party capture) and that sub-agent searches don't increment the main
+  `toolCounts.WebSearch`; the shipped fidelity reference explains the hostloop Read-vs-bash path split
+  including uploads readability.
+- **`critique` now runs at `--fidelity hostloop` as well as `container` — the container-tier pin is
+  lifted.** The pin existed because the reflection turn *resumes* the task turn and resume-continuity was
+  only proven for the container Linux ELF; a live two-turn proof at hostloop's **native** agent binary
+  (`test/live-contract.test.ts`, "resume-continuity proof at hostloop") cleared it, and a live
+  `critique --fidelity hostloop` e2e validates the full protocol there. `microvm`/`protocol`/`cowork` stay
+  refused, each with its own stated reason: the single `container-tier-only` limitation is replaced by
+  three tagged ones — `microvm-tier-refused` `[unverified]` (a resume-continuity proof at the microVM guest
+  would lift it), `protocol-tier-refused` `[not-built]` (protocol never plumbs a session id/`--resume`),
+  and `cowork-tier-refused` `[deliberate]` (the synced loop gate would make the graded tier
+  baseline-dependent, adding noise to skillHash-paired generation comparisons).
+- **`skill` accepts `--allow-host-writes`** (and `critique` forwards it to BOTH turns) — the
+  hostloop writable-connected-folder consent that previously only `chat` (its own flag) and `run` (the
+  `allow_host_writes: true` scenario field) could grant; a plain `skill --fidelity hostloop --folder X`
+  was refused with no way to consent at all. Folder-less runs (skill dir + uploads) still need no consent —
+  uploads and skill/plugin mounts are read-only.
+- **`critique`'s spaced flag parser no longer silently grabs the next flag as a value.** `critique
+  <folder> --prompt --output-format json` (a forgotten `--prompt` value) swallowed `--output-format` as the
+  prompt AND dropped the real flag, then ran a four-workload critique on the wrong input. The spaced form
+  now fails loud and points at the equals escape hatch (`--prompt=<value>`) for a value that intentionally
+  starts with `-`.
+- **`critique`'s subprocess byte cap is now one combined stdout+stderr budget.** `boundedSpawn` kept two
+  independent per-stream counters, so a looping or hostile child splitting output across both streams could
+  buffer ~2× the documented cap before either tripped. It now charges both streams against a single budget
+  and slices the terminal chunk to the remaining room, so captured output never exceeds the cap.
+- **`critique`'s verbatim citation-grounding is now case-sensitive.** The mechanical check that drops any
+  finding whose cited evidence is not a verbatim excerpt normalized whitespace AND folded case — so a
+  case-altered (paraphrased) citation resolved as "grounded," weakening the principal defense against
+  evaluator hallucination. It now matches case-exact; whitespace reflow stays tolerated (models reflow
+  spacing when quoting — they don't change case).
+- **critique's "Attached inputs" evidence no longer reports `(none)` when the uploads dir is unreadable.**
+  `listAttachedInputs` caught every `readdirSync` failure identically, so an unreadable uploads dir
+  (`EACCES`/`ENOTDIR`/…) collapsed to the same `(none)` as a legitimately-absent one — telling the
+  evaluator "the agent correctly saw no file" when attachment presence was actually UNKNOWN. It now
+  distinguishes `ENOENT` (absent) from a genuine read fault and surfaces the uncertainty loudly.
+- **critique flags a partly-corrupt archived turn-1 transcript instead of grading it as clean.**
+  `readTurn1Transcript` skipped malformed JSONL rows (resilient) but returned `degraded: false` on the
+  first valid transcript record regardless — so archive corruption vanished from evidence health and the
+  evaluator graded a silently-incomplete transcript as solid ground truth. It now scans the whole
+  (turn-1-only) archive and sets `turn1SliceDegraded` when a malformed row was skipped or the archive
+  doesn't hold exactly one transcript record; the transcript is still delivered, just flagged.
+- **critique flags a crashed task turn instead of grading evidence from it.** `taskTurnInfraFailure` only
+  treated a *killed* (timed-out / byte-capped) task turn as an instrument failure — a task that exited
+  nonzero without ever printing a parseable result envelope (a crash after the early `[status]` line)
+  slipped through, and its `[status]`-recovered run dir was reflected on and graded as a legitimate task.
+  It now also flags a nonzero exit with no parseable envelope. Deliberately narrow: a completed run that
+  reported a failing verdict (`ok:false` / `result:"error"` with a valid envelope) stays gradeable.
+- **A nested unreadable output subtree no longer persists a partial file list as complete.** The
+  `workspaceFiles` / `artifacts` list was recorded as UNAVAILABLE (`undefined`, the evidence-unavailable
+  convention) only when the workspace ROOT was unobservable; a nested `EACCES`/`EIO` subtree left the walk
+  partial (`walkComplete: false`) but still persisted the incompletely-enumerated list as if complete. An
+  authored file inside the unreadable subtree then vanished with no signal, so an absence-sensitive
+  consumer (`delivered_clean` / `ended_with_question`, the replay `diff`, `scaffold`, `file_exists`) could
+  read it as absent — a silent false-clean. All three RunResult producers (run, partial-salvage, chat) now
+  route through one shared `trustedWorkspaceFiles` gate that collapses a missing root OR any incomplete
+  walk to `undefined`, and the run lanes emit a `::warning::` naming the unreadable subtree.
+
 ## [1.7.0] — 2026-07-22
 
 ### Added

package/CONTRIBUTING.md

@@ -12,7 +12,7 @@ npm run format:check  # prettier over src/ + test/ .ts — the most common first
 npm run typecheck     # tsc --noEmit
 npm test              # vitest
 npm run build         # -> dist/
-npm run ci            # typecheck + build + test — the core TS gate (CI's `unit` job runs more; see below)
+npm run ci            # typecheck + build + test — the core TS gate (CI's `build` + `test` jobs run more; see below)
 ```
 
 Before pushing: `npm run format:check` and `npm run ci` (see RELEASING.md's release checklist for the full pre-tag list).
@@ -25,10 +25,11 @@ Extra prerequisites for specific stages:
 - **Docker (arm64)** — required for `boundary-check` and the **L1 `container`** + `hostloop` fidelity tiers (the container sandbox + agent image).
 - **Lima (`limactl`, macOS arm64)** — required only for the **L2 `microvm`** tier and the `vm` commands; the guest runs on Apple Virtualization.framework (`vmType: vz`). `microvm` does **not** use Docker. (`cowork-harness doctor --tier microvm` checks for Lima, not Docker.)
 
-CI Stage 1 (the `unit` job in `.github/workflows/ci.yml`) does **not** invoke `npm run ci`. It runs the
-gate steps individually — e.g. `check:versions`, `format:check`, `typecheck`, `npm test`, `build`, a CLI
-smoke (`node dist/cli.js list`), three token-free `replay` gate fixtures, `verify-cassettes`, `lint`, and
-source-guard checks (see `ci.yml` for the authoritative list). Only `release.yml` calls `npm run ci`.
+CI Stage 1 (the `build` job in `.github/workflows/ci.yml`) does **not** invoke `npm run ci`. It runs the
+gate steps individually — e.g. `check:versions`, `format:check`, `typecheck`, `build`, a CLI smoke
+(`node dist/cli.js list`), three token-free `replay` gate fixtures, `verify-cassettes`, `lint`, and
+source-guard checks — while the unit suite runs separately as the 4-shard `test` job (see `ci.yml` for
+the authoritative list). Only `release.yml` calls `npm run ci`.
 
 > **Cutting a release?** See [RELEASING.md](./RELEASING.md) for the branch → PR → tag → publish flow.
 
@@ -85,7 +86,7 @@ When a Desktop release moves something `sync` doesn't read, it reports an `unkno
 ## Commit & PR
 
 - Conventional, imperative commit subjects (`add …`, `fix …`, `parity: sync to <ver>`).
-- Open PRs against `main`. CI runs a six-stage pipeline (`unit`, `action-self-test`, `python`, `boundary`, `scenarios`, `parity-drift` — see `ci.yml`) on every PR including forks (no secrets needed) except `scenarios`; live scenarios only run on same-repo PRs/pushes with `ANTHROPIC_API_KEY` set.
+- Open PRs against `main`. CI runs a seven-stage pipeline (`build`, `test`, `action-self-test`, `python`, `boundary`, `scenarios`, `parity-drift` — see `ci.yml`) on every PR including forks (no secrets needed) except `scenarios`; live scenarios only run on same-repo PRs/pushes with `ANTHROPIC_API_KEY` set.
 - Describe *what changed and why*; link issues.
 
 ## Reporting issues

package/DESIGN.md

@@ -38,7 +38,7 @@ flowchart TB
 A Cowork session is the Desktop app driving an agent that runs **inside an Apple Virtualization.framework microVM**:
 
 - VM bundle: `~/Library/Application Support/Claude/vm_bundles/claudevm.bundle/` (`rootfs.img`, `sessiondata.img`, `efivars.fd`, `machineIdentifier`, `gvisorMacAddress`, `vmIP`); a warm pool at `vm_bundles/warm/<sha>/`.
-- In-VM agent: `~/Library/Application Support/Claude/claude-code-vm/<ver>/claude` (currently **2.1.205**, per `baselines/desktop-1.20186.1.json`, an **ELF aarch64** binary), spawned by the host **in cowork mode via the `CLAUDE_CODE_IS_COWORK=1` env var** — *not* a `--cowork` flag (that flag is plugin-scope and the staged agent rejects it; see the control-protocol note below). Each baseline records this ELF's `sha256` (`agentBinary.sha256`/`shaProvenance`), and the resolver integrity-checks the binary it's about to run against that hash by default (opt out `COWORK_HARNESS_VERIFY_AGENT_SHA=0`), so "the same pinned agent" is enforced, not just asserted. Old versions are re-downloadable + verifiable from the official release channel (see `docs/maintenance.md`).
+- In-VM agent: `~/Library/Application Support/Claude/claude-code-vm/<ver>/claude` (currently **2.1.217**, per `baselines/desktop-1.24012.1.json`, an **ELF aarch64** binary), spawned by the host **in cowork mode via the `CLAUDE_CODE_IS_COWORK=1` env var** — *not* a `--cowork` flag (that flag is plugin-scope and the staged agent rejects it; see the control-protocol note below). Each baseline records this ELF's `sha256` (`agentBinary.sha256`/`shaProvenance`), and the resolver integrity-checks the binary it's about to run against that hash by default (opt out `COWORK_HARNESS_VERIFY_AGENT_SHA=0`), so "the same pinned agent" is enforced, not just asserted. Old versions are re-downloadable + verifiable from the official release channel (see `docs/maintenance.md`).
 - Network: `vm_network_mode: "gvisor"`, egress through a userspace netstack with a **compiled domain allowlist**; off-list partners rejected (`partner rejected: entry not on compiled allowlist`).
 - Control plane: Electron renderer→main typed IPC on channels named `$eipc_message$_<per-build-UUID>_$_claude.web_$_<Class>_$_<method>`, every handler validating `event.senderFrame.url` against a trusted-origin allowlist. The session manager is `LocalAgentModeSessions` (80 methods: `start`, `sendMessage`, `setDraftSessionFolders`, `onToolPermissionRequest`, `respondToToolPermission`, `getTranscript`, `onEvent`, …), bridged to the renderer as `window.cowork`.