cowork-harness 2.1.0 → 2.2.0

package/.claude/skills/cowork-harness/SKILL.md

@@ -3,8 +3,8 @@ name: cowork-harness
 description: Test or debug a Claude Code skill/plugin under Claude Cowork's runtime — sandboxed agent, default-deny egress, the can_use_tool permission/question protocol — using the cowork-harness CLI. Use when validating or regression-testing a skill, authoring or debugging a scenario YAML (prompt + scripted answers + assert:), choosing a fidelity tier, scripting AskUserQuestion / tool-permission answers, or asserting artifacts, egress, or sub-agent dispatch. Especially when a harness run no-ops an assertion, fails on an unanswered gate, false-greens, a steered answer never reaches the model, or a web_fetch is unexpectedly denied or gated. Also when iterating or hardening a skill across fixes, or grounding a skill's self-critique against its own run evidence — including a document-analysis skill (cap table, deck, financial model, transcript) that needs an uploaded file attached to be critiqued at all. NOT for generic unit testing (pytest/vitest of your own scripts) or non-Cowork CI. Covers the skill / run / chat / record / replay / trace / decide / assertions / scaffold commands and the session-vs-scenario split.
 metadata:
   author: cowork-harness
-  version: 2.1.0
-  tracks-harness: cowork-harness 2.1.0 (baseline desktop-1.34493.1)
+  version: 2.2.0
+  tracks-harness: cowork-harness 2.2.0 (baseline desktop-1.34493.1)
 ---
 
 # cowork-harness
@@ -22,7 +22,7 @@ flagged with a loud `::warning::`, not silent — auto-answer a gate, observe an
 allowlist). This skill exists mostly to keep you out of those traps — the Gotchas section below is
 the highest-value part. Read it.
 
-> **Version note:** the facts and `file:line` pointers here track `cowork-harness 2.1.0` (baseline
+> **Version note:** the facts and `file:line` pointers here track `cowork-harness 2.2.0` (baseline
 > `desktop-1.34493.1`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
 > `SPEC.md` / `docs/*.md` over this snapshot, and re-run the bundled linter.
 
@@ -39,7 +39,7 @@ Before the first command, confirm the CLI is reachable and **fail loud** (never
 
 - **One-shot check.** Run `cowork-harness doctor [--tier <tier>]` first — a read-only prerequisite check that inspects Docker, the staged agent, the token, and the baseline in one pass. The bullets below explain each thing it checks (and how to fix it).
 - **Replay-only? Skip `doctor`.** Replaying committed cassettes needs no Docker, no staged agent, and no token — and every tier's `doctor` validates the auth token (the live tiers also Docker + the staged agent), so a ✗ there is expected, not a blocker. Go straight to `cowork-harness replay <cassette>`.
-- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 2.1.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@^2.1.0" <cmd>` (Node ≥ 22), or install once with `npm i -g "cowork-harness@^2.1.0"`. **Pin `@^2.1.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
+- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 2.2.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@^2.2.0" <cmd>` (Node ≥ 22), or install once with `npm i -g "cowork-harness@^2.2.0"`. **Pin `@^2.2.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
 
   This skill documents the CURRENT surface, not release history. If `cowork-harness --version` is
   OLDER than the floor, the per-release record of what you are missing is [CHANGELOG.md](https://github.com/yaniv-golan/cowork-harness/blob/main/CHANGELOG.md)

package/.claude/skills/cowork-harness/references/ci-recipe.md

@@ -1,6 +1,6 @@
 # CI recipe — replay vs live lanes
 
-Self-contained reference. Tracks `cowork-harness 2.1.0` (baseline `desktop-1.34493.1`).
+Self-contained reference. Tracks `cowork-harness 2.2.0` (baseline `desktop-1.34493.1`).
 
 **Fastest path: the packaged Action.** One step gets you `replay`/`lint`/`verify-cassettes` plus a PR
 job-summary reporter (verdict table, staleness findings, cost/turns when available):
@@ -17,7 +17,7 @@ job-summary reporter (verdict table, staleness findings, cost/turns when availab
 CLI major reaches your workflow the moment it is promoted even though your `uses:` ref never changed — so a
 copy-pasted recipe that omits the input takes a major bump with no say in it. `^2` holds the major, needs no
 patch number to remember, and only wants a human decision at the next major. Pin an exact version
-(e.g. `version: "2.1.0"`) instead when you want byte-reproducible CI.
+(e.g. `version: "2.2.0"`) instead when you want byte-reproducible CI.
 
 Reach for the manual multi-step form below only when you need per-step control the Action's inputs don't
 cover (a custom flag combination, a different runner matrix per step, or `lint`/`verify-cassettes` gated
@@ -67,7 +67,7 @@ sha256-*checked* but not hard-blocking on mismatch — it's advisory for an inte
 GitHub-hosted runners, no token/Docker/agent:
 
 ```yaml
-- run: npm i -g "cowork-harness@^2.1.0"
+- run: npm i -g "cowork-harness@^2.2.0"
 - run: cowork-harness lint scenarios/*.yaml --strict --min-severity WARN
                                                     # no silent false-greens. WITHOUT --strict this
                                                     # step cannot fail on a WARN-class rule (e.g.
@@ -340,7 +340,7 @@ jobs:
         with: { node-version: '24' }
       - uses: actions/setup-python@v5
         with: { python-version: '3.x' }                                       # python3 only — PyYAML is bundled with the linter
-      - run: npm i -g "cowork-harness@^2.1.0"
+      - run: npm i -g "cowork-harness@^2.2.0"
       - run: cowork-harness lint scenarios/*.yaml                              # no-silent-false-green (needs python3; PyYAML bundled)
       - run: cowork-harness verify-cassettes cassettes/ --output-format json   # privacy + staleness gate
       - run: cowork-harness replay cassettes/ --output-format json             # token-free content/structure
@@ -369,7 +369,7 @@ jobs:
             echo "live=true" >> "$GITHUB_OUTPUT"
           fi
       - if: steps.guard.outputs.live == 'true'
-        run: npm i -g "cowork-harness@^2.1.0"
+        run: npm i -g "cowork-harness@^2.2.0"
       - if: steps.guard.outputs.live == 'true'
         run: cowork-harness run scenarios/ --output-format json
         env:

package/.claude/skills/cowork-harness/references/critique.md

@@ -1,6 +1,6 @@
 # Critique — the facts a plugin install can't otherwise reach
 
-Tracks `cowork-harness 2.1.0` (baseline `desktop-1.34493.1`). This is **not** a trim of the full
+Tracks `cowork-harness 2.2.0` (baseline `desktop-1.34493.1`). This is **not** a trim of the full
 [`docs/critique.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/critique.md) (repo-only —
 flags, cost, reproduction discipline, known limitations all live there). This file covers exactly what a
 plugin install cannot otherwise discover: the run-dir artifact a harvester actually reads, the report's

package/.claude/skills/cowork-harness/references/fidelity-and-answers.md

@@ -1,6 +1,6 @@
 # Fidelity tiers & answer paths
 
-Self-contained reference. Tracks `cowork-harness 2.1.0` (baseline `desktop-1.34493.1`).
+Self-contained reference. Tracks `cowork-harness 2.2.0` (baseline `desktop-1.34493.1`).
 
 ## Fidelity tiers (`fidelity:` in the scenario)
 

package/.claude/skills/cowork-harness/references/scenario-schema.md

@@ -1,6 +1,6 @@
 # Scenario & session schema, assertion catalog, web_fetch, full gotchas
 
-Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 2.1.0`
+Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 2.2.0`
 (baseline `desktop-1.34493.1`). If your checkout is newer, prefer the live [`docs/scenario.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/scenario.md),
 [`docs/session.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/session.md), and `SPEC.md`.
 
@@ -342,8 +342,8 @@ same set live from the schema.
 | `all_tasks_completed: true` | every task in `RunResult.tasks[]` reached status `"completed"` — **requires ≥1 task** (a zero-task run fails; assert `task_count_min` for presence); evidence-unavailable if tasks telemetry is absent |
 | `task_count_min: <N>` | at least N tasks were created (`RunResult.tasks.length >= N`) — the presence companion for task assertions |
 | `task_status: {match, status}` | a task whose `subject` OR `id` matches the regex `match` reached `status` — evidence-unavailable if tasks telemetry is absent; also fails **malformed** when a TaskCreate result was unparseable (corrupt task telemetry), mirroring the guard `all_tasks_completed`/`task_count_min` already had |
-| `no_scratchpad_leak: true` | every file presented via `present_files` that was in the scratchpad was successfully promoted to `mnt/outputs` (none left behind) — vacuously passes if nothing was presented (pair with a presence check to require a delivery); content-class: both the `present_files` tool_use and its own tool_result live in the ordinary events stream, so `RunResult.presentedFiles` re-derives identically on replay (meaningfully replay-checkable, same as `skill_triggered`); evidence-unavailable if `presentedFiles` telemetry is absent (an older run predating the feature). **Container-only on the merits**: hostloop serves `present_files` but never promotes (its handler passes a validated path through), so there is no scratch→outputs copy that could leak. On microvm/protocol a scratchpad-delivered file is neither promoted to `mnt/outputs` nor detected there (a skill that delivers via write-to-cwd→`present_files` will false-red `user_visible_artifact` on those tiers; use `container`, or write directly to `outputs/`). Hostloop is not one of them: the agent's cwd there already *is* the outputs dir, so a write-to-cwd delivery is under a user-visible root from the start and `user_visible_artifact` passes. **The tool name is lane-specific:** `present_files` is the desktop-local lane's tool (the one this harness emulates); remote Cowork delivers via the agent-native `SendUserFile` instead, so a skill should describe the delivery outcome rather than naming either tool — this key asserts the harness-side delivery record either way. **Only `true` is valid** |
-| `present_files_called: true` | at least one file was actually delivered via the `present_files` tool (`RunResult.presentedFiles` is non-empty) — the presence companion to `no_scratchpad_leak` (which passes vacuously when nothing was presented). Pair them to require a delivery **and** require it not to leak. Content-class (re-derives identically on replay). **`fidelity: container` or `hostloop`** — the harness serves `present_files` at both (hostloop via a handler mirroring production's own host-loop branch: validate the path, pass it through, no promotion). `protocol` and `microvm` report cannot-verify. See the `no_scratchpad_leak` row, which stays container-only for a different reason; and see the lane note there — the tool name differs on remote Cowork. **Only `true` is valid** |
+| `no_scratchpad_leak: true` | every file presented via `present_files` that was in the scratchpad was successfully promoted to `mnt/outputs` (none left behind) — vacuously passes if nothing was presented (pair with a presence check to require a delivery); content-class: both the `present_files` tool_use and its own tool_result live in the ordinary events stream, so `RunResult.presentedFiles` re-derives on replay at container, where the agent's cwd IS the session root the live lane measures from; at hostloop the live lane measures from the session root while a re-drive has only the recorded cwd (`mnt/outputs`, inside it), so the promoted/leaked booleans there are not equivalent — immaterial to this key, which evaluates at container only (meaningfully replay-checkable, same as `skill_triggered`); evidence-unavailable if `presentedFiles` telemetry is absent (an older run predating the feature). **Container-only on the merits**: hostloop serves `present_files` but never promotes (its handler passes a validated path through), so there is no scratch→outputs copy that could leak. On microvm/protocol a scratchpad-delivered file is neither promoted to `mnt/outputs` nor detected there (a skill that delivers via write-to-cwd→`present_files` will false-red `user_visible_artifact` on those tiers; use `container`, or write directly to `outputs/`). Hostloop is not one of them: the agent's cwd there already *is* the outputs dir, so a write-to-cwd delivery is under a user-visible root from the start and `user_visible_artifact` passes. **The tool name is lane-specific:** `present_files` is the desktop-local lane's tool (the one this harness emulates); remote Cowork delivers via the agent-native `SendUserFile` instead, so a skill should describe the delivery outcome rather than naming either tool — this key asserts the harness-side delivery record either way. **Only `true` is valid** |
+| `present_files_called: true` | at least one file was actually delivered via the `present_files` tool (`RunResult.presentFilesCalls > 0` — the count of invocations that carried a well-formed `file_path`). Presence is read at the **invocation**, deliberately not off the classified `presentedFiles` list: that list drops any path it cannot resolve, and a host-path redaction policy makes that certain at `hostloop`, where a real host path redacts to `[REDACTED:…]/mnt/outputs/f`. So this key is safe to assert in a scenario you intend to `record` with redaction active — `record` refuses a cassette whose verdict redaction changed, and an invocation count cannot be changed by it. A run that called the tool but whose every call carried an unusable path reports **cannot verify**, never a claim of non-delivery. The presence companion to `no_scratchpad_leak` (which passes vacuously when nothing was presented). Pair them to require a delivery **and** require it not to leak. Content-class (re-derives identically on replay). **`fidelity: container` or `hostloop`** — the harness serves `present_files` at both (hostloop via a handler mirroring production's own host-loop branch: validate the path, pass it through, no promotion). `protocol` and `microvm` report cannot-verify. See the `no_scratchpad_leak` row, which stays container-only for a different reason; and see the lane note there — the tool name differs on remote Cowork. **Only `true` is valid** |
 | `question_asked: <regex>` | the agent asked an AskUserQuestion whose **question text** matches (`question`, falling back to `header`). Text only — for the options it offered, use `question_options` |
 | `question_options: {when_question?, equals?, contains?, order?}` | the option SET and ORDER a gate offered — what the user was actually SHOWN. `when_question` selects the sub-question by the same label `question_asked` matches (omit only if exactly one fired; ambiguity FAILS). Exactly one of `equals` (complete set) / `contains` (subset); `order: exact` is the default because a re-ordered list is the defect this exists for. Captured at ask time, so a gate that was shown then denied/stalled still counts; unreadable evidence fails evidence-unavailable |
 | `questions_count_max: <N>` | at most N **sub-questions** asked — a bundled `AskUserQuestion` with K sub-questions counts as K, not 1; `trace --view questions`'s footer total uses the same definition |

package/.claude/skills/cowork-harness/references/task-recipes.md

@@ -2,7 +2,7 @@
 
 Each recipe composes facts that live scattered across SKILL.md and the other references into one
 decision path. Every one answers a question a real fleet owner had to work out the hard way.
-Tracks `cowork-harness 2.1.0` (baseline `desktop-1.34493.1`), same as SKILL.md's front-matter. Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
+Tracks `cowork-harness 2.2.0` (baseline `desktop-1.34493.1`), same as SKILL.md's front-matter. Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
 Recipe 3's `init-redact` shipped in 0.24.0 and are part of the current feature set — no version gate
 needed if your CLI meets SKILL.md's version floor.
 

package/CHANGELOG.md

@@ -4,6 +4,117 @@ All notable changes to this project are documented here. The format is based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). The project uses
 [Semantic Versioning](https://semver.org/); as of 1.0.0, a backwards-incompatible change to a covered surface ([SPEC.md §12](./SPEC.md#12-versioning--the-10-compatibility-contract)) requires a major bump.
 
+## [2.2.0] — 2026-08-25
+
+### Upgrade impact
+
+Two behaviour changes can turn a previously-green run red. Neither breaks a covered surface
+([SPEC.md §12](./SPEC.md#12-versioning--the-10-compatibility-contract)) — both make an assertion report
+what it always documented — so they ship in a minor:
+
+- **`no_scratchpad_leak` at `container` can now FAIL.** It was measuring containment against a root in a
+  different path space, so every presented file classified `leaked: false` and the check passed
+  vacuously. A scenario whose skill genuinely leaves a presented file in the scratchpad will now red —
+  that is the leak the key exists to catch.
+- **`baseline: desktop-1.11847.5` is now refused at `container`/`hostloop`/`microvm`.** It carries no
+  `spawn` block, so those tiers cannot reproduce Cowork's toolset — a run on it launched an agent with no
+  file or bash tools and still reported a verdict. Use a `sync`-recorded baseline, or `fidelity: protocol`.
+
+### Fixed
+
+- **`present_files_called` no longer reports "the tool was never called" about a run that called it, and a
+  hostloop delivery scenario can be recorded with a host-path redaction policy at last.** The assertion
+  read presence off `RunResult.presentedFiles`, which is a *classification* of each presented path
+  (scratchpad? promoted? leaked?) and requires an absolute path to compute. At `hostloop` a presented path
+  is a real host path, so the shipped redaction policy rewrites it to
+  `[REDACTED:local-path:<hash>]/mnt/outputs/report.html` — correct, documented, and deliberately ordered so
+  the mount tail survives — and the classifier then drops every entry as un-normalizable. The list came
+  back empty and the assertion stated, as fact, that the tool had never been called.
+
+  Because `record` replays the base and redacted cassettes and refuses to write when the verdict differs,
+  this was not merely a wrong message: **no cassette asserting `present_files_called` could be recorded at
+  that tier at all**, so the assertion had never executed on the replay lane. The refusal was right — the
+  redacted cassette genuinely could not support the assert — but the defect it was reporting was in the
+  harness, not in the recording.
+
+  Presence now comes from `RunResult.presentFilesCalls`, a new count of the `present_files` invocations
+  that carried a well-formed `file_path`, taken from the tool_use input's shape and never from a path's
+  content, so redaction cannot alter it. Classification is untouched: `presentedFiles` still drops what it
+  cannot resolve, and `no_scratchpad_leak` still reads it. A run recorded before the field falls back to
+  the old `presentedFiles`-non-empty test, so no existing green changes.
+
+  A run whose every `present_files` call carried an unusable path now reports **cannot verify** rather than
+  "never called" — the tool *was* invoked, and the harness already knew it. (The malformed count is
+  deliberately kept out of that message: the record self-check normalizes `[REDACTED…]` tokens out of
+  failing messages but not digits, so an interpolated count that differed between the two replays would
+  refuse a cassette that is otherwise fine to write.)
+
+  Pinned as an invariant ([docs/invariants.md](./docs/invariants.md)) with the end-to-end record self-check
+  as its test anchor — the case that could not be recorded, and so had never run in CI.
+
+- **Guest paths are built from the tree the harness stages, not from a baseline's recorded mount layout.**
+  `resolveMounts` returned `mountLayout.mntRoot` verbatim — or, when that field was absent and the recorded
+  `sessionRoot` already ended in `/mnt`, the session root itself. But the staged tree is always
+  `<sessionRoot>/mnt`: `stageWorkspace` creates it there and `dockerRunArgv` nests its read-only binds
+  there. On a baseline recording anything else, `--plugin-dir` therefore pointed one directory **above**
+  the staged plugin tree, so the plugin under test never loaded. `mntRoot` is now derived from the session
+  root, and a recorded layout the harness cannot stage is reported as a fidelity divergence at spawn
+  instead of silently composing a path no stager creates.
+
+  Guest paths now anchor on `sessionRoot` — the bind target — rather than `cwd`, which is only where the
+  agent's process starts (production's own working directory is a folder mount or `outputs`, so the two are
+  not interchangeable even though every synced baseline records them equal). `dockerRunArgv` takes an
+  explicit `agentCwd` for `-w`.
+
+  Two more derivations of the same rule are gone: `prompt.ts` had a private `/sessions/<id>` +`/mnt`
+  literal (so the prompt could describe a tree the runtimes had not staged), and **microvm** read the
+  agent's root from the baseline when lima structurally mounts it at `/sessions/<sessionId>` — which put
+  `CLAUDE_CONFIG_DIR` and `--mcp-config` at paths nothing stages. A baseline recording a cwd that tier
+  cannot honour is now **refused**, not warned about: the guest `cd` would otherwise succeed at the wrong
+  directory.
+
+- **A baseline with no `spawn` block is refused at the sandbox tiers.** That block carries the tool set,
+  pre-approvals, effort default and config-dir location, and the `?? []` fallbacks meant a run would launch
+  an agent with **no Read/Write/Bash/Skill/Task at all** and still report a verdict. `fidelity: protocol`
+  builds its own argv and is unaffected.
+
+- **`no_scratchpad_leak` can see a container leak again — the session root was in the wrong path space.** The
+  root that `presentedFiles`' promoted/leaked classification is measured from was derived by the caller as
+  `<run-dir>/work/session`, a HOST path, and handed to every non-`protocol` tier. But the path space the
+  agent reports in is per-tier: at `container` (the default) it runs inside the sandbox and reports
+  `/sessions/<id>/…`, and only at `hostloop` does it run natively and report host paths. Measured against a
+  host root, no VM path is ever inside the root, so every presented file classified `leaked: false` —
+  including the handler's copy-failure branch, which returns the source path unchanged when a file is
+  blocked-extension, a directory, or absent. `no_scratchpad_leak` evaluates at `container` and nowhere else,
+  so the assertion that exists to catch that leak could not catch it, and `verdict.ts`'s delivery check read
+  the same `leaked: false` as a successful delivery.
+
+  Each runtime now reports the session root it actually launched the agent with, and the run consumes that
+  instead of deriving a second one — the two can no longer drift into different spaces. `chat` sets it on
+  both serving tiers as well; it never did, so a hostloop chat's `presentedFiles` was inverted in its result
+  file. `protocol` and `microvm` serve no `present_files` and keep the cwd fallback.
+
+  Independently, the classifier now fails CLOSED on a space mismatch: if the agent's cwd is not at or inside
+  the session root, the presented batch counts as malformed (`no_scratchpad_leak` → cannot verify) rather
+  than being graded against a root it cannot be compared to. `leaked: true` is not derivable in that state
+  either, and a `leaked: false` verdict there is exactly the vacuous pass the key exists to prevent.
+
+### Added
+
+- **First live coverage for `present_files_called` / `no_scratchpad_leak`.** No scenario in the repo
+  asserted either key, which is how a session root in the wrong path space could record `leaked: false`
+  for every presented file without anything noticing. `e2e/scenarios/smoke-present-files.yaml` writes a
+  file OUTSIDE `mnt/` and delivers it, so the promotion is real and the pair is non-vacuous; it runs in
+  CI's live e2e loop. Measured on a live container run: `presentFilesCalls: 1`, promoted `true`, leaked
+  `false`.
+
+- **`RunResult.presentFilesCalls`** — the count of `present_files` invocations that carried a well-formed
+  `file_path`, in `result.json` and [schema/run-result.json](./schema/run-result.json). Content-class, so a
+  replay re-drive reproduces it; read by `run`, `replay` and `verify-run` alike, and absent (not `0`) on a
+  result written before this release, which is what the assertion's fallback distinguishes. Use it to
+  answer "did the agent deliver anything?" from a result file without interpreting `presentedFiles`'
+  promoted/leaked classification.
+
 ## [2.1.0] — 2026-08-24
 
 ### Changed

package/README.md

@@ -115,7 +115,7 @@ node dist/cli.js replay examples/replays/example-pdf-skill.cassette.json
 
 > **Installed globally instead?** Once linked/installed, the same command is `cowork-harness replay
 > <cassette>` — but the relative path above only resolves from a source checkout's `examples/replays/`.
-> From a global install (`npm i -g "cowork-harness@^2.1.0"`), point at the package root instead:
+> From a global install (`npm i -g "cowork-harness@^2.2.0"`), point at the package root instead:
 > `cowork-harness replay "$(npm root -g)/cowork-harness/examples/replays/example-pdf-skill.cassette.json"`
 > (or copy the cassette into your own project and pass that path).
 
@@ -125,7 +125,7 @@ Live `run`/`skill` need the prerequisites in the next section — note the `prot
 > - **Replay only (zero setup):** `cowork-harness replay <cassette>` — no token, no Docker, no agent. The command above.
 > - **`protocol` (real model, no Docker):** needs only the auth token (item 3 below).
 > - **Live `container` / `microvm` / `hostloop` / `cowork`:** needs Docker (or Lima for `microvm`), a staged agent, and the token — run `cowork-harness doctor` first.
-> - **Invocation:** from a source checkout, `node dist/cli.js <cmd>` (or `npm link` to get the `cowork-harness` command); from a global install, `cowork-harness <cmd>`; the companion skill falls back to `npx "cowork-harness@^2.1.0"`.
+> - **Invocation:** from a source checkout, `node dist/cli.js <cmd>` (or `npm link` to get the `cowork-harness` command); from a global install, `cowork-harness <cmd>`; the companion skill falls back to `npx "cowork-harness@^2.2.0"`.
 
 Two more worked examples worth knowing about: `examples/scenarios/protocol-smoke.yaml` (zero-Docker smoke
 test) and `examples/scenarios/skill-loads.yaml` (container-tier acceptance check) — see
@@ -150,7 +150,7 @@ claude plugin marketplace add yaniv-golan/cowork-harness
 claude plugin install cowork-harness@cowork-harness
 ```
 
-The skill **self-bootstraps the CLI**: if `cowork-harness` isn't on your PATH it falls back to `npx "cowork-harness@^2.1.0"` (a version floor that fails loud rather than silently fetching a too-old CLI; Node ≥ 22). Tiers above `protocol` still need Docker/Lima and a Claude Desktop agent binary — see the prerequisites below.
+The skill **self-bootstraps the CLI**: if `cowork-harness` isn't on your PATH it falls back to `npx "cowork-harness@^2.2.0"` (a version floor that fails loud rather than silently fetching a too-old CLI; Node ≥ 22). Tiers above `protocol` still need Docker/Lima and a Claude Desktop agent binary — see the prerequisites below.
 
 It also follows the open [Agent Skills](https://agentskills.io) spec, so it installs cross-editor (Cursor, Codex, OpenCode, …) via [`npx skills`](https://github.com/vercel-labs/skills) (Vercel Labs' CLI implementation of that spec):
 
@@ -175,7 +175,7 @@ global install puts nothing in your working directory. The matrix, answer-policy
 ones that still need a source checkout. (The marketplace
 skill install itself only pulls `.claude/skills/cowork-harness/` — SKILL.md + `references/` + `scenario.py`/
 assertion keys, per `.claude-plugin/marketplace.json`'s `source` — not the rest of this table; the full set
-above becomes available once the skill's first command self-bootstraps `npx "cowork-harness@^2.1.0"` — see
+above becomes available once the skill's first command self-bootstraps `npx "cowork-harness@^2.2.0"` — see
 [above](#drive-it-from-claude-code-companion-skill) — which pulls the same npm package as the global-install row.)
 
 ### Prerequisites for anything above `protocol` fidelity
@@ -772,7 +772,7 @@ jobs:
           anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
 ```
 
-Every run writes a Markdown verdict table (scenario, pass/fail, signals, cost/turns when available, staleness findings, and the replay-skipped-assertions honesty line) to the job summary. Inputs: `command`, `path` (required), `version` (npm dist-tag/version, default `latest` — the recipes above pin `^2` instead, because leaving it at `latest` takes a CLI major the moment it is promoted even though your `uses:` ref never changed; pin an exact version for byte-reproducible CI. The companion skill's `cowork-harness@^2.1.0` floor guidance applies to ad-hoc CLI installs, not this input), `strict` (applies to `replay` (staleness findings), `lint`/`lint-skill` (WARN/INFO), and `analyze-skill` (any **`error`**-severity finding — advisory findings are precisely the class that does NOT gate); IGNORED — not forwarded — for `verify-cassettes`/`run`, which don't accept the flag), `fail-on-skill-drift` (**`replay`-only** — never forwarded to the analyzers), `extra-args`, `summary` (default `true`), `anthropic-api-key` (live lane only). Outputs: `ok` (`"true"`/`"false"`, mirrors the exit code), `envelope-path` (path to the raw JSON envelope, for post-processing), `summary-md` (the rendered verdict table, exposed as an output — not just written to `$GITHUB_STEP_SUMMARY` — because that file is scoped to this action's own invocation and a caller's later step gets a fresh, empty one). See [`action.yml`](https://github.com/yaniv-golan/cowork-harness/blob/main/action.yml) for the full input/output reference.
+Every run writes a Markdown verdict table (scenario, pass/fail, signals, cost/turns when available, staleness findings, and the replay-skipped-assertions honesty line) to the job summary. Inputs: `command`, `path` (required), `version` (npm dist-tag/version, default `latest` — the recipes above pin `^2` instead, because leaving it at `latest` takes a CLI major the moment it is promoted even though your `uses:` ref never changed; pin an exact version for byte-reproducible CI. The companion skill's `cowork-harness@^2.2.0` floor guidance applies to ad-hoc CLI installs, not this input), `strict` (applies to `replay` (staleness findings), `lint`/`lint-skill` (WARN/INFO), and `analyze-skill` (any **`error`**-severity finding — advisory findings are precisely the class that does NOT gate); IGNORED — not forwarded — for `verify-cassettes`/`run`, which don't accept the flag), `fail-on-skill-drift` (**`replay`-only** — never forwarded to the analyzers), `extra-args`, `summary` (default `true`), `anthropic-api-key` (live lane only). Outputs: `ok` (`"true"`/`"false"`, mirrors the exit code), `envelope-path` (path to the raw JSON envelope, for post-processing), `summary-md` (the rendered verdict table, exposed as an output — not just written to `$GITHUB_STEP_SUMMARY` — because that file is scoped to this action's own invocation and a caller's later step gets a fresh, empty one). See [`action.yml`](https://github.com/yaniv-golan/cowork-harness/blob/main/action.yml) for the full input/output reference.
 
 The provided [GitHub Actions workflow](https://github.com/yaniv-golan/cowork-harness/blob/main/.github/workflows/ci.yml) runs a **nine-stage pipeline**. The **build** + **test** stages are the token-free gate you can copy into your skill repo; the `floor`, `action-self-test`, `python`, `image-recipe`, `boundary`, `scenarios`, and `parity-drift` stages are this repo's own fidelity self-tests and are not directly portable (they build the harness's Docker image and run harness-specific e2e scenarios — see [`ci-recipe.md`](./.claude/skills/cowork-harness/references/ci-recipe.md) for the skill-repo template):
 

package/dist/assert.js

@@ -1141,10 +1141,25 @@ function check(a, ctx) {
             results.push(fail("present_files_called: present_files is not served on `lane: remote` — a local MCP server cannot reach a remote Cowork session, which delivers via the agent-native SendUserFile instead (not modeled; see docs/fidelity-gaps.md) — cannot verify"));
         else if (ctx.effectiveFidelity !== "container" && ctx.effectiveFidelity !== "hostloop")
             results.push(fail(`present_files_called: present_files is served only on the container/hostloop tiers (this run: ${ctx.effectiveFidelity ?? "unknown"}) — cannot verify; use fidelity: container or hostloop for present_files-based delivery`));
-        else if (ctx.presentedFiles === undefined || ctx.presentedFiles.length === 0)
-            results.push(fail(`present_files_called: no file was delivered via present_files (the tool was never called)`));
-        else
+        // PRESENCE comes from the invocation count, not from `presentedFiles`. The two answer different
+        // questions, and only one of them survives redaction: `presentedFiles` entries are dropped when a
+        // path can't be classified, which a host-path policy guarantees at hostloop (a real host path
+        // redacts to `[REDACTED:…]/mnt/outputs/f`, and the classifier requires an absolute path). Reading
+        // delivery off classification made a redacted recording report "the tool was never called" about a
+        // run that called it three times — and, because record's redaction self-check replays both
+        // cassettes and compares verdicts, no such cassette could be written at all.
+        // `presentedFiles.length` stays as the fallback for a run recorded before the count existed.
+        else if ((ctx.presentFilesCalls ?? 0) > 0 || (ctx.presentedFiles?.length ?? 0) > 0)
             results.push(ok());
+        // Called, but every call's `files` was unusable — the tool WAS invoked, so "never called" would be a
+        // factual claim the harness knows to be false. Mirrors no_scratchpad_leak's malformed branch above.
+        // The count is deliberately NOT interpolated: record's self-check normalizes [REDACTED…] tokens out
+        // of failing messages but not digits, so a count that differs between the base and redacted replays
+        // would trip its message compare and refuse a record that is otherwise fine to write.
+        else if (ctx.evidenceErrors?.presentFilesMalformed)
+            results.push(fail(`present_files_called: present_files WAS called, but no call carried a usable file path (malformed input) — cannot verify delivery`));
+        else
+            results.push(fail(`present_files_called: no file was delivered via present_files (the tool was never called)`));
     }
     if (a.no_skill_triggered !== undefined) {
         const c = compileUserRegex(a.no_skill_triggered);

package/dist/baseline.js

@@ -319,25 +319,47 @@ function latestBaselineFile() {
     files.sort(compareBaselineVersions);
     return join(BASELINES_DIR, files[files.length - 1]);
 }
+/** The one segment the harness's staged session tree always adds under the session root. Every stager
+ *  and every argv builder composes guest paths with it (`stage.ts`/`hostloop-stage.ts` create
+ *  `<sessionHost>/mnt`, `dockerRunArgv` nests `:ro` binds at `<sessionRoot>/mnt/<mountPath>`), so a
+ *  guest mnt root that is anything OTHER than `<sessionRoot>/mnt` cannot be produced. */
+export const GUEST_MNT_SEGMENT = "mnt";
 /**
- * Expand the mount layout for a concrete session id.
- * cwd/sessionRoot = the session root (e.g. /sessions/<id>); mounts sit under mntRoot
- * (/sessions/<id>/mnt) and are returned as ABSOLUTE guest paths.
+ * Expand the mount layout for a concrete session id — the layout of the tree THIS HARNESS stages, which
+ * is what every guest path must be built from.
+ *
+ * `mntRoot` is DERIVED as `<sessionRoot>/mnt`, not read from `mountLayout.mntRoot`: the staged tree can
+ * only ever be there (see GUEST_MNT_SEGMENT), so honouring a recorded value that says otherwise emits
+ * guest paths pointing at directories no stager creates. A baseline recording a different mnt root is a
+ * FIDELITY divergence, surfaced by `recordedLayoutDivergence` at spawn, never a path this builds.
+ *
+ * Guest paths anchor on `sessionRoot` (the bind target), never on `cwd`: production's own working dir is
+ * a folder mount or `outputs` rather than the bare session root, so the two are not interchangeable even
+ * though every synced baseline currently records them equal. `cwd` is the agent's working directory and
+ * nothing else.
  */
 export function resolveMounts(baseline, sessionId, projectId = "proj1") {
     const subst = (s) => s.replace("{sessionId}", sessionId).replace("{projectId}", projectId);
     const cwd = subst(baseline.mountLayout.cwd);
     const sessionRoot = subst(baseline.mountLayout.sessionRoot);
-    // TODO: container.ts:31 computes configGuest independently from sessionRoot and is NOT fixed here;
-    // the legacy desktop-1.11847.5 baseline (sessionRoot ending in /mnt, no spawn block) still produces
-    // a double-mnt configGuest path (/sessions/<id>/mnt/mnt/.claude) — that is a separate out-of-scope issue.
-    const rawSessionRoot = baseline.mountLayout.sessionRoot;
-    const mntRoot = subst(baseline.mountLayout.mntRoot ?? (rawSessionRoot.endsWith("/mnt") ? rawSessionRoot : `${rawSessionRoot}/mnt`));
-    return {
-        cwd,
-        sessionRoot,
-        mntRoot,
-        configDir: `${mntRoot}/.claude`,
-        mounts: baseline.mountLayout.mounts.map((m) => ({ ...m, mountPath: `${mntRoot}/${subst(m.mountPath)}` })),
-    };
+    const mntRoot = `${sessionRoot}/${GUEST_MNT_SEGMENT}`;
+    return { cwd, sessionRoot, mntRoot };
+}
+/** Does this baseline RECORD a guest layout the harness cannot stage? Reads the recorded fields only
+ *  (never the derived ones), so it stays a statement about the data: a `mntRoot` that is not
+ *  `<sessionRoot>/mnt`, or a `sessionRoot` that already ends in the mnt segment — the shape that made
+ *  `resolveMounts` return a root one level above the staged tree. Returns the divergence for the caller
+ *  to surface, or undefined when the recording is reproducible. */
+export function recordedLayoutDivergence(baseline) {
+    // Read STRUCTURALLY: a partially-constructed baseline (`{ spawn: {} }`) is normal at the argv seam, and
+    // this check must never be the thing that throws there. No recorded layout ⇒ nothing to diverge from.
+    const { sessionRoot, mntRoot } = baseline.mountLayout ?? {};
+    if (typeof sessionRoot !== "string")
+        return undefined;
+    const staged = `${sessionRoot}/${GUEST_MNT_SEGMENT}`;
+    if (mntRoot !== undefined && mntRoot !== staged)
+        return { recorded: mntRoot, staged };
+    if (sessionRoot.endsWith(`/${GUEST_MNT_SEGMENT}`))
+        return { recorded: sessionRoot, staged };
+    return undefined;
 }

package/dist/cli.js

@@ -3769,6 +3769,7 @@ async function cmdVerifyRun(args) {
         fileToolAttempts: result.fileToolAttempts,
         pathDenials: result.pathDenials,
         presentedFiles: result.presentedFiles,
+        presentFilesCalls: result.presentFilesCalls,
         evidenceErrors: result.evidenceErrors,
         effectiveFidelity: result.effectiveFidelity,
         // verify-run re-checks a kept run dir on the SAME machine that ran it — grouped with the live

package/dist/prompt.js

@@ -2,6 +2,7 @@ import { warn } from "./io.js";
 import { readFileSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
+import { resolveMounts } from "./baseline.js";
 const BASELINES_DIR = join(fileURLToPath(new URL("..", import.meta.url)), "baselines");
 /** The {{placeholder}} names renderPrompts() substitutes. KEEP IN LOCKSTEP with the `tokens` map below. */
 export const MODELED_PLACEHOLDER_NAMES = new Set([
@@ -31,8 +32,10 @@ firstFolderMountPath, opts) {
     const spawn = baseline.spawn;
     if (!spawn)
         return {};
-    const sessionRoot = `/sessions/${sessionId}`;
-    const mntRoot = `${sessionRoot}/mnt`;
+    // Through resolveMounts, NOT a local `/sessions/<id>` literal: the prompt tells the agent where its
+    // files are, so it must name the same tree the runtimes stage and bind. A private derivation here was a
+    // fourth copy of this rule, and a fourth place for it to drift.
+    const { sessionRoot, mntRoot } = resolveMounts(baseline, sessionId);
     const workspaceFolder = firstFolderMountPath ? `${mntRoot}/${firstFolderMountPath}` : `${mntRoot}/outputs`;
     // {{currentDateTime}}/{{currentTimezone}} are deliberately render-time-impure (wall clock, host
     // TZ) — that's what the real Desktop builder substitutes, and the rendered append never enters a

package/dist/run/cassette.js

@@ -1741,6 +1741,7 @@ function minimalRec() {
         fileToolAttempts: [],
         pathDenials: [],
         presentedFiles: [],
+        presentFilesCalls: 0,
         webSearches: [],
         infraErrors: [],
         evidenceErrors: { taskTracking: 0, webSearchParse: 0, presentFilesMalformed: 0 },
@@ -3920,6 +3921,7 @@ function replayErrorResult(file) {
         fileToolAttempts: undefined, // no rec to read from on this early-bail lane
         pathDenials: undefined, // no rec to read from on this early-bail lane
         presentedFiles: undefined, // no rec to read from on this early-bail lane
+        presentFilesCalls: undefined, // ditto
         preRunPaths: undefined,
         preRunLinkAware: undefined,
         preRunHashes: undefined,
@@ -5620,8 +5622,10 @@ export const ALWAYS_CONTENT_KEYS = [
     "task_status",
     "result",
     // content-class, NOT controlOut-gated: both the present_files tool_use and its own tool_result live
-    // in the ordinary events stream, so the re-drive reproduces `RunResult.presentedFiles` exactly like
-    // the other re-derived signals above (skill_triggered, redundantToolCalls, …).
+    // in the ordinary events stream, so the re-drive reproduces the present_files signals like the other
+    // re-derived ones above (skill_triggered, redundantToolCalls, …). `presentFilesCalls` (what
+    // present_files_called reads) reproduces on every tier; `presentedFiles`' promoted/leaked booleans
+    // reproduce at container, where cwd is the session root — no_scratchpad_leak's only tier.
     "no_scratchpad_leak",
     "present_files_called",
     // content-class, NOT controlOut-gated: fileToolAttempts re-derives from frozen tool_use blocks (the
@@ -6136,6 +6140,7 @@ export async function replayCassette(cassette, hooks = [], opts = {}) {
             // empty [] (nothing presented) vacuous-passes no_scratchpad_leak instead of reading as
             // evidence-unavailable.
             presentedFiles: rec.presentedFiles,
+            presentFilesCalls: rec.presentFilesCalls,
             evidenceErrors: rec.evidenceErrors,
             effectiveFidelity: cassette.effectiveFidelity,
             // Replay has no live filesystem — computer_links_resolve normalizes both link shapes against the
@@ -6493,6 +6498,7 @@ export async function replayCassette(cassette, hooks = [], opts = {}) {
             // NOT reproduce — this one genuinely re-derives. Uncollapsed (an empty [] is the real "nothing
             // presented" signal no_scratchpad_leak's vacuous pass needs, matching live).
             presentedFiles: rec.presentedFiles,
+            presentFilesCalls: rec.presentFilesCalls,
             preRunPaths: undefined,
             // Report the baseline semantics actually used during evaluation above (not undefined) so the returned
             // result doesn't misrepresent them. Same source of truth as the evaluate() ctx.

package/dist/run/chat-result.js

@@ -113,6 +113,7 @@ export function buildChatResult(record, opts) {
         fileToolAttempts: record.fileToolAttempts,
         pathDenials: record.pathDenials,
         presentedFiles: record.presentedFiles,
+        presentFilesCalls: record.presentFilesCalls,
         egress: opts.egress,
         resources,
         stderrLogPath: join(opts.outDir, "agent.stderr.log"),

package/dist/run/chat.js

@@ -417,6 +417,7 @@ export async function cmdChat(args) {
                 },
             };
             const run = new Run(agent, decider, [renderer, tripwireHook], sessionId);
+            run.setSessionRoot(hl.sessionRoot); // HOST tree — without it cwd (mnt/outputs) stands in for the root
             stopHeartbeat = startHeartbeat(renderer, renderPlan, start);
             if (viaApiOn) {
                 run.enableWebFetchGate();
@@ -450,6 +451,7 @@ export async function cmdChat(args) {
             const decider = Chain(new ScriptedDecider([]), new PermissionDefaultDecider("cowork"), new PromptDecider(ask));
             const renderer = makeRenderer(renderPlan);
             const run = new Run(agent, decider, [renderer], sessionId);
+            run.setSessionRoot(ct.sessionRoot); // VM path — same space the agent reports (see execute.ts)
             stopHeartbeat = startHeartbeat(renderer, renderPlan, start);
             record = await run.drive(withSeedPrompt(seedPrompt, ttyTurns(rl)), chatDriveOpts(prompts, { tier: "container", sdkMcp: ct.sdkMcp }));
         }

package/dist/run/execute.js

@@ -692,6 +692,10 @@ export async function executeScenario(scenario, opts = {}) {
             const prompts = renderPrompts(baseline, session, sessionId, plan.mounts.find((m) => m.kind === "folder")?.mountPath, hostLoopOpts);
             promptFidelityWarnings = prompts.fidelityWarnings; // hoist out so RunResult construction (after try) can access it
             let sdkMcp;
+            // The session root as reported BY THE SPAWN that just happened — the dir whose `mnt/` is the
+            // user-visible workspace, in the same path space the agent reports its own paths in. Only the two
+            // tiers that serve present_files supply one; the others keep the cwd fallback (see setSessionRoot).
+            let spawnedSessionRoot;
             if (effectiveFidelity === "hostloop") {
                 const hl = spawnHostLoop(scenario, baseline, plan, outDir, sessionId, {
                     systemPromptAppend: prompts.systemPromptAppend,
@@ -712,6 +716,7 @@ export async function executeScenario(scenario, opts = {}) {
                 hostloopPathGateFired = hl.pathGateFired;
                 hostloopInfraErrors = hl.infraErrors;
                 hostloopMarkTearingDown = hl.markTearingDown;
+                spawnedSessionRoot = hl.sessionRoot; // HOST tree — the native agent runs there
                 logHostWriteNotice(plan.mounts.filter((mt) => mt.kind === "folder").map((mt) => ({ from: mt.hostPath, mode: mt.mode })), warn);
                 if (scenario.assert.some((a) => a.transcript_no_host_path === true) && !opts.compact)
                     warn(`::warning:: [hostloop] scenario asserts transcript_no_host_path — hostloop's native file tools legitimately ` +
@@ -729,6 +734,7 @@ export async function executeScenario(scenario, opts = {}) {
                 child = ct.child;
                 containerName = ct.containerName; // so the Ctrl-C / finally reap removes the agent container by name
                 sdkMcp = ct.sdkMcp; // cowork/present_files + the skills/plugins discovery servers (combineSdkMcp)
+                spawnedSessionRoot = ct.sessionRoot; // VM path (`/sessions/<id>`) — what the agent inside reports
             }
             else if (effectiveFidelity === "microvm") {
                 child = spawnMicroVm(scenario, baseline, plan, outDir, sessionId, {
@@ -771,12 +777,18 @@ export async function executeScenario(scenario, opts = {}) {
             const decider = effectiveFidelity === "hostloop" ? Chain(makeHostLoopCanUseToolGate(), policyDecider) : policyDecider;
             const run = new Run(sessionT, decider, opts.hooks ?? [], sessionId, dialogTimeoutMs ?? undefined, scenario.timeout_ms);
             run.seedApprovedDomains(session.web_fetch.approved_domains); // test convenience: pre-approved web_fetch hosts
-            // The session root — the dir whose `mnt/` IS the user-visible workspace. Given explicitly because
-            // the agent's own cwd only coincides with it on some tiers (at hostloop the agent runs inside
-            // mnt/outputs), and present_files' promoted/leaked classification is measured from it.
-            // `protocol` has no session/mnt layout at all, so it stays unset and keeps the cwd fallback.
-            if (effectiveFidelity !== "protocol")
-                run.setSessionRoot(join(outDir, "work", "session"));
+            // The session root — the dir whose `mnt/` IS the user-visible workspace, and what present_files'
+            // promoted/leaked classification is measured from. Taken from the SPAWN, never re-derived here: the
+            // root and the agent's reported paths must be in the SAME path space, and they are not the same space
+            // on every tier. A host path was passed unconditionally once; at container the agent reports VM paths
+            // (`/sessions/<id>/…`), so nothing was ever inside the root, every presented file classified
+            // `leaked: false`, and `no_scratchpad_leak` — which evaluates at container and nowhere else — passed
+            // vacuously over a real copy-failure leak.
+            //
+            // Unset on the tiers that serve no present_files (`protocol`, `microvm`), where the cwd fallback is
+            // already the session root and there is no delivery to classify.
+            if (spawnedSessionRoot !== undefined)
+                run.setSessionRoot(spawnedSessionRoot);
             // fill the provenance bundle (backed by Run's tracker + recorded approval) BEFORE drive().
             // Host-loop only, and only when the web_fetch-via-API gate is on; otherwise the handler stays
             // allowlist-only (ref.current undefined). Run seeds the set from turns + tool_results.
@@ -1157,6 +1169,7 @@ export async function executeScenario(scenario, opts = {}) {
             // Always defined live — an empty array is the real "nothing presented" signal no_scratchpad_leak's
             // vacuous pass needs, distinct from replay's evidence-unavailable undefined on an older cassette.
             presentedFiles: record.presentedFiles,
+            presentFilesCalls: record.presentFilesCalls,
             evidenceErrors: record.evidenceErrors,
             effectiveFidelity,
             // Live lane (this run's own machine) — host-shaped computer:// links (hostloop) are checked
@@ -1404,6 +1417,7 @@ export async function executeScenario(scenario, opts = {}) {
             fileToolAttempts: record.fileToolAttempts, // uncollapsed — content-class, same as toolResults/decisions above
             pathDenials: record.pathDenials, // uncollapsed — content-class, same as fileToolAttempts above
             presentedFiles: record.presentedFiles, // uncollapsed — an empty [] is the real "nothing presented" signal no_scratchpad_leak's vacuous pass needs
+            presentFilesCalls: record.presentFilesCalls,
             // The pre-spawn baseline no_unexpected_files diffs against (same single read the evaluate ctx got).
             // undefined = the run didn't capture (key not asserted, microvm, pre-seam) — the assertion then
             // fails evidence-unavailable, loud.
@@ -1788,6 +1802,7 @@ export function buildPartialResult(args) {
         fileToolAttempts: record.fileToolAttempts, // uncollapsed — content-class, same as toolResults/decisions above
         pathDenials: record.pathDenials, // uncollapsed — content-class, same as fileToolAttempts above
         presentedFiles: record.presentedFiles, // uncollapsed — an empty [] is the real "nothing presented" signal no_scratchpad_leak's vacuous pass needs
+        presentFilesCalls: record.presentFilesCalls,
         preRunPaths: readPreRunManifest(args.outDir),
         preRunLinkAware: readPreRunManifestLinkAware(args.outDir),
         preRunHashes: readPreRunManifestHashes(args.outDir),

package/dist/run/run.js

@@ -267,6 +267,7 @@ export class Run {
             fileToolAttempts: [],
             pathDenials: [],
             presentedFiles: [],
+            presentFilesCalls: 0,
             webSearches: [],
             infraErrors: [],
             evidenceErrors: { taskTracking: 0, webSearchParse: 0, presentFilesMalformed: 0 },
@@ -488,6 +489,12 @@ export class Run {
                             const pf = presentFilesInput(ev.input);
                             this.pendingPresentFiles.set(ev.toolUseId, pf.files);
                             this.rec.evidenceErrors.presentFilesMalformed += pf.malformed;
+                            // Presence, counted here and NOT from `presentedFiles` below — see the field's comment.
+                            // Gated on a well-formed file (not merely on the call) so the count keeps the DELIVERY
+                            // meaning `present_files_called` documents: a call whose `files` were unusable delivered
+                            // nothing, leaves this at 0, and is reported through the malformed counter instead.
+                            if (pf.files.length > 0)
+                                this.rec.presentFilesCalls++;
                         }
                         this.toolLog.push({ name: ev.name, input: ev.input, synthetic: ev.synthetic, parentToolUseId: ev.parentToolUseId }); // still logged for provenance/trace
                         break;
@@ -932,6 +939,18 @@ export class Run {
         // genuine leak as fine. This bug over-reports; that one would under-report, and a false green is the
         // worse failure.
         const root = this.sessionRoot !== undefined ? posixPath.normalize(this.sessionRoot) : cwd;
+        // SPACE CHECK, before any classification: the agent's cwd must sit AT or INSIDE the session root. That
+        // holds on every tier that serves present_files — at container cwd IS the root, at hostloop it is
+        // `<root>/mnt/<outputs|folder>` — so a cwd outside the root means the two are in different path spaces
+        // (a host root against VM-reported paths, say) and every containment test below is meaningless. Count
+        // the batch malformed instead of grading it: nothing would be under the root, so the classification
+        // would silently read `leaked: false` for a genuine leak, which is exactly the vacuous pass
+        // `no_scratchpad_leak` exists to prevent. Deliberately NOT "no presented path is under the root" —
+        // a hostloop delivery out of a connected folder legitimately sits outside the session tree.
+        if (root !== undefined && cwd !== undefined && cwd !== root && !cwd.startsWith(`${root}/`)) {
+            this.rec.evidenceErrors.presentFilesMalformed += froms.length;
+            return;
+        }
         const isScratchpad = (p) => root !== undefined && p.startsWith(`${root}/`) && !p.startsWith(`${root}/mnt/`);
         for (let i = 0; i < froms.length; i++) {
             const rawTo = tos[i];

package/dist/runtime/argv.js

@@ -1,3 +1,5 @@
+import { recordedLayoutDivergence } from "../baseline.js";
+import { warn } from "../io.js";
 import { DEFAULT_MAX_THINKING_TOKENS } from "../types.js";
 import { SECRET_ENV_KEYS } from "./host-env.js";
 /**
@@ -9,6 +11,23 @@ import { SECRET_ENV_KEYS } from "./host-env.js";
  */
 export function baseAgentArgs(baseline, plan, opts) {
     const spawn = baseline.spawn;
+    // A baseline with NO `spawn` block cannot be spawned faithfully at a sandbox tier: the tool set,
+    // pre-approvals, effort default and config-dir location all come from it, and the `?? []` fallbacks
+    // below would silently emit an agent with no Read/Write/Bash/Skill/Task at all — a run that cannot
+    // execute the skill under test while still reporting a verdict. Refuse instead. (`protocol` builds its
+    // own argv and inherits the host CLI's toolset, so it is unaffected and stays usable.)
+    if (!spawn)
+        throw new Error(`baseline "${baseline.appVersion}" has no \`spawn\` block, so a sandbox tier cannot reproduce Cowork's ` +
+            `toolset, pre-approvals or config-dir layout — the agent would launch with none of its file/bash tools. ` +
+            `Use a baseline recorded by \`sync\`, or run at \`fidelity: protocol\` (which builds its own argv).`);
+    // FIDELITY, not correctness: guest paths are always staged at `<sessionRoot>/mnt` (see
+    // GUEST_MNT_SEGMENT), so a baseline recording a different mnt root is reproduced approximately. Say so
+    // once, here, rather than letting the recorded value build a path no stager creates.
+    const divergence = recordedLayoutDivergence(baseline);
+    if (divergence)
+        warn(`::warning:: baseline "${baseline.appVersion}" records a guest mnt root this harness cannot stage ` +
+            `(recorded ${divergence.recorded}, staged ${divergence.staged}) — guest paths use the staged layout, ` +
+            `so mount-path fidelity at this tier is approximate.\n`);
     // Real Cowork ALWAYS emits `--effort`, for every model class (picker, no-picker, regex-default,
     // unknown) — falling back to the baseline's synced medium default when the session left it unset
     // (per-model validation of an EXPLICIT value already ran in buildLaunchPlan's validateEffort; the
@@ -207,7 +226,7 @@ export function dockerRunArgv(i) {
         i.network,
         ...(i.lockdown ? HARDENING : []),
         "-w",
-        i.sessionRoot,
+        i.agentCwd ?? i.sessionRoot,
         // Render SECRET values by NAME only (`-e KEY`) so the token never lands in `docker run`'s
         // argv (visible via ps / /proc/<pid>/cmdline). Docker inherits the value from its own env — the
         // harness process env, where runtimeAuthEnv read it. Non-secret env keeps the explicit KEY=value.

package/dist/runtime/container.js

@@ -23,8 +23,11 @@ import { resolveAgentImage, resolveContainerRuntime } from "./agent-image.js";
  */
 export function spawnContainer(_scenario, baseline, plan, outDir, sessionId, opts = {}) {
     const m = resolveMounts(baseline, sessionId, "proj1");
-    const sessionRoot = m.cwd; // /sessions/<id>
-    const mntRoot = m.mntRoot; // /sessions/<id>/mnt
+    // BIND TARGET (and the anchor for every guest path), vs the agent's working dir. Equal on every synced
+    // baseline; kept distinct because production's cwd is a folder mount or `outputs`, not the session root.
+    const sessionRoot = m.sessionRoot; // /sessions/<id>
+    const agentCwd = m.cwd;
+    const mntRoot = m.mntRoot; // <sessionRoot>/mnt — the tree stageWorkspace creates
     const configGuest = `${sessionRoot}/${baseline.spawn?.configDirInGuest ?? "mnt/.claude"}`;
     const AGENT_IN = "/usr/local/bin/claude";
     // Name by the per-invocation runToken (NOT sessionId) so a --resume after a failed run doesn't collide
@@ -88,6 +91,7 @@ export function spawnContainer(_scenario, baseline, plan, outDir, sessionId, opt
         lockdown: (process.env.COWORK_LOCKDOWN ?? "on") !== "off",
         name: containerName,
         sessionRoot,
+        agentCwd,
         sessionHost,
         agentHost,
         agentIn: AGENT_IN,
@@ -130,5 +134,9 @@ export function spawnContainer(_scenario, baseline, plan, outDir, sessionId, opt
         handle: makePluginsHandler({ mountedPlugins }),
     };
     const sdkMcp = combineSdkMcp(...(coworkBundle ? [coworkBundle] : []), skillsBundle, pluginsBundle);
-    return { child, containerName, sdkMcp };
+    // `sessionRoot` is the VM path the agent sees (`-w` above, and the cowork handler's own
+    // `sessionRootVm`). Returned so the caller classifies present_files against the root THIS spawn used,
+    // instead of re-deriving one — the two lived in different path spaces (host vs VM) once, which made
+    // every container leak read as `leaked: false`.
+    return { child, containerName, sdkMcp, sessionRoot };
 }

package/dist/runtime/hostloop.js

@@ -363,7 +363,11 @@ export function spawnHostLoop(_scenario, baseline, plan, outDir, sessionId, opts
         handle: makePluginsHandler({ mountedPlugins }),
     };
     const sdkMcp = combineSdkMcp(workspaceBundle, ...(coworkBundle ? [coworkBundle] : []), skillsBundle, pluginsBundle);
-    return { child, sdkMcp, hooks, pathGateFired, containerName, hostEgress, infraErrors, markTearingDown };
+    // `sessionRoot` here is the HOST tree (`sessionHost`), not the VM path: the agent runs natively on the
+    // host at this tier (see the `spawn(agentNativeHost, …, { cwd: hostOutputsDir })` above), so the paths
+    // it reports — and the ones its present_files handler validates — are host paths. Returned for the same
+    // reason as container's: the caller must not re-derive it.
+    return { child, sdkMcp, hooks, pathGateFired, containerName, hostEgress, infraErrors, markTearingDown, sessionRoot: sessionHost };
 }
 /** The two infra-error emitters a host-loop run needs, sharing one sink and one events.jsonl writer.
  *  Every row carries its `source` so the verdict can tell a dead supervisor apart from a failed command,

package/dist/runtime/lima.js

@@ -5,6 +5,12 @@ import { join, dirname, basename } from "node:path";
 import { createHash } from "node:crypto";
 /** Host dir mounted writable into the VM at /sessions (the staging area; per-session subdirs). */
 export const VM_WORK_HOST = join(homedir(), ".cowork-harness", "vm-work");
+/** Guest mount point of `VM_WORK_HOST` — the literal in the lima template below. The microVM's guest
+ *  session root is `${VM_GUEST_SESSIONS_ROOT}/<sessionId>` STRUCTURALLY: lima mounts the work root here
+ *  and the per-session dirs live inside it, so this tier cannot honour a baseline that records the agent
+ *  running anywhere else. Exported so the runtime anchors on the same string the template mounts, and so
+ *  a test can check that pairing without booting a VM. */
+export const VM_GUEST_SESSIONS_ROOT = "/sessions";
 /**
  * L2 microVM provisioning via Lima with `vmType: vz` — Apple Virtualization.framework,
  * the SAME hypervisor Claude Cowork uses. This gives a real Linux kernel (VM-grade
@@ -141,7 +147,7 @@ mounts:
   # the agent persists its session (enabling --resume). Lima creates the mountpoint, writable by the
   # mounting user — no guest /sessions permission problem.
   - location: "${VM_WORK_HOST}"
-    mountPoint: "/sessions"
+    mountPoint: "${VM_GUEST_SESSIONS_ROOT}"
     writable: true
 provision:
   - mode: system

package/dist/runtime/microvm.js

@@ -1,7 +1,7 @@
 import { spawn } from "node:child_process";
 import { cpSync, existsSync, mkdirSync, rmSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { limaPath, vmInit, applyGuestFirewall, vmGatewayIp, VM_WORK_HOST } from "./lima.js";
+import { limaPath, vmInit, applyGuestFirewall, vmGatewayIp, VM_WORK_HOST, VM_GUEST_SESSIONS_ROOT } from "./lima.js";
 import { resolveMounts } from "../baseline.js";
 import { spawnEnv, baseAgentArgs } from "./argv.js";
 import { stageWorkspace } from "./stage.js";
@@ -62,11 +62,29 @@ function parseEnvPortMicroVm(name, defaultValue) {
  *
  * Egress: a host-side allowlist proxy + a guest default-deny iptables firewall.
  */
+/** The microVM's guest session root, which is STRUCTURAL rather than baseline-derived: lima mounts the
+ *  work root at `VM_GUEST_SESSIONS_ROOT` with a per-`sessionId` dir inside it, so the agent runs at
+ *  `<VM_GUEST_SESSIONS_ROOT>/<sessionId>` whatever the baseline records. Reading it from
+ *  `mountLayout.cwd` instead put `CLAUDE_CONFIG_DIR` and `--mcp-config` at paths nothing stages whenever
+ *  the two disagreed.
+ *
+ *  A recorded cwd this tier cannot honour THROWS rather than warns: the guest `cd` would otherwise
+ *  succeed at the wrong directory, and a silently-wrong cwd is exactly what the loud `cd` prevents.
+ *
+ *  Pure and exported so this pairing is checkable without booting a VM (`vmInit` needs `limactl`). */
+export function microvmGuestSessionRoot(baseline, sessionId) {
+    const sessionVm = `${VM_GUEST_SESSIONS_ROOT}/${sessionId}`;
+    const recordedCwd = resolveMounts(baseline, sessionId, "proj1").cwd;
+    if (recordedCwd !== sessionVm)
+        throw new Error(`baseline "${baseline.appVersion}" records the agent's cwd as ${recordedCwd}, but the microVM mounts its ` +
+            `session tree at ${sessionVm} and cannot place the agent anywhere else — run this baseline at ` +
+            `fidelity: container/hostloop, or use one whose mountLayout.cwd matches the microVM mount point.`);
+    return sessionVm;
+}
 export function spawnMicroVm(_scenario, baseline, plan, outDir, sessionId, opts = {}) {
     const { instance } = vmInit(baseline);
-    const m = resolveMounts(baseline, sessionId, "proj1");
-    const sessionVm = m.cwd; // /sessions/<id>
-    const mntVm = m.mntRoot; // /sessions/<id>/mnt
+    const sessionVm = microvmGuestSessionRoot(baseline, sessionId);
+    const mntVm = `${sessionVm}/mnt`; // the staged tree — see GUEST_MNT_SEGMENT
     const configVm = `${sessionVm}/${baseline.spawn?.configDirInGuest ?? "mnt/.claude"}`;
     // Stage into the lima-mounted work dir (host VM_WORK_HOST -> guest /cowork-work) via the shared
     // helper. It honors plan.resume for ALL of .claude + mounts + mcp.json (the .claude guard

package/dist/types.js

@@ -456,7 +456,7 @@ export const Assertion = z.strictObject({
     present_files_called: z
         .literal(true)
         .optional()
-        .describe("at least one file was actually delivered via the present_files tool (presentedFiles is non-empty). The presence companion to no_scratchpad_leak (which passes vacuously when nothing was presented, and stays container-only) — pair them to require a delivery AND require it not to leak; CONTAINER + HOSTLOOP TIERS — the harness serves present_files at both, mirroring real Cowork advertising the tool in both its VM and host-loop modes; every other tier is still a harness coverage gap (see docs/fidelity-gaps.md, 'File delivery'). present_files is the DESKTOP-LOCAL lane's tool name; remote Cowork uses the agent-native SendUserFile (docs/fidelity-gaps.md, 'File delivery') — this key asserts the harness-side delivery record either way; only `true` is valid"),
+        .describe("at least one file was actually delivered via the present_files tool (at least one call carried a well-formed file_path). Presence is read from the INVOCATION count, not from the classified presentedFiles list, so it is unaffected by a redaction policy that rewrites host paths; a run that called the tool but whose every call carried an unusable path reports cannot-verify, never 'the tool was never called'. The presence companion to no_scratchpad_leak (which passes vacuously when nothing was presented, and stays container-only) — pair them to require a delivery AND require it not to leak; CONTAINER + HOSTLOOP TIERS — the harness serves present_files at both, mirroring real Cowork advertising the tool in both its VM and host-loop modes; every other tier is still a harness coverage gap (see docs/fidelity-gaps.md, 'File delivery'). present_files is the DESKTOP-LOCAL lane's tool name; remote Cowork uses the agent-native SendUserFile (docs/fidelity-gaps.md, 'File delivery') — this key asserts the harness-side delivery record either way; only `true` is valid"),
     egress_denied: z.string().optional().describe("egress to this host was denied"),
     egress_allowed: z.string().optional().describe("egress to this host was allowed"),
     // Only `true` is accepted: `false` is rejected as a footgun. The assertion is presence-semantic — authoring

package/docs/cassette.md

@@ -512,8 +512,8 @@ the rules and CI-placement rationale (why each category behaves this way), see
 | `path_denied` | **`fidelity: hostloop` only** — a path denial matched all given matchers (`tool`/`path_matches`/`source`/`agent_scope`) — replay: needs `controlOut`; any other tier FAILS "cannot verify" |
 | `no_path_denied` | **`fidelity: hostloop` only** — no path denial was recorded at all — replay: needs `controlOut`. **Only `true` is valid**; any other tier FAILS "cannot verify" |
 | `result` | run ended with `success` or `error` |
-| `no_scratchpad_leak` | every file presented via `present_files` that was in the scratchpad was successfully promoted to `mnt/outputs` (none left behind) — vacuous pass if nothing was presented; content-class: both the tool_use and its own tool_result live in the ordinary events stream, so `RunResult.presentedFiles` re-derives identically on replay; evidence-unavailable only when `presentedFiles` is absent (an older run predating the feature); **container tier only** — `present_files` *is* served on hostloop, but that branch passes a validated path through without promoting, so there is no scratch→outputs copy to leak; `microvm`/`protocol` do not serve the tool at all |
-| `present_files_called` | at least one file was delivered via `present_files` (`RunResult.presentedFiles` is non-empty) — the presence companion to `no_scratchpad_leak`; content-class (re-derives identically on replay); **container + hostloop tiers** |
+| `no_scratchpad_leak` | every file presented via `present_files` that was in the scratchpad was successfully promoted to `mnt/outputs` (none left behind) — vacuous pass if nothing was presented; content-class: both the tool_use and its own tool_result live in the ordinary events stream, so `RunResult.presentedFiles` re-derives on replay at container, where the agent's cwd IS the session root the live lane measures from; at hostloop the live lane measures from the session root while a re-drive has only the recorded cwd (`mnt/outputs`, inside it), so the promoted/leaked booleans there are not equivalent — immaterial to this key, which evaluates at container only; evidence-unavailable only when `presentedFiles` is absent (an older run predating the feature); **container tier only** — `present_files` *is* served on hostloop, but that branch passes a validated path through without promoting, so there is no scratch→outputs copy to leak; `microvm`/`protocol` do not serve the tool at all |
+| `present_files_called` | at least one file was delivered via `present_files` (`RunResult.presentFilesCalls` > 0 — the invocation count, which a host-path redaction policy cannot alter) — the presence companion to `no_scratchpad_leak`; content-class (re-derives identically on replay); **container + hostloop tiers** |
 | `allow_permissive_auto_allow` | verdict modifier — kept on replay → no-op pass (the live signal it suppresses is zeroed) |
 | `allow_missing_capability` | verdict modifier — kept on replay → no-op pass (the live signal it suppresses is zeroed) |
 | `allow_l0_plugin_divergence` | verdict modifier — kept on replay → no-op pass (the live signal it suppresses is zeroed) |

package/docs/invariants.md

@@ -22,6 +22,9 @@ duplicate it here; this table is for finding things fast, not for the full ratio
 | A cassette carries a `sessionFingerprint` (v9+, content-SHAPE hash of the AUTHORED, pre-resolution session — connected folders, plugins, skills, mcp and egress config, web_fetch approved domains, plus projects and agent_env when set; authored so the hash stays relocatable across checkouts) checked ONLY by `verify-cassettes`, deliberately excluded from `computeStaleness`/`checkStaleness` so it never affects the default replay verdict | `src/run/cassette.ts` (`sessionFingerprintDrift`) | `test/session-fingerprint.test.ts` (`describe("buildSessionFingerprint (function-level)")` — covers `buildSessionFingerprint` + `sessionFingerprintDrift`) |
 | A corrupt `timeline.jsonl` header must read as "no timeline" (`undefined`) at every consumer, never a present-empty timeline — a header-corrupt read that folds to `[]`/`undefined` events bakes a novel "ran, no activity" shape into a recorded cassette instead of the honest evidence-unavailable state | `src/run/execute.ts`, `src/run/chat-result.ts`, `src/run/cassette.ts` (each checks `!timelineRaw.headerCorrupt` alongside `malformedLines === 0` before trusting a `readTimeline()` result) | `test/central-cluster-guards.test.ts` |
 | `evidenceErrors.egressParse` must be included in the presence gate that decides whether `RunResult.evidenceErrors` serializes at all — omitting it silently absorbs the one counter that exists specifically to surface dropped egress-proxy lines | `src/run/run.ts` (`evidenceErrorsForResult`) | `test/central-cluster-guards.test.ts` (`describe("#39 egressParse reaches result.json (presence-gate fix, not just parseEgressLine)")`) |
+| Every GUEST path must be composed from the tree the harness stages — `<sessionRoot>/mnt` — and never from a baseline's recorded `mountLayout.mntRoot`. A recorded mnt root that differs is a fidelity divergence reported at spawn, not a path to build: honouring one put `--plugin-dir` a directory above the staged plugin tree, so the plugin under test never loaded. Guest paths anchor on `sessionRoot` (the bind target), never `cwd` (where the agent merely starts); at microvm the root is lima's mount point and a baseline recording another cwd is REFUSED, since the guest `cd` would otherwise succeed at the wrong dir. A baseline with no `spawn` block is refused at the sandbox tiers outright — its toolset and pre-approvals are that block | `src/baseline.ts` (`GUEST_MNT_SEGMENT`, `resolveMounts`, `recordedLayoutDivergence`), `src/runtime/argv.ts` (the spawn-block refusal + divergence warning), `src/runtime/microvm.ts` (`microvmGuestSessionRoot`), `src/prompt.ts` (routed through `resolveMounts` instead of a private derivation) | `test/guest-path-layout.test.ts` (a table over every shipped baseline, oracle taken from the STAGING side, plus a synthetic spawnable-but-divergent baseline — the shipped divergent one has no `spawn` block, so only the synthetic case exercises the path composition) |
+| The session root handed to `Run.setSessionRoot` must come from the SPAWN that started the agent, in the same path space the agent reports its own paths in — host at hostloop (native agent), the VM `/sessions/<id>` at container — never re-derived by the caller. A host root measured against VM-reported paths puts nothing inside the root, so every presented file classifies `leaked: false` and `no_scratchpad_leak` (which evaluates at container and nowhere else) passes vacuously over a real copy-failure leak | `src/runtime/container.ts` + `src/runtime/hostloop.ts` (each returns the `sessionRoot` it used), `src/run/execute.ts` + `src/run/chat.ts` (pass it through), `src/run/run.ts` (`notePresentedFiles`' cwd-at-or-inside-root space check counts the batch malformed rather than grading it in the wrong space) | `test/session-root-path-space.test.ts` (per-tier geometry, the fail-closed space mismatch, live-vs-replay agreement, and the spawn-reports-its-own-root seam) |
+| `present_files_called` must read presence from `RunResult.presentFilesCalls` (the invocation count, derived from the tool_use input's SHAPE), never from the classified `presentedFiles` list — that list drops any path it cannot resolve, which a host-path redaction policy guarantees at `hostloop`, so reading classification claimed "the tool was never called" about a run that called it AND made every such scenario unrecordable (record refuses a cassette whose verdict redaction changed) | `src/assert.ts` (the `present_files_called` branch), `src/run/run.ts` (`presentFilesCalls`, counted at the `present_files` tool_use) | `test/present-files-redaction-invariant.test.ts` (drives the real `assertRedactionVerdictPreserved` over a hostloop cassette redacted with the shipped policy; the CONTROL case pins that the un-redacted side genuinely passes, so a shared tier-gate failure can't green it) |
 | An anonymous sub-agent dispatch's synthesized `toolUseId` must derive from the assistant message's own (stable, unique) id, never a process-lifetime counter — a counter-derived id isn't reproducible across record→replay and can collide across messages in a single run | `src/agent/session.ts` (`parseMessage`) | `test/session-parse-guards.test.ts` (the regression test asserting synthesized dispatch id uniqueness across messages, in the `parseMessage` describe block) |
 | The pre-commit cassette gate must fail CLOSED: any `verify-cassettes` outcome that is not a proven clean `0` blocks the commit, and an exit 3 blocks unless its cause is *staleness* specifically. `ci.yml` triggers on `push: [main]` and `pull_request`, but the documented local workflow lands with `merge --ff-only` into `main` and pushes afterwards — so for the maintainer, the only person who records host-inheriting cassettes, CI is not a pre-publication gate and the hook is not one layer of two. It is the only gate, and anything it waves through reaches public history | `.githooks/pre-commit` (allowlist on `hook_status`; missing `dist/cli.js` blocks rather than warning; exit 3 split by cause via `--output-format json`) | `test/cassette-gate.test.ts` |
 | Staging a new/updated `baselines/desktop-*.json` must re-stamp or re-record the committed `examples/replays/*.cassette.json` fixtures against it in the same commit — `latest` resolves to the newest baseline file (`src/baseline.ts`, `latestBaselineFile`), so any staged baseline can move `latest` and instantly stale every example cassette's `fingerprint.baseline`; caught 3 times (3431e09, 9eaba8d, the 0.29.0 cycle), always late (on the release PR's first CI run) because these commits sit unpushed for a while | `.githooks/pre-commit` (runs `verify-cassettes` whenever a `baselines/desktop-*.json`, a `*.cassette.json`, or any staged `.json` carrying the `"generator": "cowork-harness"` marker is staged) | `test/cassette-gate.test.ts` — drives the hook in a scratch repo through a stubbed CLI, and separately pins the stub's exit-code contract against the real binary; CI's `Cassette privacy + staleness scan` and `Cassette scan covers every TRACKED cassette` steps (`ci.yml`) are the non-local backstop |

package/docs/maintenance.md

@@ -23,9 +23,11 @@ forward from the previous baseline untouched)
 ```
 
 > **`mountLayout.mounts[].mode` is documentary, and older baselines carry a stale `projects` row.**
-> Nothing reads that array at run time: `resolveMounts()` spreads it, but container/microvm/hostloop each
-> take only `cwd` and `mntRoot` from the result, and the one `mode === "r"` filter reads the launch plan's
-> mounts, not the baseline's. The `projects` row reads `mode: "rw"` in every baseline before
+> Nothing reads that array at run time: `resolveMounts()` does not return it at all, and
+> container/microvm/hostloop take only `cwd`, `sessionRoot` and `mntRoot` from the result — where
+> `mntRoot` is DERIVED as `<sessionRoot>/mnt` (the only tree the stagers create) rather than read from
+> `mountLayout.mntRoot`; a recorded value that disagrees is reported as a fidelity divergence at spawn.
+> The one `mode === "r"` filter reads the launch plan's mounts, not the baseline's. The `projects` row reads `mode: "rw"` in every baseline before
 > `desktop-1.25927.0`, which is **not uniformly wrong**: below `MOUNT_BARE_NAME_MIN_VERSION` (1.14271.0)
 > `.projects/<name>` really was the connected-folder namespace, and folders are resolver-driven `rw`. From
 > that boundary on, folders moved to `mnt/<basename>` and `.projects/<uuid>` became the project-attachment

package/docs/scenario.md

@@ -470,8 +470,8 @@ whether it **survives `replay`**. Both are in the key's row below, and the repla
 | `all_tasks_completed: true` | every task in the run's task list reached status `completed` — **requires ≥1 task** (a zero-task run fails; assert `task_count_min` for presence); **only `true` is valid**; also fails **evidence unavailable** ("malformed") when any TaskCreate result was unparseable (corrupt task telemetry) |
 | `task_count_min: <N>` | at least N tasks were created (`RunResult.tasks.length >= N`) — the presence companion for task assertions; also fails **evidence unavailable** ("malformed") when any TaskCreate result was unparseable (corrupt task telemetry) |
 | `task_status: {match, status}` | a task whose subject or id matches the `match` regex reached `status` — also fails **evidence unavailable** ("malformed") when any TaskCreate result was unparseable (corrupt task telemetry), mirroring `all_tasks_completed`/`task_count_min` |
-| `no_scratchpad_leak: true` | every file presented via `present_files` that was in the scratchpad was successfully promoted to `mnt/outputs` (none left behind) — vacuously passes if nothing was presented (pair with a presence check to require a delivery); content-class: both the `present_files` tool_use and its own tool_result live in the ordinary events stream, so this is meaningfully replay-checkable (the re-drive reproduces it); fails as **evidence unavailable** when `presentedFiles` telemetry is absent (an old run predating this key); **container-only on the merits**: hostloop serves `present_files` but never promotes (its handler passes a validated path through unchanged), so there is no scratch→outputs copy for this key to check — that's not a detection gap, though: hostloop's cwd already *is* the outputs dir, so a delivered file is visible there immediately (see `user_visible_artifact`'s footgun note above). On microvm and protocol, `present_files` isn't served at all, so there's no delivery record for this key to check — cannot-verify. Use `container` for present_files-based delivery you want this key to verify, or write directly to `outputs/`; **the tool name is lane-specific** — `present_files` is the desktop-local lane's tool (the one this harness emulates) while remote Cowork delivers via the agent-native `SendUserFile`, so a skill should describe the delivery outcome rather than naming either tool ([fidelity-gaps.md](./fidelity-gaps.md), "File delivery"); this key asserts the harness-side delivery record either way; **only `true` is valid** |
-| `present_files_called: true` | at least one file was actually delivered via the `present_files` tool (`presentedFiles` is non-empty) — the presence companion to `no_scratchpad_leak` (which passes vacuously when nothing was presented). Pair them to require a delivery **and** require it not to leak; **`fidelity: container` or `hostloop`** — the harness serves `present_files` at both (hostloop via a handler mirroring production's own host-loop branch: validate the path, pass it through, no promotion). `protocol` and `microvm` report cannot-verify. See the `no_scratchpad_leak` row, which stays container-only for a different reason; and see the lane note above: the tool name differs on remote Cowork; **only `true` is valid** |
+| `no_scratchpad_leak: true` | every file presented via `present_files` that was in the scratchpad was successfully promoted to `mnt/outputs` (none left behind) — vacuously passes if nothing was presented (pair with a presence check to require a delivery); content-class: both the `present_files` tool_use and its own tool_result live in the ordinary events stream, so this is meaningfully replay-checkable at the tier it evaluates on — the re-drive reproduces the classification at container, where the agent's cwd IS the session root the live lane measures from (at hostloop a re-drive has only the recorded cwd, `mnt/outputs`, so the booleans are not equivalent there); fails as **evidence unavailable** when `presentedFiles` telemetry is absent (an old run predating this key); **container-only on the merits**: hostloop serves `present_files` but never promotes (its handler passes a validated path through unchanged), so there is no scratch→outputs copy for this key to check — that's not a detection gap, though: hostloop's cwd already *is* the outputs dir, so a delivered file is visible there immediately (see `user_visible_artifact`'s footgun note above). On microvm and protocol, `present_files` isn't served at all, so there's no delivery record for this key to check — cannot-verify. Use `container` for present_files-based delivery you want this key to verify, or write directly to `outputs/`; **the tool name is lane-specific** — `present_files` is the desktop-local lane's tool (the one this harness emulates) while remote Cowork delivers via the agent-native `SendUserFile`, so a skill should describe the delivery outcome rather than naming either tool ([fidelity-gaps.md](./fidelity-gaps.md), "File delivery"); this key asserts the harness-side delivery record either way; **only `true` is valid** |
+| `present_files_called: true` | at least one file was actually delivered via the `present_files` tool (at least one call carried a well-formed `file_path`, counted at the invocation — **not** read off the classified `presentedFiles` list, so a redaction policy that rewrites host paths cannot turn a real delivery into "never called"; a run whose every call carried an unusable path reports cannot-verify) — the presence companion to `no_scratchpad_leak` (which passes vacuously when nothing was presented). Pair them to require a delivery **and** require it not to leak; **`fidelity: container` or `hostloop`** — the harness serves `present_files` at both (hostloop via a handler mirroring production's own host-loop branch: validate the path, pass it through, no promotion). `protocol` and `microvm` report cannot-verify. See the `no_scratchpad_leak` row, which stays container-only for a different reason; and see the lane note above: the tool name differs on remote Cowork; **only `true` is valid** |
 | `max_cost_usd: <N>` | the run's SDK-reported cost is ≤ N USD — fails as **evidence unavailable** when cost telemetry is absent (an old run predating this key). **Live lane only in spirit**: on replay this asserts the *frozen recording's* cost, not fresh spend — a cost regression is caught by a live run, not a token-free replay |
 | `max_tokens: <N>` | `usage.input_tokens + usage.output_tokens` ≤ N (cache-read/creation tokens excluded — priced separately). Same replay caveat as `max_cost_usd`: asserts the recording, not fresh spend |
 | `tool_calls_max: <N>` | total top-level tool calls (sum of `toolCounts`, sub-agent tools excluded) ≤ N — unlike the cost/token keys, this **is** meaningfully replay-checkable (the re-drive recomputes `toolCounts` deterministically from the recorded events) |

package/examples/replays/README.md

@@ -16,7 +16,7 @@ DOES exercise a real gate exchange, see `example-multiselect-gate.cassette.json`
 
 Run it with:
 
-> Assumes the `cowork-harness` CLI is available — from a source checkout run `npm ci && npm run build && npm link` first, or `npm i -g "cowork-harness@^2.1.0"`. (`replay` itself needs nothing else — no token, no Docker.)
+> Assumes the `cowork-harness` CLI is available — from a source checkout run `npm ci && npm run build && npm link` first, or `npm i -g "cowork-harness@^2.2.0"`. (`replay` itself needs nothing else — no token, no Docker.)
 
 ```sh
 cowork-harness replay examples/replays/example-pdf-skill.cassette.json

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cowork-harness",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "description": "Scriptable, CI-friendly harness for Claude Cowork's runtime contract for testing skills across scenarios \u2014 same agent, mounts, egress allowlist, permission protocol, and sandbox limitations.",
   "license": "MIT",
   "type": "module",

package/schema/run-result.json

@@ -137,6 +137,10 @@
       },
       "description": "present_files promotions ({from, to, promoted, leaked}) \u2014 scratch\u2192outputs deliverable surfacing (container tier)."
     },
+    "presentFilesCalls": {
+      "type": "integer",
+      "description": "How many present_files calls carried at least one well-formed file_path \u2014 the presence evidence present_files_called reads, counted from the tool_use input's shape so it survives redaction (presentedFiles entries are dropped when a path can't be classified, which a host-path policy guarantees at hostloop). Absent on pre-field results."
+    },
     "mode": {
       "type": "string",
       "enum": ["run", "chat"],

package/schema/scenario.schema.json

@@ -480,7 +480,7 @@
             "const": true
           },
           "present_files_called": {
-            "description": "at least one file was actually delivered via the present_files tool (presentedFiles is non-empty). The presence companion to no_scratchpad_leak (which passes vacuously when nothing was presented, and stays container-only) — pair them to require a delivery AND require it not to leak; CONTAINER + HOSTLOOP TIERS — the harness serves present_files at both, mirroring real Cowork advertising the tool in both its VM and host-loop modes; every other tier is still a harness coverage gap (see docs/fidelity-gaps.md, 'File delivery'). present_files is the DESKTOP-LOCAL lane's tool name; remote Cowork uses the agent-native SendUserFile (docs/fidelity-gaps.md, 'File delivery') — this key asserts the harness-side delivery record either way; only `true` is valid",
+            "description": "at least one file was actually delivered via the present_files tool (at least one call carried a well-formed file_path). Presence is read from the INVOCATION count, not from the classified presentedFiles list, so it is unaffected by a redaction policy that rewrites host paths; a run that called the tool but whose every call carried an unusable path reports cannot-verify, never 'the tool was never called'. The presence companion to no_scratchpad_leak (which passes vacuously when nothing was presented, and stays container-only) — pair them to require a delivery AND require it not to leak; CONTAINER + HOSTLOOP TIERS — the harness serves present_files at both, mirroring real Cowork advertising the tool in both its VM and host-loop modes; every other tier is still a harness coverage gap (see docs/fidelity-gaps.md, 'File delivery'). present_files is the DESKTOP-LOCAL lane's tool name; remote Cowork uses the agent-native SendUserFile (docs/fidelity-gaps.md, 'File delivery') — this key asserts the harness-side delivery record either way; only `true` is valid",
             "type": "boolean",
             "const": true
           },