cowork-harness 2.3.0 → 2.4.0

package/dist/run/execute.js

@@ -22,7 +22,7 @@ import { loadBaseline } from "../baseline.js";
 import { loadSession, resolveSessionPaths, buildLaunchPlan, userVisibleRootsFromPlan, readonlyFolderRootsFromPlan, deleteDeniedRootsFromPlan, pluginSkillRootsFromPlan, isConnectedContent, } from "../session.js";
 import { spawnProtocol } from "../runtime/protocol.js";
 import { spawnContainer } from "../runtime/container.js";
-import { spawnHostLoop, WORKSPACE_TOOL_ALIASES } from "../runtime/hostloop.js";
+import { spawnHostLoop, WORKSPACE_TOOL_ALIASES, VM_LOOP_TOOL_ALIASES } from "../runtime/hostloop.js";
 import { snapshotHostLoopWorkspace } from "../runtime/hostloop-stage.js";
 import { checkHostLoopWriteConsent, logHostWriteNotice } from "../hostloop/safety.js";
 import { warnUnservedHookEvents } from "./hook-events.js";
@@ -558,6 +558,9 @@ export async function executeScenario(scenario, opts = {}) {
     let containerName;
     let deregisterContainerReap; // Ctrl-C cleanup for the agent container
     let hostEgress; // host-routed web_fetch egress
+    // Container's web_fetch is host-routed too, so its decisions cannot come from the proxy log and must
+    // survive the `egress = eg.entries` teardown assignment. Kept separate for exactly that reason.
+    const containerWebFetchEgress = [];
     let hostloopHooks; // hostloop's PreToolUse path-gate bundle
     let hostloopPathGateFired; // tool_use_ids the path gate actually saw
     let hostloopInfraErrors; // spawnHostLoop's live infra sink (sidecar crash + failed execs, tagged by origin) — folded into record.infraErrors below
@@ -732,6 +735,12 @@ export async function executeScenario(scenario, opts = {}) {
                     runToken,
                     suggestSkillsEnabled,
                     proactiveSkillSuggestEnabled,
+                    // Same gate production reads for its VM-loop web_fetch registration. Read once above and shared
+                    // with the hostloop branch so the two tiers cannot drift apart on it.
+                    webFetchViaApi: viaApiOn,
+                    provenanceRef,
+                    dedup,
+                    onEgress: (e) => containerWebFetchEgress.push(e),
                 });
                 child = ct.child;
                 containerName = ct.containerName; // so the Ctrl-C / finally reap removes the agent container by name
@@ -794,7 +803,11 @@ export async function executeScenario(scenario, opts = {}) {
             // fill the provenance bundle (backed by Run's tracker + recorded approval) BEFORE drive().
             // Host-loop only, and only when the web_fetch-via-API gate is on; otherwise the handler stays
             // allowlist-only (ref.current undefined). Run seeds the set from turns + tool_results.
-            if (effectiveFidelity === "hostloop" && viaApiOn) {
+            // BOTH loops, not just host-loop: production's VM-loop factory calls the provenance path
+            // unconditionally and has no allowlist fallback in it at all. Leaving `ref.current` undefined at
+            // container drops the handler onto PATH B — the gate-OFF path — even though the tool exists only
+            // BECAUSE the gate is on, which is the inverse of production.
+            if ((effectiveFidelity === "hostloop" || effectiveFidelity === "container") && viaApiOn) {
                 run.enableWebFetchGate();
                 provenanceRef.current = {
                     isAllowed: (u) => run.provenanceHas(u),
@@ -811,7 +824,15 @@ export async function executeScenario(scenario, opts = {}) {
                         subagentAppend: prompts.subagentAppend,
                         sdkMcp,
                         hooks: hostloopHooks,
-                        ...(effectiveFidelity === "hostloop" ? { toolAliases: WORKSPACE_TOOL_ALIASES } : {}),
+                        // Host-loop aliases Bash+WebFetch; the VM loop aliases WebFetch alone, and only when the
+                        // gate that put the workspace server there is on. Tied to the SAME `viaApiOn` that drives the
+                        // disallow in spawnContainer — an alias to a server this run never registered would resolve a
+                        // bare WebFetch onto nothing.
+                        ...(effectiveFidelity === "hostloop"
+                            ? { toolAliases: WORKSPACE_TOOL_ALIASES }
+                            : effectiveFidelity === "container" && viaApiOn
+                                ? { toolAliases: VM_LOOP_TOOL_ALIASES }
+                                : {}),
                     });
                 }
                 catch (e) {
@@ -857,9 +878,14 @@ export async function executeScenario(scenario, opts = {}) {
                 egressMalformedLines += eg.malformedLines; // applied to record.evidenceErrors after the finally, where `record` is assigned (#39)
                 sidecar.teardown();
             }
-            // merge host-routed web_fetch decisions (host-loop) so they're visible to egress assertions.
+            // merge host-routed web_fetch decisions so they're visible to egress assertions. This MUST come
+            // after the `egress = eg.entries` above, which replaces the array wholesale with the proxy log —
+            // a log that can never contain a host-side fetch. Both loops route web_fetch off-container, so
+            // both need the merge; container's decisions were being discarded by that assignment.
             if (hostEgress?.length)
                 egress = [...egress, ...hostEgress];
+            if (containerWebFetchEgress.length)
+                egress = [...egress, ...containerWebFetchEgress];
             hostProxy?.close();
         }
         // A post-listen egress-sidecar crash (container topology) surfaces as `fatalError` after teardown —
@@ -1089,9 +1115,21 @@ export async function executeScenario(scenario, opts = {}) {
         // on-disk content), so a claim about a written artifact is presentation-stable (not a paste-vs-write
         // coin-flip). Captured here — BEFORE the semantic pre-pass below — using the pre-run manifest to diff
         // added/modified files. (`[]` when there's no manifest, e.g. a --resume run.)
-        // F12: at container/hostloop the agent's cwd is the SESSION ROOT (parent of `mnt`), not `mnt` — so a
-        // relative `Write outputs/x` lands in the scratchpad, outside `workRoot`. Pass the session root so those
-        // cwd-relative deliverables are captured too (`workRoot` ends `/session/mnt`; its parent is the root).
+        // F12, CORRECTED 2026-08-27: the old text said "at container/hostloop the agent's cwd is the SESSION
+        // ROOT". True at CONTAINER only. At hostloop the agent process sits at `mnt/outputs` (see
+        // `hostLoopCwds` in src/runtime/hostloop.ts), so a bare `Write` there lands INSIDE `workRoot` and needs
+        // no scratchpad walk to be seen. The branch is still right, but for two different reasons per tier:
+        //   container — agent cwd IS the session root, so a relative `Write` lands outside `workRoot`;
+        //   hostloop  — the agent writes inside `mnt`, but `mcp__workspace__bash` starts at the session root,
+        //               so a relative SHELL write lands outside `workRoot`.
+        // Either way `workRoot` ends `/session/mnt` and its parent is the root, so passing it captures what the
+        // run actually authored.
+        //
+        // KNOWN FALSE-GREEN, deliberately not fixed here (see docs/fidelity-gaps.md, "Path resolution"):
+        // production DISCARDS anything written outside `mnt/` — "never reaches the user or your file tools" —
+        // while the harness bind-mounts the whole session dir, so these files persist and can be graded as
+        // authored. That is correct for the semantic judge (the run did write them) and wrong as a model of
+        // delivery. `user_visible_artifact` is unaffected: it checks user-visible ROOTS, not this set.
         const scratchpadRoot = workRoot.endsWith(`${sep}mnt`) ? dirname(workRoot) : undefined;
         // On a resume the session root is REUSED, so the scratchpad no longer starts empty — a prior turn's files
         // would be mis-attributed as this turn's authorship. Skip the scratchpad walk in that case (evidence-
@@ -1519,10 +1557,37 @@ const isFileRelative = (p) => p !== "(inline)" && !isAbsolute(p) && !p.startsWit
  * file's directory (not the cwd), so a scenario+session bundle is self-contained and
  * relocatable. Use this everywhere a scenario is read from disk (`run`, `record`).
  */
+/** True when the YAML did not name a tier, so `fidelity` came from the schema default.
+ *
+ *  Must be read from the RAW document: Zod's `.default("container")` makes the parsed object
+ *  indistinguishable from one that said `fidelity: container` on purpose, and those two cases deserve
+ *  different treatment — an author who chose the tier has made the choice, one who omitted it has not.
+ *
+ *  Why anyone cares: the default models the VM-LOOP lane, and production runs HOST-LOOP (gate 1143815894
+ *  is force-ON in every shipped baseline). So a scenario that omits the key is measured against the lane
+ *  real users are not on — silently. Measured 2026-08-27; see docs/fidelity-gaps.md, "Path resolution". */
+export function fidelityWasDefaulted(raw) {
+    return typeof raw === "object" && raw !== null && !("fidelity" in raw);
+}
+/** The deprecation notice for a defaulted tier. `fidelity` becomes REQUIRED in the next major; until
+ *  then this warns rather than failing, so consumers get told before they get an error. */
+export function defaultedFidelityNotice(name) {
+    return (`::warning:: [scenario] ${name}: no \`fidelity:\` — defaulting to \`container\`, which models the ` +
+        `VM-LOOP lane. Production runs HOST-LOOP by default (gate 1143815894), so this scenario is likely ` +
+        `measured against a lane your users are not on: the file tools resolve a bare relative path ` +
+        `differently, the shell starts somewhere else, and the offered tool set differs. Name a tier ` +
+        `explicitly — \`fidelity: hostloop\` to match production, \`fidelity: cowork\` to auto-pick the way ` +
+        `Cowork does, or \`fidelity: container\` to keep today's behaviour deliberately. Switching tiers can ` +
+        `COST you assertions: \`no_scratchpad_leak\` is container-only (a lint error elsewhere) and ` +
+        `\`transcript_no_host_path\` fails by design at hostloop/protocol. ` +
+        `DEPRECATION: the default is being removed — \`fidelity:\` becomes REQUIRED in the next major.`);
+}
 export function parseScenarioFile(path) {
     let scenario;
+    let rawDoc;
     try {
-        scenario = Scenario.parse(parseYaml(readFileSync(path, "utf8")));
+        rawDoc = parseYaml(readFileSync(path, "utf8"));
+        scenario = Scenario.parse(rawDoc);
     }
     catch (e) {
         // A schema violation is a USER mistake (a typo'd/retired key like `profile:`, a bad enum value),
@@ -1535,6 +1600,9 @@ export function parseScenarioFile(path) {
     // `name` defaults to the filename (sans extension) — the file is the identity.
     if (!scenario.name)
         scenario.name = basename(path).replace(/\.ya?ml$/i, "");
+    // Warn, do not fail: this is the deprecation window before `fidelity` becomes required.
+    if (fidelityWasDefaulted(rawDoc))
+        process.stderr.write(defaultedFidelityNotice(scenario.name) + "\n");
     if (isFileRelative(scenario.session))
         scenario.session = resolve(dirname(path), scenario.session);
     // Load-time regex validation: fail fast with a clear message rather than letting a malformed pattern

package/dist/runtime/container.js

@@ -9,9 +9,28 @@ import { capturePreRunManifest } from "../run/pre-run-manifest.js";
 import { makeCoworkHandler } from "../hostloop/cowork-handler.js";
 import { makeSkillsHandler, SKILLS_PLUGINS_TOOL_NAMES } from "../hostloop/skills-handler.js";
 import { makePluginsHandler } from "../hostloop/plugins-handler.js";
+import { makeWorkspaceHandler } from "../hostloop/workspace-handler.js";
 import { combineSdkMcp } from "../agent/session.js";
 import { listMountedSkills } from "../run/skill-metadata.js";
 import { resolveAgentImage, resolveContainerRuntime } from "./agent-image.js";
+/** The VM loop's web_fetch surface, as three coupled answers derived from ONE gate reading.
+ *
+ *  Exported and pure because the bug this prevents lives at the CALL SITE, not in any one value: the
+ *  three parts (advertise, do-not-pre-approve, disallow the built-in) are only correct together, and
+ *  each can be dropped independently without any other test noticing. An adversarial review deleted the
+ *  disallow and the alias and the entire suite still passed.
+ *
+ *  - `advertised`   — the workspace tool the model can see.
+ *  - `preApproved`  — deliberately EMPTY. Production gates web_fetch at can_use_tool (its VM-loop
+ *                     registration passes the same approval hook the host loop does), so pre-approving
+ *                     would make a scripted `webfetch:<domain>` answer and `decide: deny` silently inert.
+ *  - `disallowed`   — the built-in name production removes. Ships with the alias in execute.ts; without
+ *                     that alias a bare `WebFetch` resolves onto nothing instead of the workspace tool. */
+export function vmLoopWebFetchSurface(webFetchViaApi) {
+    if (!webFetchViaApi)
+        return { advertised: [], preApproved: [], disallowed: [] };
+    return { advertised: ["mcp__workspace__web_fetch"], preApproved: [], disallowed: ["WebFetch"] };
+}
 /**
  * L1 — container parity runtime. Runs the staged in-VM agent in a sandboxed arm64
  * Linux container that reproduces the Desktop→agent spawn contract (asar 1.12603.1):
@@ -71,6 +90,12 @@ export function spawnContainer(_scenario, baseline, plan, outDir, sessionId, opt
     // `lane: remote` serves no cowork server, so the tool must not be advertised or pre-approved either:
     // a registered tool with no backing server is a phantom capability the model can try and fail to use.
     const coworkTools = plan.lane === "remote" ? [] : ["mcp__cowork__present_files"];
+    // Mirror production's VM-loop web_fetch swap: the built-in name goes away and the workspace tool takes
+    // its place. ADVERTISED but deliberately NOT pre-approved — production's VM-loop registration passes
+    // the same `requestWebFetchApproval` hook the host loop does, so the call is gated at can_use_tool.
+    // `spawnHostLoop` splits extraTools/extraAllowedTools for exactly this reason; pre-approving here
+    // would make a scripted `webfetch:<domain>` answer, and a `decide: deny` on it, silently inert.
+    const { advertised: webFetchTools, disallowed: webFetchDisallowed } = vmLoopWebFetchSurface(!!opts.webFetchViaApi);
     const claudeArgs = agentArgs(baseline, plan, {
         mntRoot,
         systemPromptAppend: opts.systemPromptAppend,
@@ -83,7 +108,10 @@ export function spawnContainer(_scenario, baseline, plan, outDir, sessionId, opt
         // The 5 skills/plugins discovery tools are declared on the SAME cowork lane as present_files (spec
         // §3: `isEnabled` = `sessionType==="cowork"`, which container satisfies) — pre-approved for the same
         // off-registry-auto-allow reason present_files is.
-        extraTools: [...coworkTools, ...SKILLS_PLUGINS_TOOL_NAMES],
+        disallowed: webFetchDisallowed,
+        extraTools: [...coworkTools, ...webFetchTools, ...SKILLS_PLUGINS_TOOL_NAMES],
+        // web_fetch is absent here ON PURPOSE — see webFetchTools above. It is the one registered tool this
+        // tier does not pre-approve, because production gates it at can_use_tool.
         extraAllowedTools: [...coworkTools, ...SKILLS_PLUGINS_TOOL_NAMES],
     });
     const dockerArgs = dockerRunArgv({
@@ -133,7 +161,30 @@ export function spawnContainer(_scenario, baseline, plan, outDir, sessionId, opt
         servers: ["plugins"],
         handle: makePluginsHandler({ mountedPlugins }),
     };
-    const sdkMcp = combineSdkMcp(...(coworkBundle ? [coworkBundle] : []), skillsBundle, pluginsBundle);
+    // VM-LOOP web_fetch. Production's non-host-loop site, gated on `coworkWebFetchViaApi`, registers a
+    // workspace server exposing **web_fetch only**, disallows the built-in `WebFetch`, and aliases the name.
+    // Bash is deliberately untouched here — that replacement is host-loop-only, which is why this tier keeps
+    // the built-in shell. `containerName` is supplied because the handler's type wants it; the web_fetch
+    // path never execs into the container.
+    const workspaceBundle = opts.webFetchViaApi
+        ? {
+            servers: ["workspace"],
+            handle: makeWorkspaceHandler({
+                containerName,
+                vmMnt: `${sessionRoot}/mnt`,
+                provenanceRef: opts.provenanceRef,
+                dedup: opts.dedup,
+                onEgress: opts.onEgress,
+                // MUST be passed. The handler defaults this to ["*"], and compile(["*"]) is `() => true` — so
+                // omitting it hands the tier an UNRESTRICTED fetcher that runs in the harness's own Node
+                // process, outside the container network namespace and therefore invisible to the sidecar
+                // proxy. That silently voids this tier's default-deny egress promise for this one tool.
+                webFetchAllow: plan.egressAllow,
+                tools: ["web_fetch"],
+            }),
+        }
+        : undefined;
+    const sdkMcp = combineSdkMcp(...(workspaceBundle ? [workspaceBundle] : []), ...(coworkBundle ? [coworkBundle] : []), skillsBundle, pluginsBundle);
     // `sessionRoot` is the VM path the agent sees (`-w` above, and the cowork handler's own
     // `sessionRootVm`). Returned so the caller classifies present_files against the root THIS spawn used,
     // instead of re-deriving one — the two lived in different path spaces (host vs VM) once, which made

package/dist/runtime/hostloop.js

@@ -33,9 +33,19 @@ export const HOSTLOOP_PATH_GATE_ID = "hostloop-path-gate";
 /** Production's host-loop tool aliases (asar `et()`; single-hop, deny rules do NOT expand across the
  *  alias). An alias never GRANTS a tool — it resolves only when the target is already in the caller's
  *  bound set, so a bare Bash/WebFetch from a sub-agent without the workspace tool bound still fails.
- *  Host-loop-only: the container/microvm tiers register no workspace server to alias to (see
- *  docs/fidelity-gaps.md). */
+ *  BOTH names are host-loop-only. The VM loop replaces web_fetch alone and never touches Bash — use
+ *  `VM_LOOP_TOOL_ALIASES` there, not this map. */
 export const WORKSPACE_TOOL_ALIASES = { Bash: "mcp__workspace__bash", WebFetch: "mcp__workspace__web_fetch" };
+/** The VM loop's alias set: web_fetch ONLY, applied when `coworkWebFetchViaApi` is on.
+ *
+ *  "Bash is the only tool that truly diverges between loops" — the VM loop keeps the built-in shell and
+ *  aliases only WebFetch, so aliasing Bash here would invent a tool production does not replace.
+ *
+ *  Without this, disallowing `WebFetch` at container is a REGRESSION rather than a fidelity fix: the
+ *  built-in stops resolving and nothing catches the bare name, so a model that emits `WebFetch` hard-fails
+ *  where production silently resolves it to the workspace tool. The disallow and the alias are two halves
+ *  of one behaviour and must ship together. */
+export const VM_LOOP_TOOL_ALIASES = { WebFetch: "mcp__workspace__web_fetch" };
 /**
  * Pure builder for the hostloop native process's env: `hostNativeSpawnEnv`'s contract-layer output
  * layered over this REAL macOS process's own `...process.env` base (unlike container/microvm, which
@@ -69,6 +79,23 @@ export function buildHostLoopNativeEnv(baseline, opts) {
  *  (/tmp→/private/tmp, /var→/private/var on macOS) makes the agent's realpath'd wire cwd differ from the
  *  un-canonicalized spawner cwd even for the SAME directory — a false alarm this collapses. The gate
  *  decision is unaffected (it realpaths candidate and roots itself); this only governs the diagnostic. */
+/** The host-loop cwd SPLIT, in one place because the two halves are only correct TOGETHER.
+ *
+ *  Production keeps them deliberately different, measured on desktop-local Cowork 2026-08-27:
+ *   - the agent process sits at the OUTPUTS dir, so its file tools resolve a bare `Write` there;
+ *   - every `mcp__workspace__bash` call starts at the bare SESSION ROOT, and bash resets its cwd
+ *     between calls ("no cwd/env carryover"), so a relative shell path can never be `cd`-ed elsewhere.
+ *
+ *  Cowork's own sub-agent prompt states the second half: "Each command starts in `<vmCwd>`; anything
+ *  written outside `<vmCwd>/mnt/` (including /tmp) stays in that environment and never reaches the user
+ *  or your file tools."
+ *
+ *  Collapsing them — which this harness did until 2026-08-27, running bash at the outputs dir — makes a
+ *  skill that writes relative paths from a script look correct here and deliver nothing in production.
+ *  Keep them as one function so a future edit cannot move one and leave the other. */
+export function hostLoopCwds(sessionRoot, hostOutputsDir) {
+    return { agentProcessCwd: hostOutputsDir, workspaceBashCwd: sessionRoot };
+}
 export function pathGateCwdMismatch(wireCwd, spawnerCwd) {
     const canon = (p) => {
         try {
@@ -274,7 +301,11 @@ export function spawnHostLoop(_scenario, baseline, plan, outDir, sessionId, opts
             return checkHostLoopPathGate(input?.tool_name, input?.tool_input ?? {}, gateCfg);
         },
     };
-    const child = spawn(agentNativeHost, nativeArgs, { cwd: hostOutputsDir, env: nativeEnv, stdio: ["pipe", "pipe", "pipe"] });
+    const child = spawn(agentNativeHost, nativeArgs, {
+        cwd: hostLoopCwds(sessionRoot, hostOutputsDir).agentProcessCwd,
+        env: nativeEnv,
+        stdio: ["pipe", "pipe", "pipe"],
+    });
     // The VM sidecar container: bash/web_fetch's `docker exec` target. No agent inside it (the agent is
     // the native `child` above) — it runs a keep-alive command (dockerRunArgv's default when `agentArgv` is
     // omitted). Folders are bind-mounted here as REAL host paths (never copied); `.claude/skills`+
@@ -310,11 +341,24 @@ export function spawnHostLoop(_scenario, baseline, plan, outDir, sessionId, opts
     const infraErrors = [];
     const { logSidecarInfra, logExecInfra } = makeInfraEmitters(outDir, infraErrors);
     const { markTearingDown } = watchHostLoopSidecar(sidecarChild, logSidecarInfra);
-    // Production's vmCwd is the first non-network-drive connected folder's mount name, falling back to
-    // outputs — never the bare session root or bare mnt/. The harness has no network-drive detection; an
-    // unmountable folder fails loud at container start instead (a documented, deliberate divergence).
-    const firstFolder = plan.mounts.find((mt) => mt.kind === "folder");
-    const execCwd = `${sessionRoot}/mnt/${firstFolder ? firstFolder.mountPath : "outputs"}`;
+    // Every `mcp__workspace__bash` call starts at the bare SESSION ROOT — not a connected folder, not
+    // outputs. MEASURED on desktop-local Cowork 2026-08-27, twice: `pwd` returned `/sessions/<id>` with no
+    // folder connected AND with one connected. Cowork's own sub-agent prompt says the same thing: "Each
+    // command starts in `<vmCwd>`; anything written outside `<vmCwd>/mnt/` (including /tmp) stays in that
+    // environment and never reaches the user or your file tools."
+    //
+    // This REPLACES a `${sessionRoot}/mnt/${firstFolder ?? "outputs"}` derivation whose comment claimed
+    // production's vmCwd was the first connected folder "never the bare session root". That claim came from
+    // the asar's `cwd: c.vmCwd` spawn argument, which is NOT load-bearing on the cowork path — only the
+    // `chat` branch prepends an explicit `cd ${vmCwd}`, which would be redundant if the argument worked.
+    // The old value was never faithful: it reproduced a prompt claim rather than an observed behaviour.
+    //
+    // It is deliberately NOT the agent-process cwd. The agent spawns at `hostOutputsDir` (see the
+    // `spawn(agentNativeHost, …, { cwd: hostOutputsDir })` above) so its FILE TOOLS resolve relative paths
+    // against outputs, while the SHELL sits at the session root. Production keeps those two values
+    // different on purpose; collapsing them is the bug this replaces. Both are pinned together in
+    // test/baseline.test.ts — a single-value assertion cannot express the split.
+    const execCwd = hostLoopCwds(sessionRoot, hostOutputsDir).workspaceBashCwd;
     // Host-routed web_fetch bypasses the sidecar proxy, so collect its egress decisions here and
     // surface them to execute.ts → result.egress, making host-loop web_fetch visible to egress assertions.
     const hostEgress = [];

package/dist/sync/cowork-sync.js

@@ -46,8 +46,11 @@ export const PINNED_GATES = {
     // replaces the hardcoded subagent_env_hl / subagent_env_vm fallback texts (resolveSection). OFF live
     // (source defaultValue) -> the hardcoded texts are the wire text the committed paraphrase assets
     // model. An ON flip is invisible to the text sentinel (the hardcoded template is unchanged), so
-    // checkSubagentOverrideGate additionally emits a HARD-STOP unknown delta on ON — a pinned drift
-    // alone is a non-blocking warning.
+    // checkSubagentOverrideGate emits a non-blocking WARNING on ON (downgraded from a hard delta
+    // 2026-08-27): gate-ON only enables the lookup, and the payload that would actually override is
+    // delivered per-session by the server — invisible to every input sync reads. A guard that can never
+    // clear itself from its own inputs blocks forever rather than tripping. Settled by a live sub-agent
+    // probe instead; see the message body.
     "124685897": "subagentPromptServerOverride",
     // Spawn-env conditional gates: each controls a key in the Desktop→agent spawn env
     // (SPAWN_GATES). Pinned so a production flip surfaces BOTH as a provenance.gates diff AND as the
@@ -351,10 +354,23 @@ export function checkSubagentOverrideGate(gates) {
     if (!gates?.["124685897"]?.on)
         return [];
     return [
-        "gate subagentPromptServerOverride:124685897 reads ON — a server-delivered spSectionPrompts override " +
-            "is active for the sub-agent append; the harness has no captured override text, so the committed " +
-            "fallback assets would ship as if verified. Capture the override text, update the subagent-append " +
-            "assets + fingerprints, then re-sync.",
+        "gate subagentPromptServerOverride:124685897 reads ON — the sub-agent append MAY be server-overridden " +
+            "and this sync CANNOT TELL from its own inputs. Gate-ON only enables the lookup: the asar reads the " +
+            "section entry and, when it is missing or empty, logs `using hardcoded fallback` and returns the " +
+            "built-in text anyway. The entry is delivered PER SESSION by the server — it is in neither the asar, " +
+            "the fcache nor config.json — so gate state alone cannot separate 'override active' from 'gate on, " +
+            "no payload, fallback still correct'. " +
+            "This gate is SERVER-SIDE and Desktop-version-INDEPENDENT (it flipped off->on via " +
+            '`source:"defaultValue"` with the asar byte-identical, 1.37937.1 -> .3) — do NOT go looking for a ' +
+            "Desktop change. " +
+            "WARNING, not a refusal: probed live 2026-08-27 on desktop-local Cowork (agent 2.1.246, hl branch, " +
+            "no folder connected). A real sub-agent's environment section matched the committed asset on all " +
+            "four load-bearing claims — host cwd, mcp__workspace__bash in an isolated Linux env, folders under " +
+            "<vmCwd>/mnt/, and shell starting in <vmCwd> with non-mnt writes reaching neither the user nor the " +
+            "file tools — so NO override was reaching that account and the committed paraphrase is faithful. " +
+            "That is EVIDENCE, NOT PROOF: one account, one session, and a server rule can be segment-targeted. " +
+            "If the sub-agent append matters to what you are about to ship, re-probe (dispatch a sub-agent, ask " +
+            "for its environment section verbatim, diff the four claims) rather than trusting this note.",
     ];
 }
 /** Read `network.allowDomains` from the NEWEST committed baseline — the pinned, hand-curated egress
@@ -445,8 +461,10 @@ export function sync() {
         // only count gates that actually matched a live fcache feature.
         flag(unknown, "gates: fcache decoded but NONE of the pinned gate IDs matched — gate IDs may have been re-keyed; update PINNED_GATES in cowork-sync.ts");
     }
-    for (const f of checkSubagentOverrideGate(gates))
-        flag(unknown, f);
+    // WARNING, not a hard delta — downgraded 2026-08-27 on MEASURED evidence, see checkSubagentOverrideGate.
+    // It blocked the write while being unable to distinguish the two states it names; a guard that can
+    // never clear itself from its own inputs is a permanent block, not a tripwire.
+    notes.push(...checkSubagentOverrideGate(gates));
     return {
         appVersion,
         agentVersion,

package/dist/types.js

@@ -719,7 +719,7 @@ export const ScenarioObject = z.strictObject({
     fidelity: z
         .enum(FIDELITY_TIERS)
         .default("container")
-        .describe("isolation tier: protocol (L0, no sandbox) | container/microvm (force a VM-loop tier) | hostloop (force host-loop) | cowork (auto-pick host-loop vs. container via Cowork's own gate logic)"),
+        .describe("isolation tier: protocol (L0, no sandbox) | container/microvm (force a VM-loop tier) | hostloop (force host-loop) | cowork (auto-pick host-loop vs. container via Cowork's own gate logic). DEPRECATION: omitting this key is deprecated and the field becomes REQUIRED in the next major. The `container` default models the VM loop, while production runs the host loop by default (gate 1143815894), so an omitted key likely measures the scenario against a lane your users are not on — a bare relative path lands elsewhere, the shell starts elsewhere, and the offered tool set differs. Name a tier: hostloop to match production, cowork to auto-pick the way Cowork does, or container to keep the current behaviour deliberately."),
     // execution LOCATION, orthogonal to `fidelity` (a local privilege tier) — do NOT collapse the two.
     // `cloud-describe` is RESERVED: no runner exists yet, so authoring it is a load-time error (see
     // execute.ts's validateScenarioRegexes, which mirrors the `replay_protocol_fidelity` rejection).

package/docs/fidelity-gaps.md

@@ -181,6 +181,46 @@ The `--help` text notes this at runtime. If you need to test egress policy, use
 
 ---
 
+## Browser tools are not served — and egress assertions say nothing about that path
+
+**Real Cowork behaviour:** Desktop `1.37937.1` serves an in-app browser to Cowork agent sessions as
+`mcp__Claude_Browser__*` — 16 tools (`browser_batch`, `computer`, `find`, `form_input`, `get_page_text`,
+`javascript_tool`, `navigate`, `preview_start`, `read_console_messages`, `read_network_requests`,
+`read_page`, `resize_window`, `tabs_close`, `tabs_context`, `tabs_create`, `tabs_select`). Two gates
+carry it, `17519066` and `3990395613`; both read `on:true source:"force"` in the live fcache
+(2026-08-27). Chat mode does not receive them. The tool list comes from real sessions' `system/init`
+arrays; the browser's *behaviour* is unprobed, so treat the limits Anthropic's prompt text describes
+(no `file://`, no Claude-started `localhost`) as documentation rather than observation.
+
+**Harness behaviour:** none of the 16 are served, and neither gate is in `PINNED_GATES`. A skill that
+calls one gets an unknown-tool error — a false-RED, and the cheaper half of this gap.
+
+**The half that matters is what a GREEN does not cover.** Egress entries have exactly two sources: the
+sidecar proxy's `onDecision` (container traffic, which is what `bash` uses) and the workspace
+`web_fetch`'s `onEgress`. In production the browser pane runs Desktop-side — it traverses neither the
+container nor the harness's proxy. So this tier of the contract has a hole that no assertion reports:
+
+> **`egress_denied` and the other `egress_*` assertions do not cover browser-tool traffic.** They are
+> evidence about `bash` and `web_fetch` only. A run where they pass is silent about whether the skill
+> could reach the network through the browser in production — not proof that it could not.
+
+That silence is easy to over-read, because "default-deny egress held" is exactly the sentence a reader
+wants from a green egress assertion. It is true of the paths the harness models and says nothing about
+the one it does not.
+
+**Why the tools are not modelled:** driving a real browser pane is disproportionate to the value.
+Declaring the 16 names so calls resolve is a much smaller step than serving behaviour, and the
+declaration-vs-rendered distinction elsewhere in this document covers the difference — worth doing if a
+real skill needs it, not before. Anything added must be gate-conditional: this is per-account
+(force-ON here, not necessarily elsewhere), so it needs both gate ids pinned first.
+
+**One sync trap, latent today.** `preview_start` is served in Cowork with a **different input schema**
+than its base definition — `{url}` (open a tab; explicitly no dev server on that surface) versus
+`{name}` (start a dev server from `.claude/launch.json`). Same tool name, no shared field, chosen by
+session kind at tool-list construction. Nothing in the harness reasons about that tool, so nothing is
+wrong today; if a sentinel or `deriveSpawnEnv` ever does, the surface qualifier is load-bearing and a
+name-only match would silently pick the wrong schema.
+
 ## No session resume in `chat`
 
 **Real Cowork behaviour:** Sessions persist and can be resumed across launches.
@@ -464,11 +504,39 @@ read-only categories (uploads hardlink write-block, spool, plugin) ARE modeled.
 `web_fetch` (gate `coworkWebFetchViaApi`, live true) — "Bash is the only tool that truly diverges
 between loops."
 
-**Harness behaviour:** host-loop sets both aliases (`WORKSPACE_TOOL_ALIASES`, hostloop.ts) on the
-`initialize` control_request. The container/microvm tiers register only the `cowork` SDK server — no
-workspace `web_fetch` server exists there to alias to — so they set NO aliases. Consequence: a VM-tier
-model emitting a bare `WebFetch` errors in the harness where production resolves it. Host-loop is the
-production-default loop; use hostloop for alias-sensitive scenarios.
+**Harness behaviour:** CLOSED at `container`, still OPEN at `microvm`.
+
+Host-loop sets both aliases (`WORKSPACE_TOOL_ALIASES`, hostloop.ts) on the `initialize`
+control_request. `container` now models the VM-loop registration: when `coworkWebFetchViaApi` resolves
+on (true in every shipped baseline), it registers a workspace server exposing **web_fetch only**,
+disallows the built-in `WebFetch`, and aliases the name via `VM_LOOP_TOOL_ALIASES`. Bash is deliberately
+untouched there — "Bash is the only tool that truly diverges between loops" — which is why `container`
+keeps the built-in shell while host-loop replaces it.
+
+The three parts ship together on purpose. Disallowing the built-in **without** the alias would turn a
+fidelity fix into a regression: the bare name would stop resolving instead of landing on the workspace
+tool. Registering the tool without pre-approving it would trip the off-registry auto-allow guard.
+
+**`chat` does not do the swap.** `chat --fidelity container` spawns without the gate, so it still offers
+the built-in `WebFetch` and no `mcp__workspace__web_fetch`. The swap is a `run`/`record` property today.
+Debugging a skill in `chat` and then running it as a scenario therefore presents two different tool sets
+at the same declared tier — check the tier's inventory in the run's `system/init` rather than assuming
+`chat` matches.
+
+**`microvm` is still unaliased** — `spawnMicroVm` does not receive the gate, so that tier continues to
+offer the built-in `WebFetch` and a bare emission there does not reach a workspace server. Use
+`container` or `hostloop` for alias-sensitive scenarios.
+
+**Consequence for scenarios:** at `container` the offered set contains `mcp__workspace__web_fetch`, and
+not `WebFetch`. An assertion naming the built-in (`tool_called: WebFetch`, `tool_not_called: WebFetch`)
+therefore names a tool that does not exist at this tier — and `tool_not_called` passes **vacuously**
+rather than failing loudly, which is the harder direction to notice. Name `mcp__workspace__web_fetch`
+instead — **but that name is itself tier-dependent**: `microvm` and `protocol` never offer it, so the same
+assertion is permanently vacuous THERE. There is no single spelling that is meaningful at every tier,
+because the tiers genuinely differ; switching a scenario's `fidelity:` can silently turn a web-fetch
+assertion into a tautology in either direction. Pair it with a positive assertion that fails if the tool
+set is not what you assumed, or keep the scenario on the tier it was written for. `verify-cassettes` emits a `replaced-builtin` note when a recorded init inventory names a
+built-in absent from the tier's current set.
 
 ## Skill/plugin discovery SDK-MCP servers — modeled on container/hostloop; microvm/protocol pending
 
@@ -892,6 +960,61 @@ branch never promotes, so there is no scratch→outputs copy to leak there.
 path model to work against; `microvm` stages into a different tree than the artifact scan walks. Both
 report can't-verify rather than passing vacuously.
 
+### Path resolution: the shell and the file tools use DIFFERENT roots (measured 2026-08-27)
+
+**The two roots are modeled; what remains divergent is whether the write SURVIVES.** On the
+desktop-local lane, production resolves a relative path differently depending on which tool writes it:
+
+| | production (host-loop) | `container`/`microvm` (VM-loop) | `hostloop` |
+|---|---|---|---|
+| file tools (`Write`/`Read`) base | `mnt/outputs` | session root | `mnt/outputs` ✓ |
+| `mcp__workspace__bash` cwd | session root | session root ✓ | session root ✓ |
+
+Both cwds come from a single function (`hostLoopCwds`, `src/runtime/hostloop.ts`) and are pinned together
+in one test, because a single-value assertion cannot express "the shell and the file tools disagree, on
+purpose" — and collapsing them into one value is the mistake this arrangement exists to prevent.
+
+Confirmed by Cowork's own sub-agent prompt: *"Each command starts in `<vmCwd>`; anything written outside
+`<vmCwd>/mnt/` (including `/tmp`) stays in that environment and never reaches the user or your file
+tools."* Bash also **resets its cwd between every call** (*"no cwd/env carryover"*), so a relative path
+from a script always resolves against the session root and cannot be `cd`-ed away from.
+
+Three consequences — the first for anyone reading a green run, the other two for anyone writing a skill
+or an assertion against these tools:
+
+1. **A relative bash write lands in the right place but PERSISTS, where production discards it.**
+   Production throws away anything outside `mnt/`; the harness bind-mounts the whole session dir, so the
+   same write survives into the run dir. Measured 2026-08-27: `printf > rel.txt` from a shell tool landed
+   at `/sessions/<id>/rel.txt` on `container` and **persisted** as `session/rel.txt`.
+
+   **Scope, so this is not over-read:** `file_exists`, `user_visible_artifact` and
+   `computer_links_resolve` are all bounded by `workRoot` (`…/session/mnt`) and **cannot** reach such a
+   file. The exposure is `semantic_matches` and `no_lost_write_back`, which grade the *authored* set. That
+   set still contains the file — capturing it is correct, since the run did write it — but every entry
+   from the scratchpad walk is labelled `— SCRATCH, NOT delivered to the user` in the judged document,
+   with a note saying such files are evidence of what the run DID and not that anything was delivered.
+   That label is what keeps a rubric like "the report was written" from grading TRUE on a file the user
+   would never receive.
+
+   **What is still divergent:** production would have discarded the file entirely, so a skill whose
+   bundled scripts take relative output paths still gets further here than it would there. The location
+   half is now faithful on both tiers; the survival half is not, and removing it would mean unpicking a
+   bind-mount every tier's artifact capture, `--resume` and the microvm snapshot depend on.
+2. **`Write`'s tool result echoes the RAW path it was given — it never absolutizes.** Structural, read
+   from the agent binary. A bare `Write foo.md` comes back as `foo.md`, not
+   `/sessions/<id>/mnt/outputs/foo.md`. Nothing in the harness parses a path out of a `Write` result
+   today, and this note exists so nothing starts: an assertion or doc that reads an absolute path out of
+   one is reading something production does not emit. Cowork's own chat-surface prompt asserts the
+   opposite ("Write's result shows the file's full path"), so the product's documentation of its own tool
+   is wrong here — do not take it as a spec.
+3. **The literal prefix `outputs/` DOUBLES on the desktop-local lane** (`outputs/x` → `outputs/outputs/x`,
+   invisible), and **`<folder>/x` builds a same-named decoy inside `outputs`** rather than reaching the
+   connected folder — silently, with a success result. No relative path from the file tools reaches a
+   connected folder. See [scenario.md](./scenario.md), "Where a relative path actually lands".
+
+The **cloud** lane shares none of this: cwd is `/home/claude`, there is no `mnt/` tree, and the shell and
+file tools share one root.
+
 ### Remote device bridge — `internal__remote-devices__*`, deliberately unmodeled
 
 The remote lane also has an internal MCP server the harness does not model at all, wire-named