cowork-harness 3.2.1 → 3.4.0

package/.claude/skills/cowork-harness/SKILL.md

@@ -3,8 +3,8 @@ name: cowork-harness
 description: Test or debug a Claude Code skill/plugin under Claude Cowork's runtime — sandboxed agent, default-deny egress, the can_use_tool permission/question protocol — using the cowork-harness CLI. Use when validating or regression-testing a skill, authoring or debugging a scenario YAML (prompt + scripted answers + assert:), choosing a fidelity tier, scripting AskUserQuestion / tool-permission answers, or asserting artifacts, egress, or sub-agent dispatch. Especially when a harness run no-ops an assertion, fails on an unanswered gate, false-greens, a steered answer never reaches the model, or a web_fetch is unexpectedly denied or gated. Also when iterating or hardening a skill across fixes, or grounding a skill's self-critique against its own run evidence — including a document-analysis skill (cap table, deck, financial model, transcript) that needs an uploaded file attached to be critiqued at all. NOT for generic unit testing (pytest/vitest of your own scripts) or non-Cowork CI. Covers the skill / run / chat / record / replay / trace / decide / assertions / scaffold commands and the session-vs-scenario split.
 metadata:
   author: cowork-harness
-  version: 3.2.1
-  tracks-harness: cowork-harness 3.2.1 (baseline desktop-1.40609.1)
+  version: 3.4.0
+  tracks-harness: cowork-harness 3.4.0 (baseline desktop-1.46388.3)
 ---
 
 # cowork-harness
@@ -25,8 +25,8 @@ flagged with a loud `::warning::`, not silent — auto-answer a gate, observe an
 allowlist). This skill exists mostly to keep you out of those traps — the Gotchas section below is
 the highest-value part. Read it.
 
-> **Version note:** the facts and `file:line` pointers here track `cowork-harness 3.2.1` (baseline
-> `desktop-1.40609.1`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
+> **Version note:** the facts and `file:line` pointers here track `cowork-harness 3.4.0` (baseline
+> `desktop-1.46388.3`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
 > `SPEC.md` / `docs/*.md` over this snapshot, and re-run the bundled linter.
 
 ## Preflight — make sure the harness can actually run
@@ -42,7 +42,7 @@ Before the first command, confirm the CLI is reachable and **fail loud** (never
 
 - **One-shot check.** Run `cowork-harness doctor [--tier <tier>]` first — a read-only prerequisite check that inspects Docker, the staged agent, the token, and the baseline in one pass. The bullets below explain each thing it checks (and how to fix it).
 - **Replay-only? Skip `doctor`.** Replaying committed cassettes needs no Docker, no staged agent, and no token — and every tier's `doctor` validates the auth token (the live tiers also Docker + the staged agent), so a ✗ there is expected, not a blocker. Go straight to `cowork-harness replay <cassette>`.
-- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 3.2.1**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@^3.2.1" <cmd>` (Node ≥ 22), or install once with `npm i -g "cowork-harness@^3.2.1"`. **Pin `@^3.2.1`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
+- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 3.4.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@^3.4.0" <cmd>` (Node ≥ 22), or install once with `npm i -g "cowork-harness@^3.4.0"`. **Pin `@^3.4.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
 
   This skill documents the CURRENT surface, not release history. If `cowork-harness --version` is
   OLDER than the floor, the per-release record of what you are missing is [CHANGELOG.md](https://github.com/yaniv-golan/cowork-harness/blob/main/CHANGELOG.md)

package/.claude/skills/cowork-harness/references/ci-recipe.md

@@ -1,6 +1,6 @@
 # CI recipe — replay vs live lanes
 
-Self-contained reference. Tracks `cowork-harness 3.2.1` (baseline `desktop-1.40609.1`).
+Self-contained reference. Tracks `cowork-harness 3.4.0` (baseline `desktop-1.46388.3`).
 
 **Fastest path: the packaged Action.** One step gets you `replay`/`lint`/`verify-cassettes` plus a PR
 job-summary reporter (verdict table, staleness findings, cost/turns when available):
@@ -17,7 +17,7 @@ job-summary reporter (verdict table, staleness findings, cost/turns when availab
 CLI major reaches your workflow the moment it is promoted even though your `uses:` ref never changed — so a
 copy-pasted recipe that omits the input takes a major bump with no say in it. `^2` holds the major, needs no
 patch number to remember, and only wants a human decision at the next major. Pin an exact version
-(e.g. `version: "3.2.1"`) instead when you want byte-reproducible CI.
+(e.g. `version: "3.4.0"`) instead when you want byte-reproducible CI.
 
 Reach for the manual multi-step form below only when you need per-step control the Action's inputs don't
 cover (a custom flag combination, a different runner matrix per step, or `lint`/`verify-cassettes` gated
@@ -36,12 +36,18 @@ jobs:
       - uses: actions/checkout@v4
       - name: Stage the agent binary (official channel, sha256-verified against the pinned baseline)
         run: |
-          V=2.1.255   # match your scenario's pinned baseline's agentVersion
+          V=2.1.260   # match your scenario's pinned baseline's agentVersion
+          # The release channel is NOT always the stable one. Desktop also stages release CANDIDATES,
+          # served only from .../claude-code-releases/rc/<commit>/ — the stable path 404s for those, and
+          # 2.1.255 is one. Take B from your pinned baseline's agentBinary.releaseBaseUrl; baselines
+          # written before that field existed were stable-staged, so their base is the plain
+          # https://downloads.claude.ai/claude-code-releases.
+          B=https://downloads.claude.ai/claude-code-releases
           # The expected digest is baselines/desktop-<ver>.json -> agentBinary.sha256. Paste it here, or
           # read it with jq if you vendor the baseline. An unverified download is an unverified agent:
           # this step FAILS rather than staging one, which is the whole point of naming it "verified".
           EXPECTED=<paste agentBinary.sha256 for $V>
-          curl -fSL "https://downloads.claude.ai/claude-code-releases/$V/linux-arm64/claude" -o "$RUNNER_TEMP/claude-$V"
+          curl -fSL "$B/$V/linux-arm64/claude" -o "$RUNNER_TEMP/claude-$V"
           echo "$EXPECTED  $RUNNER_TEMP/claude-$V" | sha256sum -c -
           chmod +x "$RUNNER_TEMP/claude-$V"
           echo "COWORK_AGENT_BINARY=$RUNNER_TEMP/claude-$V" >> "$GITHUB_ENV"
@@ -67,7 +73,7 @@ sha256-*checked* but not hard-blocking on mismatch — it's advisory for an inte
 GitHub-hosted runners, no token/Docker/agent:
 
 ```yaml
-- run: npm i -g "cowork-harness@^3.2.1"
+- run: npm i -g "cowork-harness@^3.4.0"
 - run: cowork-harness lint scenarios/*.yaml --strict --min-severity WARN
                                                     # no silent false-greens. WITHOUT --strict this
                                                     # step cannot fail on a WARN-class rule (e.g.
@@ -344,7 +350,7 @@ jobs:
         with: { node-version: '24' }
       - uses: actions/setup-python@v5
         with: { python-version: '3.x' }                                       # python3 only — PyYAML is bundled with the linter
-      - run: npm i -g "cowork-harness@^3.2.1"
+      - run: npm i -g "cowork-harness@^3.4.0"
       - run: cowork-harness lint scenarios/*.yaml                              # no-silent-false-green (needs python3; PyYAML bundled)
       - run: cowork-harness verify-cassettes cassettes/ --output-format json   # privacy + staleness gate
       - run: cowork-harness replay cassettes/ --output-format json             # token-free content/structure
@@ -373,7 +379,7 @@ jobs:
             echo "live=true" >> "$GITHUB_OUTPUT"
           fi
       - if: steps.guard.outputs.live == 'true'
-        run: npm i -g "cowork-harness@^3.2.1"
+        run: npm i -g "cowork-harness@^3.4.0"
       - if: steps.guard.outputs.live == 'true'
         run: cowork-harness run scenarios/ --output-format json
         env:

package/.claude/skills/cowork-harness/references/critique.md

@@ -1,6 +1,6 @@
 # Critique — the facts a plugin install can't otherwise reach
 
-Tracks `cowork-harness 3.2.1` (baseline `desktop-1.40609.1`). This is **not** a trim of the full
+Tracks `cowork-harness 3.4.0` (baseline `desktop-1.46388.3`). This is **not** a trim of the full
 [`docs/critique.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/critique.md) (repo-only —
 flags, cost, reproduction discipline, known limitations all live there). This file covers exactly what a
 plugin install cannot otherwise discover: the run-dir artifact a harvester actually reads, the report's

package/.claude/skills/cowork-harness/references/fidelity-and-answers.md

@@ -1,6 +1,6 @@
 # Fidelity tiers & answer paths
 
-Self-contained reference. Tracks `cowork-harness 3.2.1` (baseline `desktop-1.40609.1`).
+Self-contained reference. Tracks `cowork-harness 3.4.0` (baseline `desktop-1.46388.3`).
 
 ## Fidelity tiers (`fidelity:` in the scenario)
 

package/.claude/skills/cowork-harness/references/scenario-schema.md

@@ -1,7 +1,7 @@
 # Scenario & session schema, assertion catalog, web_fetch, authoring gotchas
 
-Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 3.2.1`
-(baseline `desktop-1.40609.1`). If your checkout is newer, prefer the live [`docs/scenario.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/scenario.md),
+Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 3.4.0`
+(baseline `desktop-1.46388.3`). If your checkout is newer, prefer the live [`docs/scenario.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/scenario.md),
 [`docs/session.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/session.md), and `SPEC.md`.
 
 **Minimal scenario** — `prompt` is the only required field:
@@ -384,7 +384,7 @@ same set live from the schema.
 | `egress_allowed: <host>` | the host was allowed through |
 | `no_mcp_error: true` | no MCP round-trip failed (`RunResult.mcpErrors` is empty — no unhandled server, no handler throw) — live-only: MCP round-trips are harness-computed, not in the SDK stdout stream, so evidence-unavailable on replay (never a vacuous pass). **Only `true` is valid** |
 | `max_peak_rss_bytes: <N>` | peak sampled RSS of the agent sandbox ≤ N bytes (`RunResult.resources.peakRssBytes`) — live-only: replay never spawns a sandbox to sample, so evidence-unavailable on replay/protocol (never a vacuous pass); also evidence-unavailable when sampling captured no RSS value |
-| `semantic_matches: {rubric: [...], min_pass?, judge_model?, include_subagent_text?}` | a pinned LLM judge grades each fixed `rubric` claim against the run's answer — the **union of the agent's final result text (`RunResult.finalMessage`), the transcript, and the final on-disk content of any files the agent authored during the run** — so a claim about content the skill led the agent to *write to a file* grades as reliably as one about inlined prose. **"The transcript" is narrower than it reads: top-level `assistant_text` ONLY.** It excludes every `tool_use`/`tool_result` and **all sub-agent-originated text** (including fork-scoped `Skill`/`Agent(fork)` dispatches — the harness attributes their *tool* calls to the main agent, but not their text). ⚠️ **Consequence: a rubric claim about whether a tool was called can NEVER grade true** — the evidence is not in the judged document. Such a claim looks reasonable and silently caps your pass rate; assert tool use with `tool_called` / `present_files_called` / `subagent_dispatched` / `hook_blocked` instead. Sub-agent text is captured in `RunResult.subagents[].reasoning` and reaches the judge only via opt-in `include_subagent_text: true` (`kind:"text"` turns only — sub-agent *thinking* arrives empty with `redacted:true`, so it would pad the document with blanks) (authored-file evidence is captured on every live sandbox tier including **microvm** — its session tree is snapshotted from the VM into the run dir). When the authored-file evidence backing the judged document is **incomplete** — a file dropped at the capture-size cap, unreadable at read-back, or (on `--resume`) the scratchpad walk skipped — the assert fails evidence-unavailable rather than trusting a judge grade over a partial document; this is separate from the malformed-grade `judgeInvalid` path below. The assert passes iff ≥ `min_pass` claims pass (default: all — avoid for a gating scenario). Results align by claim index and are recorded per-claim in `RunResult.assertions[].semanticClaims` (`[{index, claim, pass}]`, so a consumer can diff the per-claim profile across runs); a rep whose grade can't be parsed (after one retry) is marked `RunResult.assertions[].judgeInvalid` and **never silently dropped** — it is excluded from the pass denominator, and the guard against a misleading score from that exclusion is the gate's minimum-valid-rep floor (`MIN_VALID` ≥ 4) plus this visibility, not a claim that denominator-shrinking inflation is impossible. Within a rep, a grade that's still unparseable after the retry **fails that assert outright** (evidence-unavailable, not a vacuous pass) — a persistently-flaky judge reds the run rather than silently passing. `judge_model` pins the grader (default when neither it nor `COWORK_HARNESS_JUDGE_MODEL` is set: `claude-opus-4-8`; a dated id keeps a before/after comparison reproducible). Live-only: the judge is a live model call, so evidence-unavailable / skipped-loud on replay (never a vacuous pass) |
+| `semantic_matches: {rubric: [...], min_pass?, judge_model?, include_subagent_text?, evidence_files?}` | a pinned LLM judge grades each fixed `rubric` claim against the run's answer — the **union of the agent's final result text (`RunResult.finalMessage`), the transcript, and the final on-disk content of any files the agent authored during the run** — so a claim about content the skill led the agent to *write to a file* grades as reliably as one about inlined prose. **"The transcript" is narrower than it reads: top-level `assistant_text` ONLY.** It excludes every `tool_use`/`tool_result` and **all sub-agent-originated text** (including fork-scoped `Skill`/`Agent(fork)` dispatches — the harness attributes their *tool* calls to the main agent, but not their text). ⚠️ **Consequence: a rubric claim about whether a tool was called can NEVER grade true** — the evidence is not in the judged document. Such a claim looks reasonable and silently caps your pass rate; assert tool use with `tool_called` / `present_files_called` / `subagent_dispatched` / `hook_blocked` instead. Sub-agent text is captured in `RunResult.subagents[].reasoning` and reaches the judge only via opt-in `include_subagent_text: true` (`kind:"text"` turns only — sub-agent *thinking* arrives empty with `redacted:true`, so it would pad the document with blanks) (authored-file evidence is captured on every live sandbox tier including **microvm** — its session tree is snapshotted from the VM into the run dir). When the authored-file evidence backing the judged document is **incomplete** — a file dropped at the capture-size cap, unreadable at read-back, or (on `--resume`) the scratchpad walk skipped — the assert fails evidence-unavailable rather than trusting a judge grade over a partial document; this is separate from the malformed-grade `judgeInvalid` path below. The assert passes iff ≥ `min_pass` claims pass (default: all — avoid for a gating scenario). Results align by claim index and are recorded per-claim in `RunResult.assertions[].semanticClaims` (`[{index, claim, pass}]`, so a consumer can diff the per-claim profile across runs); a rep whose grade can't be parsed (after one retry) is marked `RunResult.assertions[].judgeInvalid` and **never silently dropped** — it is excluded from the pass denominator, and the guard against a misleading score from that exclusion is the gate's minimum-valid-rep floor (`MIN_VALID` ≥ 4) plus this visibility, not a claim that denominator-shrinking inflation is impossible. Within a rep, a grade that's still unparseable after the retry **fails that assert outright** (evidence-unavailable, not a vacuous pass) — a persistently-flaky judge reds the run rather than silently passing. `judge_model` pins the grader (default when neither it nor `COWORK_HARNESS_JUDGE_MODEL` is set: `claude-opus-4-8`; a dated id keeps a before/after comparison reproducible). Live-only: the judge is a live model call, so evidence-unavailable / skipped-loud on replay (never a vacuous pass) **`evidence_files: [globs]` scopes which authored files are graded** — reach for it the moment a run authors more than a couple of files. The capture budget (64 KiB total by default) is spent prefix-major then alphabetically, so a pipeline that stages intermediates (`outputs/_work/*.json`) exhausts it before reaching its own deliverable and the verdict is refused evidence-unavailable over files no rubric mentions. Scoping also makes the capture spend the budget on the named files FIRST and exempts them from the per-file cap. Paths are `<root>/<rel>` (`outputs/report.md`, never a bare `report.md`; session-root writes are `scratchpad/<rel>`); globs are `*`/`?`/`**`, not regex. A glob matching nothing FAILS and the message lists every authored path — read it rather than guessing. Still too big? Raise `$COWORK_HARNESS_AUTHORED_TOTAL_BYTES`. The typed reason is on `RunResult.assertions[].semanticEvidence` — check `.reason` instead of parsing the message |
 | `artifact_json: {artifact, path, …}` | assert a JSON artifact's contents — `equals`/`gt`/`in`/`exists`/`absent`/`is_null` over a dotted `path` (`in` = membership in a list, for a stochastic/LLM value; `absent` ≠ `is_null`; an unresolved intermediate fails loud) |
 | `computer_links_resolve: true` | every `computer://` link in the model-visible transcript resolves to an artifact that exists in the run's collected outputs/mounts — a dangling link fails, naming which target was checked (a live host path, the collected work tree, or the replay manifest). **Requires ≥1 link** (zero links fails — use `computer_links_resolve_if_present` for the presence-free variant). **Only `true` is valid** (`false` is rejected by the schema) **Sees top-level `assistant_text` only — it excludes every `tool_use`/`tool_result`**, so a `computer://` link that appeared only inside a tool call or its result is invisible to it. |
 | `computer_links_resolve_if_present: true` | like `computer_links_resolve` but passes vacuously when the transcript has zero `computer://` links — the presence-free variant. **Only `true` is valid** **Sees top-level `assistant_text` only — it excludes every `tool_use`/`tool_result`**, so a `computer://` link that appeared only inside a tool call or its result is invisible to it. |

package/.claude/skills/cowork-harness/references/task-recipes.md

@@ -2,7 +2,7 @@
 
 Each recipe composes facts that live scattered across SKILL.md and the other references into one
 decision path. Every one answers a question a real fleet owner had to work out the hard way.
-Tracks `cowork-harness 3.2.1` (baseline `desktop-1.40609.1`), same as SKILL.md's front-matter. Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
+Tracks `cowork-harness 3.4.0` (baseline `desktop-1.46388.3`), same as SKILL.md's front-matter. Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
 Recipe 3's `init-redact` shipped in 0.24.0 and are part of the current feature set — no version gate
 needed if your CLI meets SKILL.md's version floor.
 
@@ -169,6 +169,10 @@ degrade the advice. It is real work to calibrate; these steps are the traps that
    rate. Assert tool use with the structural keys instead (`tool_called`, `present_files_called`,
    `subagent_dispatched`, `hook_blocked`), and reserve `semantic_matches` for what the agent *said* or
    *wrote*. For a fan-out skill whose real work happens in sub-agents, add `include_subagent_text: true`.
+   If the run authors more than a couple of files, add `evidence_files: ["outputs/report.md"]` naming the
+   deliverable — otherwise the 64 KiB capture budget is spent alphabetically and an unrelated intermediate
+   dropped at the cap refuses the whole verdict. Paths are `<root>/<rel>`; a glob that matches nothing
+   fails and prints the paths the run actually authored.
 
 2. **Write DISCRIMINATING claims, and verify each against ground truth — not memory.** A claim that
    contradicts how the tool actually behaves can *never* pass (the correct skill will contradict it), and

package/CHANGELOG.md

@@ -6,6 +6,343 @@ All notable changes to this project are documented here. The format is based on
 
 ## [Unreleased]
 
+## [3.4.0] — 2026-09-05
+
+### Upgrade notes
+
+- **`promptAssetsHash` now also covers prompt text the harness GENERATES**, not only the committed
+  prompt-asset files — specifically the host-loop sub-agent folder manifest and the trailing skills
+  sentence added in this release. If you hold a cassette recorded with 3.3.0 against a baseline whose
+  `appVersion` still matches your live one, it will report `prompt-assets` staleness; re-record it. A
+  cassette on an older baseline already reports `baseline` staleness and is unaffected by this change.
+- **A host-loop sub-agent is now told which folders exist and how to address them.** If you assert on a
+  sub-agent's prose, note it now has per-session path information it did not have before.
+- **Sub-agent prompt assets are no longer the whole append.** If you maintain your own baseline,
+  `spawn.subagentAppendHostLoop` now points at the overridable SECTION only; the manifest and trailing
+  sentence are generated. Do not restore them into the asset — they would render twice.
+
+### Verification
+
+Verified **locally**, against the Desktop install this baseline was synced from — Desktop `1.46388.3`,
+agent `2.1.260`, macOS arm64, agent image `cowork-agent-base:2` — on 2026-09-05:
+
+| suite | result |
+|---|---|
+| `boundary-check` | **6/6** (host-fs-sealed, direct-egress-denied, allowlist-enforced, allowlist-permits, loopback-not-proxied, hostloop-bash-egress) |
+| `npm run test:live` | 4 files, **19 passed, 0 skipped** |
+| `run examples/scenarios/` | **7/7 success**, 39 assertions, 0 failed |
+| e2e self-tests | **8/8 success** — askuserquestion, multiselect, multiselect-deciderdir, l1-container, l1-egress, present-files, semantic-evidence-files, canary-hostloop |
+
+Tiers exercised: **`protocol`, `container`, `hostloop`**. **`microvm` was NOT exercised** (it needs a
+real VM; CI excludes it for the same reason), so `smoke-l2-microvm` did not run.
+
+`subagent-manifest-probe` is new here and is the first live coverage the sub-agent append has ever
+had. It proves the composed append is *actionable* — the sub-agent shelled against
+`/sessions/<id>/mnt/<name>/`, summed the same ledger through its file tools to the same total, and a
+bare relative write landed at the host cwd — not that the paraphrase matches Desktop's wording, which
+is what the `manifest`/`suffix` fingerprint axes are for.
+
+### Parity — Desktop 1.46388.3 (agent 2.1.260)
+
+New baseline `desktop-1.46388.3`. `sync` refused with 7 unknown deltas; all are classified and it now
+runs clean.
+
+#### Fixed — the sub-agent append sentinel could not see part of the append
+
+Desktop 1.46388.3 restructured the per-session sub-agent append into three parts: the overridable
+`## Cowork environment` section, a host-loop-only folder manifest, and one trailing sentence appended to
+**both** branches. The sentinel fingerprinted only the two ternary branch texts, so the trailing sentence
+changed the rendered append on both branches while the VM fingerprint did not move — and the pointer
+coupling guard only demands a repoint on an axis whose fingerprint moved. A counterfactual confirms it:
+Desktop 1.44121.1 with only that sentence added raises **no flags and syncs green**.
+
+Two fingerprint axes now cover the composed parts (`manifest`, `suffix`). Both become mandatory once
+either is recorded, and only the newest entry is compared, so entries predating the restructure are not
+retro-failed.
+
+Related, and separately load-bearing: the host-loop branch extractor was selecting the **wrong template**.
+It anchored on a phrase that left the branch at this release and survives in unrelated prose in the same
+module, so the drift it reported named text that is not the branch. It is now anchored on the ternary's
+structure rather than on wording. The module selector keyed on the same dead phrase and was one chunk
+move away from dropping the entire branch sentinel behind a single generic flag.
+
+#### Added — the host-loop folder manifest is modeled
+
+A host-loop sub-agent is now told the same thing production tells it: which folders exist on the user's
+computer, each with its host path and its shell path, or a different sentence when there is nothing to
+list. It is generated from the run's real mounts rather than read from a static asset — the same reason
+the main-loop shell section became a generator at Desktop 1.14271.0 — and it uses **canonical** folder
+paths, matching what production renders. Folders dropped by `COWORK_HARNESS_SOFT_MISSING=1` are listed as
+unreachable rather than silently disappearing, which is production's behaviour for a folder that fails to
+mount.
+
+The text this generator produces is mixed into `promptAssetsHash`, so editing it stales recorded cassettes
+exactly as editing a committed prompt asset does.
+
+#### Added — `CLAUDE_CODE_QUESTION_EXTENDED`
+
+A new gate-conditional key in the Cowork spawn window, pinned along with its gate. The gate reads
+served-and-off today, so the key stays out of `spawn.env` and an upstream flip will surface as a diff. It
+drives an AskUserQuestion behaviour the harness models, and Desktop and the agent shipped it in the same
+release.
+
+#### Cassettes
+
+`example-pdf-skill` was **re-recorded** at `container`: it embeds the VM sub-agent append in its
+recorded frames, and that text changed, so re-stamping would have left a committed fixture
+contradicting what the harness now sends. Tool calls moved 5 → 4 against the cassette it replaced.
+
+`example-multiselect-gate` (protocol) and `hostloop-computer-links` (hostloop) were **re-stamped**
+rather than re-recorded. No sub-agent was dispatched in either recording, protocol receives no
+sub-agent append at all by design, and neither cassette embeds the changed text — so the prompt change
+provably never entered either recording, while re-recording at those tiers would bake the recording
+machine's own MCP servers and skills into a public fixture.
+
+#### Fixed — a mutation test made ambiguous by the new build
+
+A second `=31999` literal appeared in an unrelated chunk, and the two were in different chunks at
+1.44121.1, so no chunk marker separates them durably. The S4 mutation now changes every occurrence and
+asserts the guard's **resolved value** rather than merely that it flagged, so a mutation that never
+reached the guarded site cannot read as a pass.
+
+## [3.3.0] — 2026-09-02
+
+### Verification
+
+Verified **locally**, against the Desktop install this baseline was synced from — Desktop `1.44121.1`,
+agent `2.1.258`, macOS arm64, agent image `cowork-agent-base:2` — on 2026-09-02:
+
+| suite | result |
+|---|---|
+| `boundary-check` | pass (3/3: allowlist-permits, loopback-not-proxied, hostloop-bash-egress) |
+| `npm run test:live` | 4 files, **19 passed, 0 skipped** |
+| `run examples/scenarios/` | **6/6 success** |
+| 8 of 9 e2e scenarios | **8/8 success** — askuserquestion, multiselect, multiselect-deciderdir, l1-container, l1-egress, present-files, **semantic-evidence-files**, canary-hostloop. `smoke-l2-microvm` is the ninth and was not run. |
+
+Tiers exercised: **`protocol`, `container`, `hostloop`**. **`microvm` was NOT exercised.**
+
+**The `evidence_files` scoped path was exercised live**, by `smoke-semantic-evidence-files` at container
+tier, which is new in this release and exists because the feature had no live or e2e coverage at all: it
+passes scoped (`semanticEvidence.reason "graded"`, `paths ["outputs/report.md"]`) and refuses with the
+`evidence_files` line removed (`reason "evidence_incomplete"`, naming all seven authored files), so the
+scenario is falsifiable rather than decorative. Both readings are quoted in the scenario's own header
+with their run ids. The **truncation refusal**, the **unscoped-starvation** case and the
+**`no_pre_run_manifest` refusal** remain covered by unit tests only — the last of those because arming the
+manifest for `semantic_matches` is precisely what stops a scenario reaching it; its live trigger is a
+`--resume` turn.
+
+Nothing was skipped and nothing was gated out. An earlier pass of this same suite reported 18 passed and
+1 skipped — `live-outputs-delete`'s "touches outputs without deleting" case, whose agent issued no Bash
+call, so its guard observed nothing. That case ran and passed here. It is model variance in the fixture,
+and it is recorded because the suite reports such a case as a SKIP rather than a pass, by design.
+
+**CI does not run any of this.** There is no `ANTHROPIC_API_KEY` repository secret, so `ci.yml`'s live
+scenario stage soft-skips in seconds on both the pull request and the merge commit. A green CI run for
+this release therefore covers build, unit tests, the agent-image recipe and the boundary check — **not
+live inference**. The evidence above is one machine and one account, which is not the same guarantee.
+
+### Fixed
+
+- **A `semantic_matches` assert could grade a document containing NO authored files and report it as
+  complete.** The authored set is derived by diffing the work tree against a pre-run manifest, and the
+  manifest is only captured when a scenario asserts one of `no_unexpected_files`, `input_unmodified`,
+  `no_delete_in_outputs`, `no_delete_in_mounts` or `no_lost_write_back` — or the run is a `record`.
+  `semantic_matches` was not on that list. A scenario whose asserts include `semantic_matches` but none of
+  those five, and which is not a recording, therefore never armed the baseline: the capture returned zero
+  files, and the judge was handed the final message and transcript alone — with the result stamped as
+  complete authored evidence. Found on a live run that authored 7 files under `outputs/` and whose assert
+  reported none.
+
+  **This is a FALSE GREEN, not a new regression, and it is not new in 3.3.0.** The arming predicate has
+  carried the same five keys since authored-file evidence first reached the judge in `0.29.0`, so every
+  release from `0.29.0` through `3.2.1` graded that shape against no authored evidence at all. It failed
+  silently, which is why it outlived a 404ing recipe that failed loudly.
+
+  **Re-run your affected scenarios.** If a scenario asserts `semantic_matches` without any of the five keys
+  above, a previous green graded no authored files — whatever it was measuring, it was not the run's
+  output. Re-running is the only way to learn what the verdict should have been.
+
+  Both halves are fixed: `semantic_matches` now arms the manifest, and an absent manifest is recorded in the
+  capture's health so the assert fails `evidence unavailable` with
+  `semanticEvidence.reason: "no_pre_run_manifest"` instead of grading an empty set. The distinction matters
+  — every other reason describes evidence that exists and could not be fully shown; this one describes
+  evidence that was never derivable.
+
+  **This changes the verdict of existing scenarios**, in the same way as the truncation fix above: a
+  `semantic_matches` that was passing on final-message-and-transcript evidence alone will now either grade
+  against the authored files it should always have seen, or refuse if no baseline can be captured (a
+  `--resume` turn, where the baseline belongs to the first turn — re-run live without `--resume`). A rubric
+  written against the weaker document may need revisiting, and that is the point: it was never being graded
+  against what the skill produced.
+
+- **A deliverable larger than the 16 KiB per-file capture cap was graded as a PREFIX, and could return a
+  pass on a claim its tail disproved.** With one 87 KB `outputs/report.md` at stock settings the capture
+  keeps the first 16 KiB and flags it `truncated` — but nothing was omitted, nothing was unreadable, and the
+  composed document sits far under the aggregate cap, so the assert graded it and stamped `graded`. A
+  negative rubric ("the report contains no unmitigated risk line") passed over a prefix that never included
+  the line. The only signal was a ` (truncated)` suffix on the file's heading; the evidence-health note,
+  which tells the judge not to read an absence as a negative, never mentioned truncation at all.
+
+  Truncation is now treated exactly like omission: any file the judge would grade that was kept only as a
+  prefix fails `evidence unavailable`, and the health note lists truncated paths in the same "do not infer
+  absence from the cut" register as dropped ones. **This changes the verdict of existing scenarios** — a run
+  whose deliverable exceeded 16 KiB was previously graded on its first 16 KiB and now refuses. The fix is to
+  scope the assert (`semantic_matches.evidence_files: ["outputs/report.md"]`), which exempts the file from
+  the per-file cap; raising `COWORK_HARNESS_AUTHORED_TOTAL_BYTES` alone does **not** lift that cap, and the
+  failure message says so rather than sending you to the wrong knob.
+
+  The feature made this shape more reachable, which is why it is fixed here: a scope on one assert exempts
+  its file from the per-file cap and consumes the shared budget, so an unscoped sibling's per-file allowance
+  is `min(16 KiB, whatever is left)` and can fall to almost nothing. The multi-assert warning now says so.
+
+- **Raising the capture budget could have moved incompleteness from a loud refusal into a silent cut.**
+  Authored evidence sits near the tail of the judged document, so an overflow of the 262144-char aggregate
+  cap can eat it. Any `semantic_matches` — scoped or not — now refuses `authored_evidence_truncated` rather
+  than grading a document whose evidence was cut, and the message names the section that overflowed (a
+  document overflowing on `include_subagent_text` is not fixed by narrowing a file scope). The check
+  measures the offset at which the authored region ends, so a trim that reaches only the trailing
+  evidence-health note is an advisory warning, not a refusal.
+
+  **This changes the verdict of some existing scenarios, and you should expect it.** Affected: any live
+  `semantic_matches` whose composed judge document already exceeded 262144 chars far enough to cut into the
+  authored-file sections — in practice a run with a large deliverable, a long transcript, or
+  `include_subagent_text: true` with several substantial sub-agents. At stock settings a single large
+  deliverable does **not** reach the cap (32768 + 131072 + 65536 = 229376 chars with every section maxed),
+  so the two triggers that do not require raising the budget are **many** authored files — the per-file
+  `## Authored file: <path>` headings are counted, so several hundred small files overflow at the same total
+  — and `include_subagent_text: true`, whose per-dispatch 16 KiB is multiplied by an unbounded dispatch
+  count. Those runs were being graded against a document whose evidence had been silently truncated, and
+  could return a **pass** on a claim the judge never had the text to verify. They now fail `evidence unavailable` with
+  `semanticEvidence.reason: "authored_evidence_truncated"` and a message naming the section that overflowed.
+
+  This is a fix to a false PASS rather than a break in a covered surface — but it is **not** free: the check
+  is a property of the composed document, not of the rubric, and the harness cannot know which sections a
+  given rubric actually depended on. A rubric that was satisfiable from the agent's final message alone (the
+  first section, which is never cut) was being graded correctly and now turns red too. That is a deliberate
+  trade — a conservative refusal you can see and act on, over a silent grade you cannot — but if a newly-red
+  assert was genuinely answerable from the final message, this is why. What to do when you hit it, in order — (1) scope the judge with
+  `semantic_matches.evidence_files: ["outputs/<your deliverable>"]`, which shrinks the document to the files
+  the rubric is about and is the right answer in almost every case; (2) if the graded files themselves do not
+  fit, raise `COWORK_HARNESS_AUTHORED_TOTAL_BYTES` so the capture keeps them whole — but note the composed
+  document is still capped at 262144 chars, so past that point only scoping helps; (3) if the overflow is
+  sub-agent text, set `include_subagent_text: false`. The failure message names which of these applies.
+
+
+- **`agentBinary.manifestChecksumMatch` was cross-checking the wrong release channel, and had been for a
+  month.** `sync` hard-coded the *stable* versioned manifest path. Desktop also stages release
+  **candidates**, served only from `…/claude-code-releases/rc/<commit>/`, so for agent `2.1.255` the
+  stable path 404s — and because the helper swallows every fetch failure to stay offline-capable, the
+  baseline recorded `"unknown"` for a build whose published checksum matches the staged ELF exactly.
+  `sync` now reads the channel out of the asar's own SDK descriptor and queries that, so
+  `baselines/desktop-1.40609.1.json` records `manifestChecksumMatch: true`.
+
+  This was not new with `2.1.255`. Of the 25 Desktop builds on record **3 are RC-staged**, and the two
+  earlier ones (`1.24012.9`/`.11`, agent `2.1.219`) recorded `true` only because that version had *also*
+  been promoted to stable — the wrong-channel query happened to resolve. Nothing in the output
+  distinguished that lucky pass from a real one, which is the defect this closes.
+
+- **`sync` now says *why* a checksum cross-check did not run.** An HTTP status from the channel is a
+  `WARNING` (it does not serve this version's manifest); a transport failure is a `NOTE` (the rig has no
+  egress, which says nothing about the release). Previously both wrote `"unknown"` silently — and a
+  sandbox-blocked fetch was once mistaken for a finding about the release because of it. The recorded
+  field stays two-valued (`boolean | "unknown"`); the distinction is in the operator-facing output.
+
+- **The documented ELF-download recipes `curl`ed a URL that 404s.** `docs/ci.md`, the companion skill's
+  `references/ci-recipe.md` and `docs/maintenance.md`'s recovery runbook all assumed the stable path
+  while pinning `V=2.1.255`, which is RC-staged — so the copy-paste CI step failed. They now take the
+  base URL from the baseline. `scripts/check-versions.ts` pins it: the invariant that kept `V=` honest
+  had no idea the URL had stopped working, and it is what propagated the broken pin into all three.
+
+  **If you copied the recipe from `3.2.1` or earlier, re-copy it.** The `curl` now reads its host from a
+  new `B=` line alongside the existing `V=` pin, because the stable path is not always where Desktop
+  staged the agent from. An older copy has no `B=` line and hard-codes the stable URL, so it keeps
+  working only for as long as the agent you pin happens to be a stable-channel build.
+
+### Added
+
+- **`agentBinary.releaseBaseUrl` in the platform baseline** — the release channel Desktop staged the
+  agent from. It names the source `manifestChecksumMatch` agreed with (without it the boolean is an
+  unattributed claim), makes the ELF-recovery runbook work for an RC-staged version, and surfaces a
+  stable↔RC flip as a `sync --diff` line. Recomputed from the local asar every sync, so it needs no
+  network; absent on baselines written earlier, all of which were stable-staged or later promoted.
+
+- **`baselines/desktop-1.40609.1.json` re-synced** against the live Desktop 1.40609.1 install to pick up
+  the corrected row. (It is no longer the newest baseline — Desktop self-updated later in the same cycle and
+  `desktop-1.44121.1` ships alongside it; see **Parity** below. Both moved, which is why this release
+  touches two baseline files.) `provenance.fcache` moved with it — that payload is server-refreshed on Desktop's
+  own schedule and drifts between syncs; it is not a change this fix caused. `spawn`, `network`, all 28
+  gate rows and every fingerprint are unchanged.
+
+- **`semantic_matches.evidence_files` — scope which authored files the judge grades.** A run that authors
+  many files could not pass a `semantic_matches` assert at all: the authored-file capture spends a fixed
+  64 KiB budget prefix-major then alphabetically, so a pipeline staging intermediates under
+  `outputs/_work/` exhausted it before reaching its own deliverable, and any omission refused the verdict —
+  over files no rubric mentioned. Naming the deliverable now (a) sends only those files to the judge,
+  (b) spends the capture budget on them **first**, (c) exempts them from the per-file cap, and (d) narrows
+  the evidence-unavailable refusal to in-scope omissions. A scenario with no `evidence_files` anywhere keeps
+  its previous grading behaviour; note that scoping ONE assert changes the shared capture for its unscoped
+  siblings (they share a single authored-file capture, and a scope exempts its files from the per-file cap),
+  which now warns.
+
+  Guards that come with it, because scoping is a new way to manufacture a vacuous green: globs matching
+  **nothing** fail evidence-unavailable (and the message lists every path the run authored — paths are
+  `<root>/<rel>`, which nothing else in the CLI surfaces); an empty list is a load-time error; an in-scope
+  file that is *truncated* rather than dropped also refuses, since a partial deliverable grades as a partial
+  document; and a scoped **pass** records the files it graded in its `evidence`.
+
+  The judged document is memoized per assert, and its cache key now includes the scope — keying it on
+  `include_subagent_text` alone was sufficient before scopes existed and is not any more.
+
+- **`RunResult.assertions[].semanticEvidence`** — the typed reason a `semantic_matches` assert refused
+  (`scope_matched_nothing` | `in_scope_omitted` | `in_scope_truncated` | `evidence_incomplete` |
+  `authored_evidence_truncated`) or what it graded (`graded`, recorded on a substantive fail too — the bug
+  this guards against is a false ABSENCE, so a red is only actionable next to what the judge was shown),
+  with the paths. Five causes with five different fixes previously shared one prose message; a consumer had
+  to regex English to tell them apart.
+
+- **`COWORK_HARNESS_AUTHORED_TOTAL_BYTES`** — raise the total authored-file evidence budget (default
+  65536) when a deliverable legitimately exceeds it. A malformed value throws rather than silently
+  defaulting: a quietly-defaulted evidence budget resurfaces later as an unexplained refusal. Raising it
+  enlarges the document sent to an external judge, so cost, latency and disclosure scale with it.
+
+### Parity
+
+- **Baseline `desktop-1.44121.1` (agent `2.1.258`).** Desktop self-updated during this release cycle, so
+  3.3.0 carries the sync as well as the fix above. Measured unchanged against `desktop-1.40609.1`:
+  `spawn` and `network` **byte-identical**, all 28 recorded gate rows identical in value, `guest`,
+  `mountLayout` and `settings` identical. The three committed example cassettes are **re-stamped, not
+  re-recorded** — `promptAssetsHash` resolves to the same `491afe2862dc67ea` under both baselines.
+
+- **The gate-id set moved even though every pinned gate's value held, and one removal matters.**
+  `provenance.asarGateIds` goes **291 → 328 (+43, −6)**. Among the six ids Desktop dropped is
+  **`3246569822`, the `canSaveSkill` gate** — 3 occurrences in the 1.40609.1 asar, **0** in 1.44121.1. As
+  of Desktop 1.44121.1 the skill-saving capability is no longer gate-guarded for a standard session; it
+  rests on the `skillsEnabled` conjunct alone. The baseline still carries the `canSaveSkill:3246569822`
+  row — the server still serves the flag, and that row is fcache provenance, not an asar reading — but it
+  now carries a `note` recording that the id is absent from the asar, so it cannot be mistaken for
+  evidence that a gate still guards the feature. `provenance.spawnEnvSpreadCount` also moves 32 → 33, the
+  new nested conditional spread carrying the third-party key below.
+
+- **Agent `2.1.255` → `2.1.258`.** The agent's `CLAUDE_*` env-flag export table moves **588 → 590**
+  (+3, −1): `CLAUDE_CODE_ARTIFACT_MULTI_FILE`, `CLAUDE_CODE_ARTIFACT_TOOLSET` and
+  `CLAUDE_CODE_MODEL_CATALOG_URL` arrive, `CLAUDE_CODE_PRINT_ENGINE_LOOP` goes. **None is set by the
+  Cowork spawn**, and no flag the spawn does set changed from or to zero consumers, so no harness change
+  follows from the bump.
+
+- **This is the first sync to exercise `agentBinary.releaseBaseUrl`, and it moved in both directions
+  within a day.** `1.40609.1` staged a release candidate; `1.44121.1` is back on the stable channel, so
+  the recorded base flips from `…/claude-code-releases/rc/aa8f2d98…` to `…/claude-code-releases` and
+  `manifestChecksumMatch` reads `true` from the stable manifest. The guard added with the field caught a
+  real error while doing it: the documented `B=` pin still named the RC channel, which would have shipped
+  a `curl` that 404s for anyone on the new agent.
+
+- **A new third-party spawn key, `CLAUDE_STREAM_IDLE_TIMEOUT_MS`, is classified as out-of-scope for the
+  modeled session.** Desktop constructs it only inside the `accountType === "3p"` branch and only when a
+  gateway provider supplies a stream-idle timeout, so a first-party session never receives it and it is
+  absent from the baseline's `spawn.env` (still 24 keys). `sync` refused to write until it was
+  classified, which is the refusal working as intended.
+
+
 ## [3.2.1] — 2026-09-02
 
 ### Parity

package/DESIGN.md

@@ -47,7 +47,7 @@ in how a file reaches the user, which is what changes skill behaviour: see
 [docs/scenario.md](./docs/scenario.md)'s `lane:` key for holding a run to either contract. The local lane:
 
 - VM bundle: `~/Library/Application Support/Claude/vm_bundles/claudevm.bundle/` (`rootfs.img`, `sessiondata.img`, `efivars.fd`, `machineIdentifier`, `gvisorMacAddress`, `vmIP`); a warm pool at `vm_bundles/warm/<sha>/`.
-- In-VM agent: `~/Library/Application Support/Claude/claude-code-vm/<ver>/claude` (currently **2.1.255**, per `baselines/desktop-1.40609.1.json`, an **ELF aarch64** binary), spawned by the host **in cowork mode via the `CLAUDE_CODE_IS_COWORK=1` env var** — *not* a `--cowork` flag (that flag is plugin-scope and the staged agent rejects it; see the control-protocol note below). Each baseline records this ELF's `sha256` (`agentBinary.sha256`/`shaProvenance`), and the resolver integrity-checks the binary it's about to run against that hash by default (opt out `COWORK_HARNESS_VERIFY_AGENT_SHA=0`), so "the same pinned agent" is enforced, not just asserted. Old versions are re-downloadable + verifiable from the official release channel (see `docs/maintenance.md`).
+- In-VM agent: `~/Library/Application Support/Claude/claude-code-vm/<ver>/claude` (currently **2.1.260**, per `baselines/desktop-1.46388.3.json`, an **ELF aarch64** binary), spawned by the host **in cowork mode via the `CLAUDE_CODE_IS_COWORK=1` env var** — *not* a `--cowork` flag (that flag is plugin-scope and the staged agent rejects it; see the control-protocol note below). Each baseline records this ELF's `sha256` (`agentBinary.sha256`/`shaProvenance`), and the resolver integrity-checks the binary it's about to run against that hash by default (opt out `COWORK_HARNESS_VERIFY_AGENT_SHA=0`), so "the same pinned agent" is enforced, not just asserted. Old versions are re-downloadable + verifiable from the official release channel — from the channel that baseline's `agentBinary.releaseBaseUrl` names, which is **not always the stable path** (Desktop stages release candidates too); the exact command is in `docs/maintenance.md`.
 - Network: `vm_network_mode: "gvisor"`, egress through a userspace netstack with a **compiled domain allowlist**; off-list partners rejected (`partner rejected: entry not on compiled allowlist`).
 - Control plane: Electron renderer→main typed IPC on channels named `$eipc_message$_<per-build-UUID>_$_claude.web_$_<Class>_$_<method>`, every handler validating `event.senderFrame.url` against a trusted-origin allowlist. The session manager is `LocalAgentModeSessions` (80 methods: `start`, `sendMessage`, `setDraftSessionFolders`, `onToolPermissionRequest`, `respondToToolPermission`, `getTranscript`, `onEvent`, …), bridged to the renderer as `window.cowork`.
 
@@ -176,7 +176,7 @@ The policy that produces those `allow`/`deny` responses is the **Decider** seam
 
 ### Control protocol — VERIFIED end-to-end against the live host CLI (macOS. The staged in-VM agent that L1/L2 run is **2.1.246**, the native host app that `hostloop` runs is **2.1.246**, baseline **`desktop-1.37937.1`** — a fresh live end-to-end pass across the `protocol`, `container`, and `hostloop` tiers was run against this baseline on 2026-08-26, superseding the prior `1.32885.1` pin. Scope and caveats of that pass are in the note directly below; read it before citing this heading.) The subsequent `desktop-1.20186.1` baseline is a patch-only Desktop release (egress allowlist, spawn config, and the Cowork system-prompt fingerprint unchanged from 1.20186.0; the staged VM ELF re-synced 2.1.202 → 2.1.205) — the live pass is deliberately not restamped onto it.
 
-> **Scope of that claim, stated plainly.** `2026-08-26 / desktop-1.37937.1` is the baseline carrying the latest **full live end-to-end pass**, and it is no longer the newest committed baseline: **two** baselines have shipped since (`1.40609.0`, `1.40609.1`), **two** of which moved the agent ELF, most recently to **2.1.255** — so the newest baseline is **not** live-verified, and this paragraph describes the 1.37937.1 pass only. The pass ran on agent `2.1.246` (the staged VM ELF and the native `.app` were both at that version) and covered all three tiers: `protocol` (the matrix runner's own live e2e plus its unanswered-gate regression pin), `container` (the spawn contract against the staged binary, resume continuity across the container boundary, and the outputs-delete guard), and `hostloop` (the sub-agent relative-`Write` acceptance probe, resume continuity on the native binary, critique at the unpinned tier, uploads readability, sub-agent WebSearch capture, and the discovery-server declaration check). It was one invocation of `npm run test:live` — **4 suites, 19 assertions, 19 green / 0 skipped**. **Nothing was gated out**, which is the part worth stating: every `describe` in this lane is `skipIf`-gated on Docker, the staged-binary version and the token, so a gated case reports as SKIPPED rather than passing vacuously — vitest reported zero skips, and the 19 that ran are exactly the 19 the suite enumerates. **Scope-out, so this is not read as more than it is.** (a) The assertion population is 19 here against the 24 recorded for the 1.32885.1 pass; cases have been retired and consolidated since (the `live-outputs-delete` whole-line-`#`-comment case was retired in 1.25.0 after its pinned command stopped being executed by the model), so the two counts are not comparable and the drop is not coverage lost in this pass. (b) The `boundary-check` sandbox proof and the example-scenario suite were part of the 1.32885.1 stamp and were **NOT** run here — this paragraph claims `npm run test:live` only. (c) A live pass verifies observed behaviour, not the whole spawn contract by construction. **These suites are model-dependent, so a single red is evidence of model variance until a re-run says otherwise, not of a regression** — which is why the gated cases skip loudly rather than fail. Separately and not a live matter: the three committed example cassettes (`example-pdf-skill` at `container`, `example-multiselect-gate` at `protocol`, `hostloop-computer-links` at `hostloop`) were re-recorded against this baseline in the same change, so nothing in `examples/replays/` is stale against it. Re-stamp this paragraph, naming the baseline, whenever a live pass is actually re-run.
+> **Scope of that claim, stated plainly.** `2026-09-05 / desktop-1.46388.3` is the baseline carrying the latest **full live end-to-end pass**, and it is also the newest committed baseline — **no baselines have shipped since**, so nothing committed here is live-unverified for want of a newer run. The pass ran against agent **2.1.260** (the staged VM ELF and the native `.app` both at that version) on macOS arm64, agent image `cowork-agent-base:2`, and covered **four** suites: `boundary-check` **6/6** (host-fs-sealed, direct-egress-denied, allowlist-enforced, allowlist-permits, loopback-not-proxied, hostloop-bash-egress); `npm run test:live` **4 files, 19 passed, 0 skipped**; `run examples/scenarios/` **7/7 success, 39 assertions, 0 failed** (csv-fx-normalize, csv-metrics, example-pdf-skill, hostloop-computer-links, protocol-smoke, skill-loads, subagent-manifest-probe); and the e2e self-tests **8/8 success** (smoke-askuserquestion, smoke-multiselect, smoke-multiselect-deciderdir, smoke-l1-container, smoke-l1-egress, smoke-present-files, smoke-semantic-evidence-files, canary-hostloop). **Zero skips** in the live lane is the part worth stating: every `describe` there is `skipIf`-gated on Docker, the staged-binary version and the token, so a gated case reports as SKIPPED rather than passing vacuously — vitest reported none. Tiers exercised: **`protocol`, `container`, `hostloop`**. **`microvm` was NOT exercised** — it needs a real VM and CI excludes it for the same reason, so the ninth e2e scenario (`smoke-l2-microvm`) did not run. **Scope-out, so this is not read as more than it is.** (a) `subagent-manifest-probe` is new in this release and is the first live coverage the sub-agent append has ever had; it proves the composed append is ACTIONABLE — a sub-agent reaches the right files through both tool families, and a bare relative write lands at the host cwd — **not** that the harness's paraphrase matches Desktop's wording, which is the `manifest`/`suffix` fingerprint axes' job. (b) A live pass verifies observed behaviour, not the whole spawn contract by construction. (c) These suites are model-dependent, so a single red is evidence of model variance until a re-run says otherwise, not of a regression — which is why the gated cases skip loudly rather than fail. Separately and not a live matter: `example-pdf-skill` was re-recorded against this baseline and the other two committed cassettes were re-stamped (see the CHANGELOG for why each), so nothing in `examples/replays/` is stale against it. Re-stamp this paragraph, naming the baseline, whenever a live pass is actually re-run.
 
 > The staged agent ELF is unchanged (2.1.181) across the 1.14271.0→1.15200.0 asar bump, and 2.1.187 across the 1.15200.0→1.15962.0 bump. The live scenario suite (`protocol` + `container` tiers) was re-run against the 1.15200.0 baseline; the 1.15962.0 bump was verified via asar analysis (content byte-identical: host-loop generator, system prompt, identity string, gates, and egress domains all unchanged) plus a full local test suite pass. The 1.15962.1→1.17377.1 bump moved the staged agent to **2.1.197** and added `api.claude.ai` to the egress allowlist; re-verified via `sync` (no unknown deltas) plus a manual asar spot-check of the reconstructed prompt content (substantively unchanged — see the Parity entry in CHANGELOG.md) and a full live scenario-suite pass (`protocol` + `container` tiers).
 

package/README.md

@@ -36,7 +36,7 @@ npm ci && npm run build
 node dist/cli.js replay examples/replays/example-pdf-skill.cassette.json
 ```
 
-(Installing globally — `npm install -g "cowork-harness@^3.2.1"` — gives you the `cowork-harness` CLI for your own
+(Installing globally — `npm install -g "cowork-harness@^3.4.0"` — gives you the `cowork-harness` CLI for your own
 scenarios and cassettes; the bundled example above also replays from a global install — see the `$(npm root -g)` path below.)
 
 Full setup → [Quick start](./docs/cli.md#quick-start).
@@ -49,8 +49,8 @@ Three ways to use this project. Each row is the whole hook — follow the link f
 
 | I want to… | Start here | Needs |
 |---|---|---|
-| **Run scenarios myself** from a terminal | **[docs/cli.md](./docs/cli.md)**<br><br>`npm i -g "cowork-harness@^3.2.1"`<br>`cowork-harness replay examples/replays/example-pdf-skill.cassette.json` | Node ≥ 22. The replay demo above is token-free and needs nothing else; live tiers above `protocol` need Docker + a staged agent binary |
-| **Have Claude Code drive it** for me | **[docs/companion-skill.md](./docs/companion-skill.md)**<br><br>`/plugin marketplace add yaniv-golan/cowork-harness`<br>`/plugin install cowork-harness@cowork-harness` | Claude Code. The skill self-bootstraps the CLI via `npx "cowork-harness@^3.2.1"` |
+| **Run scenarios myself** from a terminal | **[docs/cli.md](./docs/cli.md)**<br><br>`npm i -g "cowork-harness@^3.4.0"`<br>`cowork-harness replay examples/replays/example-pdf-skill.cassette.json` | Node ≥ 22. The replay demo above is token-free and needs nothing else; live tiers above `protocol` need Docker + a staged agent binary |
+| **Have Claude Code drive it** for me | **[docs/companion-skill.md](./docs/companion-skill.md)**<br><br>`/plugin marketplace add yaniv-golan/cowork-harness`<br>`/plugin install cowork-harness@cowork-harness` | Claude Code. The skill self-bootstraps the CLI via `npx "cowork-harness@^3.4.0"` |
 | **Gate my skill in CI** | **[docs/ci.md](./docs/ci.md)**<br><br>`- uses: yaniv-golan/cowork-harness@v3`<br>`  with: { command: replay, path: cassettes/ }` | Nothing for the token-free gate; the live lane needs a self-hosted runner with Docker + an agent binary |
 
 Not sure a harness is what you need? The next two sections are the argument.
@@ -353,6 +353,6 @@ inputs/outputs. Human-readable terminal text is explicitly **not** part of the c
 ## Status
 
 The latest shipped baseline — what `baseline: latest` resolves to (`cowork-harness list`) — is
-**`desktop-1.40609.1`**. Release-by-release verification notes (what was re-verified against
+**`desktop-1.46388.3`**. Release-by-release verification notes (what was re-verified against
 which live agent/asar) are recorded in [CHANGELOG.md](./CHANGELOG.md); the feature catalogue
 this section would otherwise duplicate lives in the sections above.

package/SPEC.md

@@ -630,7 +630,7 @@ and a fail observed) always fails that batch, regardless of the numeric rate.
   "nonDeterministic?": bool,                      // true if any decision came from a non-deterministic source → not reproducible
   "gateProvenance?": { "total": number, "bySource": {…}, "gates": [{ "question","answeredBy","answer","model?" }] }, // how each AskUserQuestion gate was answered; informational (never fails the verdict); live/partial lane only (absent on replay)
   "permissiveAutoAllow?": ["string"],             // tools auto-allowed by cowork parity that real Cowork BLOCKS → green is NOT faithful
-  "staleness?": [{ "class": "baseline|skill|shared-root|format|unverifiable-baseline|unverifiable-skill|resolved-tier|unverifiable-tier|prompt-assets|unverifiable-prompt-assets", "message" }], // replay only; cassette-staleness findings, surfaced for a JSON gate. Drift classes are non-failing by default (a stale but passing replay stays ok:true); `unverifiable-skill` FAILS by default since 2.0.0. `--strict` fails on every class, `--fail-on-skill-drift` adds skill/shared-root. `resolved-tier` = a `fidelity: cowork` cassette's recorded effectiveFidelity no longer matches the tier the scenario's baseline (pinned `baseline:` or `latest`) resolves to today — the recording exercises the wrong tier; `unverifiable-tier` = the tier check couldn't run for a baseline-dependent (`fidelity: cowork`) cassette (no recorded effectiveFidelity, or its pinned baseline failed to load). Tier resolution is baseline-only (the CLAUDE_FORCE_HOST_LOOP env override is suppressed) so verify results can't differ across machines. `prompt-assets` = the baseline's committed prompt-asset files (spawn.promptTemplate/subagentAppend/subagentAppendHostLoop) changed since record under the SAME appVersion — warn by default, `--strict` fails, re-record; `unverifiable-prompt-assets` = a recorded `fingerprint.promptAssetsHash` exists but the live baseline's prompt assets can't be hashed (a moved/dangling pointer) — can't verify ⇒ not green.
+  "staleness?": [{ "class": "baseline|skill|shared-root|format|unverifiable-baseline|unverifiable-skill|resolved-tier|unverifiable-tier|prompt-assets|unverifiable-prompt-assets", "message" }], // replay only; cassette-staleness findings, surfaced for a JSON gate. Drift classes are non-failing by default (a stale but passing replay stays ok:true); `unverifiable-skill` FAILS by default since 2.0.0. `--strict` fails on every class, `--fail-on-skill-drift` adds skill/shared-root. `resolved-tier` = a `fidelity: cowork` cassette's recorded effectiveFidelity no longer matches the tier the scenario's baseline (pinned `baseline:` or `latest`) resolves to today — the recording exercises the wrong tier; `unverifiable-tier` = the tier check couldn't run for a baseline-dependent (`fidelity: cowork`) cassette (no recorded effectiveFidelity, or its pinned baseline failed to load). Tier resolution is baseline-only (the CLAUDE_FORCE_HOST_LOOP env override is suppressed) so verify results can't differ across machines. `prompt-assets` = the baseline's committed prompt-asset files (spawn.promptTemplate/subagentAppend/subagentAppendHostLoop), or the sub-agent prompt text the harness generates rather than reads from an asset (the folder manifest + trailing sentence, Desktop >=1.46388.3), changed since record under the SAME appVersion — warn by default, `--strict` fails, re-record; `unverifiable-prompt-assets` = a recorded `fingerprint.promptAssetsHash` exists but the live baseline's prompt assets can't be hashed (a moved/dangling pointer) — can't verify ⇒ not green.
   "skippedAssertions?": { "full": number, "partial": number }, // replay only; count of live-only assertions NOT evaluated (full = whole assertion skipped; partial = content half ran, fs/egress half dropped). The skipped ones are absent from `assertions[]`.
   "toolResults?": [{ "toolUseId?","isError","text","assertText?" }], // tool-result text at assertion-fidelity cap (10 KB); backs tool_result_contains/tool_result_not_contains and their regex siblings tool_result_matches/tool_result_not_matches
   "skillsInvoked?": ["string"],                  // Wave 1: skill/plugin ids invoked via the Skill tool_use event, call order, duplicates kept. Backs skill_triggered/no_skill_triggered.