cowork-harness 3.4.0 → 3.4.1

package/.claude/skills/cowork-harness/SKILL.md

@@ -3,8 +3,8 @@ name: cowork-harness
 description: Test or debug a Claude Code skill/plugin under Claude Cowork's runtime — sandboxed agent, default-deny egress, the can_use_tool permission/question protocol — using the cowork-harness CLI. Use when validating or regression-testing a skill, authoring or debugging a scenario YAML (prompt + scripted answers + assert:), choosing a fidelity tier, scripting AskUserQuestion / tool-permission answers, or asserting artifacts, egress, or sub-agent dispatch. Especially when a harness run no-ops an assertion, fails on an unanswered gate, false-greens, a steered answer never reaches the model, or a web_fetch is unexpectedly denied or gated. Also when iterating or hardening a skill across fixes, or grounding a skill's self-critique against its own run evidence — including a document-analysis skill (cap table, deck, financial model, transcript) that needs an uploaded file attached to be critiqued at all. NOT for generic unit testing (pytest/vitest of your own scripts) or non-Cowork CI. Covers the skill / run / chat / record / replay / trace / decide / assertions / scaffold commands and the session-vs-scenario split.
 metadata:
   author: cowork-harness
-  version: 3.4.0
-  tracks-harness: cowork-harness 3.4.0 (baseline desktop-1.46388.3)
+  version: 3.4.1
+  tracks-harness: cowork-harness 3.4.1 (baseline desktop-1.46388.3)
 ---
 
 # cowork-harness
@@ -25,7 +25,7 @@ flagged with a loud `::warning::`, not silent — auto-answer a gate, observe an
 allowlist). This skill exists mostly to keep you out of those traps — the Gotchas section below is
 the highest-value part. Read it.
 
-> **Version note:** the facts and `file:line` pointers here track `cowork-harness 3.4.0` (baseline
+> **Version note:** the facts and `file:line` pointers here track `cowork-harness 3.4.1` (baseline
 > `desktop-1.46388.3`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
 > `SPEC.md` / `docs/*.md` over this snapshot, and re-run the bundled linter.
 
@@ -42,7 +42,7 @@ Before the first command, confirm the CLI is reachable and **fail loud** (never
 
 - **One-shot check.** Run `cowork-harness doctor [--tier <tier>]` first — a read-only prerequisite check that inspects Docker, the staged agent, the token, and the baseline in one pass. The bullets below explain each thing it checks (and how to fix it).
 - **Replay-only? Skip `doctor`.** Replaying committed cassettes needs no Docker, no staged agent, and no token — and every tier's `doctor` validates the auth token (the live tiers also Docker + the staged agent), so a ✗ there is expected, not a blocker. Go straight to `cowork-harness replay <cassette>`.
-- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 3.4.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@^3.4.0" <cmd>` (Node ≥ 22), or install once with `npm i -g "cowork-harness@^3.4.0"`. **Pin `@^3.4.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
+- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 3.4.1**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@^3.4.1" <cmd>` (Node ≥ 22), or install once with `npm i -g "cowork-harness@^3.4.1"`. **Pin `@^3.4.1`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
 
   This skill documents the CURRENT surface, not release history. If `cowork-harness --version` is
   OLDER than the floor, the per-release record of what you are missing is [CHANGELOG.md](https://github.com/yaniv-golan/cowork-harness/blob/main/CHANGELOG.md)
@@ -158,6 +158,18 @@ Set the tier in the **scenario's `fidelity:` field**, not a flag — `run` rejec
 (it's a `skill`/`chat` flag; `run` takes fidelity only from the scenario). See
 `references/fidelity-and-answers.md`.
 
+**Every tier models Cowork's DESKTOP-LOCAL lane** — agent on the user's machine, shell rooted at
+`/sessions/<id>`, folders at `/sessions/<id>/mnt/<name>`, delivery via `present_files`. Cowork's
+**remote** lane runs server-side in a cloud container with a different filesystem (`$HOME/mnt/`),
+different delivery (`/mnt/user-data/outputs/` + `SendUserFile`) and a server-authored prompt; no tier
+reproduces it and none can — that container is not something a local tool can stand up. Which lane a
+real session gets is a Cowork setting ("Only on this computer"), observed **off** on a current install.
+So: behaviour conclusions (triggering, tool sequencing, gate handling) travel between lanes; anything
+asserting a **path, mount or delivery mechanism** is a claim about the local lane only. Declare
+`lane: remote` when the scenario is about that lane — the affected assertions then refuse to grade
+rather than passing (see the `delivery_unobservable` WARN and the `lane: remote` load-time rejections
+above).
+
 ### Choose an answer path (gates: AskUserQuestion + tool-permission)
 
 Default to **deterministic**: scripted `answers:` + `on_unanswered: fail`. Anything that brings a

package/.claude/skills/cowork-harness/references/ci-recipe.md

@@ -1,6 +1,6 @@
 # CI recipe — replay vs live lanes
 
-Self-contained reference. Tracks `cowork-harness 3.4.0` (baseline `desktop-1.46388.3`).
+Self-contained reference. Tracks `cowork-harness 3.4.1` (baseline `desktop-1.46388.3`).
 
 **Fastest path: the packaged Action.** One step gets you `replay`/`lint`/`verify-cassettes` plus a PR
 job-summary reporter (verdict table, staleness findings, cost/turns when available):
@@ -17,7 +17,7 @@ job-summary reporter (verdict table, staleness findings, cost/turns when availab
 CLI major reaches your workflow the moment it is promoted even though your `uses:` ref never changed — so a
 copy-pasted recipe that omits the input takes a major bump with no say in it. `^2` holds the major, needs no
 patch number to remember, and only wants a human decision at the next major. Pin an exact version
-(e.g. `version: "3.4.0"`) instead when you want byte-reproducible CI.
+(e.g. `version: "3.4.1"`) instead when you want byte-reproducible CI.
 
 Reach for the manual multi-step form below only when you need per-step control the Action's inputs don't
 cover (a custom flag combination, a different runner matrix per step, or `lint`/`verify-cassettes` gated
@@ -73,7 +73,7 @@ sha256-*checked* but not hard-blocking on mismatch — it's advisory for an inte
 GitHub-hosted runners, no token/Docker/agent:
 
 ```yaml
-- run: npm i -g "cowork-harness@^3.4.0"
+- run: npm i -g "cowork-harness@^3.4.1"
 - run: cowork-harness lint scenarios/*.yaml --strict --min-severity WARN
                                                     # no silent false-greens. WITHOUT --strict this
                                                     # step cannot fail on a WARN-class rule (e.g.
@@ -350,7 +350,7 @@ jobs:
         with: { node-version: '24' }
       - uses: actions/setup-python@v5
         with: { python-version: '3.x' }                                       # python3 only — PyYAML is bundled with the linter
-      - run: npm i -g "cowork-harness@^3.4.0"
+      - run: npm i -g "cowork-harness@^3.4.1"
       - run: cowork-harness lint scenarios/*.yaml                              # no-silent-false-green (needs python3; PyYAML bundled)
       - run: cowork-harness verify-cassettes cassettes/ --output-format json   # privacy + staleness gate
       - run: cowork-harness replay cassettes/ --output-format json             # token-free content/structure
@@ -379,7 +379,7 @@ jobs:
             echo "live=true" >> "$GITHUB_OUTPUT"
           fi
       - if: steps.guard.outputs.live == 'true'
-        run: npm i -g "cowork-harness@^3.4.0"
+        run: npm i -g "cowork-harness@^3.4.1"
       - if: steps.guard.outputs.live == 'true'
         run: cowork-harness run scenarios/ --output-format json
         env:

package/.claude/skills/cowork-harness/references/critique.md

@@ -1,6 +1,6 @@
 # Critique — the facts a plugin install can't otherwise reach
 
-Tracks `cowork-harness 3.4.0` (baseline `desktop-1.46388.3`). This is **not** a trim of the full
+Tracks `cowork-harness 3.4.1` (baseline `desktop-1.46388.3`). This is **not** a trim of the full
 [`docs/critique.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/critique.md) (repo-only —
 flags, cost, reproduction discipline, known limitations all live there). This file covers exactly what a
 plugin install cannot otherwise discover: the run-dir artifact a harvester actually reads, the report's

package/.claude/skills/cowork-harness/references/fidelity-and-answers.md

@@ -1,6 +1,6 @@
 # Fidelity tiers & answer paths
 
-Self-contained reference. Tracks `cowork-harness 3.4.0` (baseline `desktop-1.46388.3`).
+Self-contained reference. Tracks `cowork-harness 3.4.1` (baseline `desktop-1.46388.3`).
 
 ## Fidelity tiers (`fidelity:` in the scenario)
 

package/.claude/skills/cowork-harness/references/scenario-schema.md

@@ -1,6 +1,6 @@
 # Scenario & session schema, assertion catalog, web_fetch, authoring gotchas
 
-Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 3.4.0`
+Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 3.4.1`
 (baseline `desktop-1.46388.3`). If your checkout is newer, prefer the live [`docs/scenario.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/scenario.md),
 [`docs/session.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/session.md), and `SPEC.md`.
 

package/.claude/skills/cowork-harness/references/task-recipes.md

@@ -2,7 +2,7 @@
 
 Each recipe composes facts that live scattered across SKILL.md and the other references into one
 decision path. Every one answers a question a real fleet owner had to work out the hard way.
-Tracks `cowork-harness 3.4.0` (baseline `desktop-1.46388.3`), same as SKILL.md's front-matter. Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
+Tracks `cowork-harness 3.4.1` (baseline `desktop-1.46388.3`), same as SKILL.md's front-matter. Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
 Recipe 3's `init-redact` shipped in 0.24.0 and are part of the current feature set — no version gate
 needed if your CLI meets SKILL.md's version floor.
 

package/CHANGELOG.md

@@ -6,6 +6,39 @@ All notable changes to this project are documented here. The format is based on
 
 ## [Unreleased]
 
+## [3.4.1] — 2026-09-05
+
+### Documentation
+
+- **Which Cowork *lane* the harness models is now stated, in the places a consumer reads.** Every
+  fidelity tier reproduces the desktop-local lane; Cowork's remote lane runs server-side in a cloud
+  container with a different filesystem, shell tool, delivery mechanism and a server-authored prompt.
+  Which lane a real session gets is a Cowork setting ("Only on this computer"), and it was observed
+  **off** on a current install. README, the companion skill, `docs/fidelity-gaps.md` and
+  `docs/maintenance.md` now say so. The distinction that matters: behaviour conclusions (triggering,
+  tool sequencing, gate handling) travel between lanes; anything asserting a **path, mount or delivery
+  mechanism** is a local-lane claim only. No remote tier is planned — that container is Anthropic's, so
+  emulating it would mean authoring an environment rather than reproducing one; `lane: remote` already
+  makes the affected assertions refuse to grade instead of passing.
+
+### Changed
+
+- **The sub-agent override sentinel's note now carries a current probe.** Gate `124685897` reads ON,
+  which only enables a server-delivered replacement of the `## Cowork environment` section. Re-probed
+  against the 1.46388.3 composition in a real host-loop session: all three composed parts arrived
+  byte-identical to the shipped fallback, so the gate is on with no payload. The two non-overridable
+  parts are the control that makes it conclusive. The note also states the probe's precondition, which
+  it previously lacked.
+
+### Verification
+
+- **`microvm` exercised after the 3.4.0 tag** — `smoke-l2-microvm` passed 3/3 against the *published*
+  3.4.0 artifact (real Apple-VZ VM, separate kernel; guest egress reached allowlisted
+  `api.anthropic.com` and denied an off-list telemetry host). That completes all four tiers for the
+  1.46388.3 baseline; DESIGN.md's scope note is re-stamped accordingly. The 3.4.0 entry below is left
+  as the record of what was verified at tag time. This tier is macOS-arm64 only and CI runners are
+  Linux, so it is only ever exercised by hand.
+
 ## [3.4.0] — 2026-09-05
 
 ### Upgrade notes

package/DESIGN.md

@@ -176,7 +176,7 @@ The policy that produces those `allow`/`deny` responses is the **Decider** seam
 
 ### Control protocol — VERIFIED end-to-end against the live host CLI (macOS. The staged in-VM agent that L1/L2 run is **2.1.246**, the native host app that `hostloop` runs is **2.1.246**, baseline **`desktop-1.37937.1`** — a fresh live end-to-end pass across the `protocol`, `container`, and `hostloop` tiers was run against this baseline on 2026-08-26, superseding the prior `1.32885.1` pin. Scope and caveats of that pass are in the note directly below; read it before citing this heading.) The subsequent `desktop-1.20186.1` baseline is a patch-only Desktop release (egress allowlist, spawn config, and the Cowork system-prompt fingerprint unchanged from 1.20186.0; the staged VM ELF re-synced 2.1.202 → 2.1.205) — the live pass is deliberately not restamped onto it.
 
-> **Scope of that claim, stated plainly.** `2026-09-05 / desktop-1.46388.3` is the baseline carrying the latest **full live end-to-end pass**, and it is also the newest committed baseline — **no baselines have shipped since**, so nothing committed here is live-unverified for want of a newer run. The pass ran against agent **2.1.260** (the staged VM ELF and the native `.app` both at that version) on macOS arm64, agent image `cowork-agent-base:2`, and covered **four** suites: `boundary-check` **6/6** (host-fs-sealed, direct-egress-denied, allowlist-enforced, allowlist-permits, loopback-not-proxied, hostloop-bash-egress); `npm run test:live` **4 files, 19 passed, 0 skipped**; `run examples/scenarios/` **7/7 success, 39 assertions, 0 failed** (csv-fx-normalize, csv-metrics, example-pdf-skill, hostloop-computer-links, protocol-smoke, skill-loads, subagent-manifest-probe); and the e2e self-tests **8/8 success** (smoke-askuserquestion, smoke-multiselect, smoke-multiselect-deciderdir, smoke-l1-container, smoke-l1-egress, smoke-present-files, smoke-semantic-evidence-files, canary-hostloop). **Zero skips** in the live lane is the part worth stating: every `describe` there is `skipIf`-gated on Docker, the staged-binary version and the token, so a gated case reports as SKIPPED rather than passing vacuously — vitest reported none. Tiers exercised: **`protocol`, `container`, `hostloop`**. **`microvm` was NOT exercised** — it needs a real VM and CI excludes it for the same reason, so the ninth e2e scenario (`smoke-l2-microvm`) did not run. **Scope-out, so this is not read as more than it is.** (a) `subagent-manifest-probe` is new in this release and is the first live coverage the sub-agent append has ever had; it proves the composed append is ACTIONABLE — a sub-agent reaches the right files through both tool families, and a bare relative write lands at the host cwd — **not** that the harness's paraphrase matches Desktop's wording, which is the `manifest`/`suffix` fingerprint axes' job. (b) A live pass verifies observed behaviour, not the whole spawn contract by construction. (c) These suites are model-dependent, so a single red is evidence of model variance until a re-run says otherwise, not of a regression — which is why the gated cases skip loudly rather than fail. Separately and not a live matter: `example-pdf-skill` was re-recorded against this baseline and the other two committed cassettes were re-stamped (see the CHANGELOG for why each), so nothing in `examples/replays/` is stale against it. Re-stamp this paragraph, naming the baseline, whenever a live pass is actually re-run.
+> **Scope of that claim, stated plainly.** `2026-09-05 / desktop-1.46388.3` is the baseline carrying the latest **full live end-to-end pass**, and it is also the newest committed baseline — **no baselines have shipped since**, so nothing committed here is live-unverified for want of a newer run. The pass ran against agent **2.1.260** (the staged VM ELF and the native `.app` both at that version) on macOS arm64, agent image `cowork-agent-base:2`, and covered **four** suites: `boundary-check` **6/6** (host-fs-sealed, direct-egress-denied, allowlist-enforced, allowlist-permits, loopback-not-proxied, hostloop-bash-egress); `npm run test:live` **4 files, 19 passed, 0 skipped**; `run examples/scenarios/` **7/7 success, 39 assertions, 0 failed** (csv-fx-normalize, csv-metrics, example-pdf-skill, hostloop-computer-links, protocol-smoke, skill-loads, subagent-manifest-probe); and the e2e self-tests **9/9 success** (smoke-askuserquestion, smoke-multiselect, smoke-multiselect-deciderdir, smoke-l1-container, smoke-l1-egress, smoke-present-files, smoke-semantic-evidence-files, canary-hostloop, smoke-l2-microvm). **Zero skips** in the live lane is the part worth stating: every `describe` there is `skipIf`-gated on Docker, the staged-binary version and the token, so a gated case reports as SKIPPED rather than passing vacuously — vitest reported none. Tiers exercised: **all four — `protocol`, `container`, `hostloop` and `microvm`.** The microvm case ran AFTER the 3.4.0 tag, against the published artifact rather than the checkout, and is recorded here rather than in that release's CHANGELOG entry, which states what was verified at tag time. It is the tier CI can never cover — GitHub's runners are Linux and Apple-VZ is macOS-arm64 only — so it is only ever exercised by hand here: `smoke-l2-microvm` passed 3/3 in a real VM with its own kernel, and its guest egress behaved (allowlisted `api.anthropic.com` reached, an off-list telemetry host denied). **Scope-out, so this is not read as more than it is.** (a) `subagent-manifest-probe` is new in this release and is the first live coverage the sub-agent append has ever had; it proves the composed append is ACTIONABLE — a sub-agent reaches the right files through both tool families, and a bare relative write lands at the host cwd — **not** that the harness's paraphrase matches Desktop's wording, which is the `manifest`/`suffix` fingerprint axes' job. (b) A live pass verifies observed behaviour, not the whole spawn contract by construction. (c) These suites are model-dependent, so a single red is evidence of model variance until a re-run says otherwise, not of a regression — which is why the gated cases skip loudly rather than fail. Separately and not a live matter: `example-pdf-skill` was re-recorded against this baseline and the other two committed cassettes were re-stamped (see the CHANGELOG for why each), so nothing in `examples/replays/` is stale against it. Re-stamp this paragraph, naming the baseline, whenever a live pass is actually re-run.
 
 > The staged agent ELF is unchanged (2.1.181) across the 1.14271.0→1.15200.0 asar bump, and 2.1.187 across the 1.15200.0→1.15962.0 bump. The live scenario suite (`protocol` + `container` tiers) was re-run against the 1.15200.0 baseline; the 1.15962.0 bump was verified via asar analysis (content byte-identical: host-loop generator, system prompt, identity string, gates, and egress domains all unchanged) plus a full local test suite pass. The 1.15962.1→1.17377.1 bump moved the staged agent to **2.1.197** and added `api.claude.ai` to the egress allowlist; re-verified via `sync` (no unknown deltas) plus a manual asar spot-check of the reconstructed prompt content (substantively unchanged — see the Parity entry in CHANGELOG.md) and a full live scenario-suite pass (`protocol` + `container` tiers).
 

package/README.md

@@ -36,7 +36,7 @@ npm ci && npm run build
 node dist/cli.js replay examples/replays/example-pdf-skill.cassette.json
 ```
 
-(Installing globally — `npm install -g "cowork-harness@^3.4.0"` — gives you the `cowork-harness` CLI for your own
+(Installing globally — `npm install -g "cowork-harness@^3.4.1"` — gives you the `cowork-harness` CLI for your own
 scenarios and cassettes; the bundled example above also replays from a global install — see the `$(npm root -g)` path below.)
 
 Full setup → [Quick start](./docs/cli.md#quick-start).
@@ -49,8 +49,8 @@ Three ways to use this project. Each row is the whole hook — follow the link f
 
 | I want to… | Start here | Needs |
 |---|---|---|
-| **Run scenarios myself** from a terminal | **[docs/cli.md](./docs/cli.md)**<br><br>`npm i -g "cowork-harness@^3.4.0"`<br>`cowork-harness replay examples/replays/example-pdf-skill.cassette.json` | Node ≥ 22. The replay demo above is token-free and needs nothing else; live tiers above `protocol` need Docker + a staged agent binary |
-| **Have Claude Code drive it** for me | **[docs/companion-skill.md](./docs/companion-skill.md)**<br><br>`/plugin marketplace add yaniv-golan/cowork-harness`<br>`/plugin install cowork-harness@cowork-harness` | Claude Code. The skill self-bootstraps the CLI via `npx "cowork-harness@^3.4.0"` |
+| **Run scenarios myself** from a terminal | **[docs/cli.md](./docs/cli.md)**<br><br>`npm i -g "cowork-harness@^3.4.1"`<br>`cowork-harness replay examples/replays/example-pdf-skill.cassette.json` | Node ≥ 22. The replay demo above is token-free and needs nothing else; live tiers above `protocol` need Docker + a staged agent binary |
+| **Have Claude Code drive it** for me | **[docs/companion-skill.md](./docs/companion-skill.md)**<br><br>`/plugin marketplace add yaniv-golan/cowork-harness`<br>`/plugin install cowork-harness@cowork-harness` | Claude Code. The skill self-bootstraps the CLI via `npx "cowork-harness@^3.4.1"` |
 | **Gate my skill in CI** | **[docs/ci.md](./docs/ci.md)**<br><br>`- uses: yaniv-golan/cowork-harness@v3`<br>`  with: { command: replay, path: cassettes/ }` | Nothing for the token-free gate; the live lane needs a self-hosted runner with Docker + an agent binary |
 
 Not sure a harness is what you need? The next two sections are the argument.
@@ -215,6 +215,32 @@ L2  microvm parity    Optional. Agent inside a real Linux microVM (Lima/Apple-VZ
                       synced baseline. "Do what real Cowork does."
 ```
 
+### Which Cowork *lane* this models — read this before trusting an environment assertion
+
+Every tier above reproduces Cowork's **desktop-local lane**: the agent runs on your machine, shell
+commands land in a Linux sandbox rooted at `/sessions/<id>`, attached folders appear under
+`/sessions/<id>/mnt/<name>`, and finished files reach the user through `present_files`.
+
+Cowork also has a **remote lane**, where the session runs server-side in an ephemeral cloud container
+that reaches your machine over a link. There the filesystem, the shell tool, and file delivery are all
+different — folders arrive under `$HOME/mnt/`, deliverables go to `/mnt/user-data/outputs/` and are
+handed over with `SendUserFile`, and the environment prompt is authored by the server rather than by
+Desktop. **Which lane you get is a Cowork setting** ("Only on this computer", Settings → Cowork), and
+it has been observed **off** — i.e. remote — on a current install.
+
+The harness **cannot execute the remote lane**: that container is Anthropic's, not something a local
+tool can stand up. What it does instead is refuse to fake it. Declare `lane: remote` on a scenario and
+the assertions that depend on observing a local filesystem degrade honestly — `file_absent` reports
+evidence-unavailable rather than passing, and delivery is reported as unobservable — so a green never
+means more than it should.
+
+**What this means for you.** Behaviour-shaped conclusions travel between lanes: whether your skill
+triggers, how it sequences tools, which questions it asks, whether it respects a permission gate.
+Environment-shaped conclusions do not: anything asserting a path, a mount, or a delivery mechanism is a
+statement about the **local** lane specifically. Scope your claims accordingly, and if you are probing
+real Cowork to compare, turn "Only on this computer" **on** first or you will be measuring a lane this
+tool does not model.
+
 **Decision guide** — `fidelity:` takes exactly one of these five values (`protocol`/`container`/`microvm` vary isolation strength; `hostloop`/`cowork` are overlays that instead pick *where the loop runs* — there's no combining the two groups):
 
 | Question | Choose |
@@ -281,6 +307,7 @@ See [DESIGN.md](./DESIGN.md) for the full parity matrix, the known deltas vs. re
 
 ## Limitations
 
+- **One lane, deliberately.** Every tier models Cowork's desktop-local lane. The remote (cloud) lane runs server-side with a different filesystem, shell tool, delivery mechanism and a server-authored prompt; no tier reproduces it, and `lane: remote` exists to make the resulting blind spots refuse to grade rather than pass. See [Which Cowork lane this models](#which-cowork-lane-this-models--read-this-before-trusting-an-environment-assertion).
 - **Not the full Desktop network transport.** L1 is a container, not a VM; L2 *is* a real Apple-VZ microVM but still does not reproduce Cowork's gVisor netstack — its egress is the same allowlist proxy as L1 (with a guest iptables firewall in front). If your skill depends on VM-kernel specifics, validate at L2; if it depends on packet-level gVisor behavior, no tier reproduces it.
 - **Cowork in-guest context is partial.** Desktop supplies host-loop staging, runtime `mountPath` RPC, and the bridge. We reproduce the *filesystem and cowork mode*, not those host-side services. Skills that call Desktop-only host RPCs won't run here (they wouldn't be portable anyway).
 - **The agent binary is the staged ELF** (`claude-code-vm/<ver>/claude`), **bind-mounted** from your own Claude Desktop install — nothing Anthropic-owned is bundled or installed. There is **no npm path**; override the path with `COWORK_AGENT_BINARY`. Check licensing/ToS for your use.

package/dist/sync/cowork-sync.js

@@ -518,13 +518,19 @@ export function checkSubagentOverrideGate(gates) {
             "<vmCwd>/mnt/, and shell starting in <vmCwd> with non-mnt writes reaching neither the user nor the " +
             "file tools — so NO override was reaching that account and the committed paraphrase is faithful. " +
             "That is EVIDENCE, NOT PROOF: one account, one session, and a server rule can be segment-targeted. " +
-            "AND IT IS NOW SUPERSEDED: that probe was run against the pre-1.46388.3 hl text, which Desktop " +
-            "1.46388.3 REPLACED. Two of the four claims above (host cwd, folders under <vmCwd>/mnt/) no longer " +
-            "live in the overridable section at all — they moved into the appended folder manifest — so a " +
-            "re-probe cannot be scored against that list. Score a new probe against what the release actually " +
-            "composes: the section, then the folder manifest, then the trailing skills sentence. " +
+            "RE-PROBED 2026-09-05 against the 1.46388.3 composition, and it holds: a real host-loop sub-agent " +
+            "received all three composed parts byte-identical to this build's fallback text — the overridable " +
+            "section, the folder manifest, and the trailing skills sentence. The two composed parts are the " +
+            "CONTROL that makes this conclusive: they are appended AFTER resolveSection and cannot be " +
+            "server-replaced, so their being verbatim proves the sub-agent quoted faithfully rather than " +
+            "paraphrasing something that merely looked right. So the gate is ON with no payload, and the " +
+            "hardcoded fallback is what reaches the model. " +
+            "Still one account, one session, and still segment-targetable. " +
             "If the sub-agent append matters to what you are about to ship, re-probe (dispatch a sub-agent, ask " +
-            "for its environment section verbatim, diff the three composed parts) rather than trusting this note.",
+            "for its environment section verbatim, diff the three composed parts) rather than trusting this note. " +
+            "NOTE the probe now has a PRECONDITION: Cowork's `Only on this computer` setting (localAgentMode) is " +
+            "OFF by default, and with it off a session runs server-side with a server-authored prompt that has no " +
+            "`## Cowork environment` section at all. Turn it ON, or you will probe a lane this harness does not model.",
     ];
 }
 /** Read `network.allowDomains` from the NEWEST committed baseline — the pinned, hand-curated egress

package/docs/ci.md

@@ -97,7 +97,7 @@ jobs:
           anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
 ```
 
-Every run writes a Markdown verdict table (scenario, pass/fail, signals, cost/turns when available, staleness findings, and the replay-skipped-assertions honesty line) to the job summary. Inputs: `command`, `path` (required), `version` (npm dist-tag/version, default `latest` — the recipes above pin `^3` instead, because leaving it at `latest` takes a CLI major the moment it is promoted even though your `uses:` ref never changed; pin an exact version for byte-reproducible CI. The companion skill's `cowork-harness@^3.4.0` floor guidance applies to ad-hoc CLI installs, not this input), `strict` (applies to `replay` (staleness findings), `lint`/`lint-skill` (WARN/INFO), and `analyze-skill` (any **`error`**-severity finding — advisory findings are precisely the class that does NOT gate); IGNORED — not forwarded — for `verify-cassettes`/`run`, which don't accept the flag), `fail-on-skill-drift` (**`replay`-only** — never forwarded to the analyzers), `extra-args`, `summary` (default `true`), `anthropic-api-key` (live lane only). Outputs: `ok` (`"true"`/`"false"`, mirrors the exit code), `envelope-path` (path to the raw JSON envelope, for post-processing), `summary-md` (the rendered verdict table, exposed as an output — not just written to `$GITHUB_STEP_SUMMARY` — because that file is scoped to this action's own invocation and a caller's later step gets a fresh, empty one). See [`action.yml`](https://github.com/yaniv-golan/cowork-harness/blob/main/action.yml) for the full input/output reference.
+Every run writes a Markdown verdict table (scenario, pass/fail, signals, cost/turns when available, staleness findings, and the replay-skipped-assertions honesty line) to the job summary. Inputs: `command`, `path` (required), `version` (npm dist-tag/version, default `latest` — the recipes above pin `^3` instead, because leaving it at `latest` takes a CLI major the moment it is promoted even though your `uses:` ref never changed; pin an exact version for byte-reproducible CI. The companion skill's `cowork-harness@^3.4.1` floor guidance applies to ad-hoc CLI installs, not this input), `strict` (applies to `replay` (staleness findings), `lint`/`lint-skill` (WARN/INFO), and `analyze-skill` (any **`error`**-severity finding — advisory findings are precisely the class that does NOT gate); IGNORED — not forwarded — for `verify-cassettes`/`run`, which don't accept the flag), `fail-on-skill-drift` (**`replay`-only** — never forwarded to the analyzers), `extra-args`, `summary` (default `true`), `anthropic-api-key` (live lane only). Outputs: `ok` (`"true"`/`"false"`, mirrors the exit code), `envelope-path` (path to the raw JSON envelope, for post-processing), `summary-md` (the rendered verdict table, exposed as an output — not just written to `$GITHUB_STEP_SUMMARY` — because that file is scoped to this action's own invocation and a caller's later step gets a fresh, empty one). See [`action.yml`](https://github.com/yaniv-golan/cowork-harness/blob/main/action.yml) for the full input/output reference.
 
 CI uses `ANTHROPIC_API_KEY` specifically because there's no interactive browser available to run
 `claude setup-token`'s OAuth flow in a GitHub Actions runner; locally, the OAuth token is preferred because

package/docs/cli.md

@@ -18,7 +18,7 @@ companion skill, CI). This page is the CLI one.
 **Install from npm:**
 
 ```bash
-npm install -g "cowork-harness@^3.4.0"    # puts the `cowork-harness` command on your PATH
+npm install -g "cowork-harness@^3.4.1"    # puts the `cowork-harness` command on your PATH
 ```
 
 **Or build from source:**
@@ -38,7 +38,7 @@ node dist/cli.js replay examples/replays/example-pdf-skill.cassette.json
 
 > **Installed globally instead?** Once linked/installed, the same command is `cowork-harness replay
 > <cassette>` — but the relative path above only resolves from a source checkout's `examples/replays/`.
-> From a global install (`npm i -g "cowork-harness@^3.4.0"`), point at the package root instead:
+> From a global install (`npm i -g "cowork-harness@^3.4.1"`), point at the package root instead:
 > `cowork-harness replay "$(npm root -g)/cowork-harness/examples/replays/example-pdf-skill.cassette.json"`
 > (or copy the cassette into your own project and pass that path).
 
@@ -48,7 +48,7 @@ Live `run`/`skill` need the prerequisites in the next section — note the `prot
 > - **Replay only (zero setup):** `cowork-harness replay <cassette>` — no token, no Docker, no agent. The command above.
 > - **`protocol` (real model, no Docker):** needs only the auth token (item 3 below).
 > - **Live `container` / `microvm` / `hostloop` / `cowork`:** needs Docker (or Lima for `microvm`), a staged agent, and the token — run `cowork-harness doctor` first.
-> - **Invocation:** from a source checkout, `node dist/cli.js <cmd>` (or `npm link` to get the `cowork-harness` command); from a global install, `cowork-harness <cmd>`; the companion skill falls back to `npx "cowork-harness@^3.4.0"`.
+> - **Invocation:** from a source checkout, `node dist/cli.js <cmd>` (or `npm link` to get the `cowork-harness` command); from a global install, `cowork-harness <cmd>`; the companion skill falls back to `npx "cowork-harness@^3.4.1"`.
 
 Two more worked examples worth knowing about: `examples/scenarios/protocol-smoke.yaml` (zero-Docker smoke
 test) and `examples/scenarios/skill-loads.yaml` (container-tier acceptance check) — see

package/docs/companion-skill.md

@@ -28,7 +28,7 @@ claude plugin marketplace add yaniv-golan/cowork-harness
 claude plugin install cowork-harness@cowork-harness
 ```
 
-The skill **self-bootstraps the CLI**: if `cowork-harness` isn't on your PATH it falls back to `npx "cowork-harness@^3.4.0"` (a version floor that fails loud rather than silently fetching a too-old CLI; Node ≥ 22). Tiers above `protocol` still need Docker/Lima and a Claude Desktop agent binary — see the prerequisites below.
+The skill **self-bootstraps the CLI**: if `cowork-harness` isn't on your PATH it falls back to `npx "cowork-harness@^3.4.1"` (a version floor that fails loud rather than silently fetching a too-old CLI; Node ≥ 22). Tiers above `protocol` still need Docker/Lima and a Claude Desktop agent binary — see the prerequisites below.
 
 It also follows the open [Agent Skills](https://agentskills.io) spec, so it installs cross-editor (Cursor, Codex, OpenCode, …) via [`npx skills`](https://github.com/vercel-labs/skills) (Vercel Labs' CLI implementation of that spec):
 
@@ -38,7 +38,7 @@ npx skills add yaniv-golan/cowork-harness --skill cowork-harness
 
 (Working *inside* this repo, the skill auto-loads as a project skill — no install needed.)
 
-| What ships | npm global (`npm install -g "cowork-harness@^3.4.0"`) | Source checkout (`git clone` + `npm ci`) |
+| What ships | npm global (`npm install -g "cowork-harness@^3.4.1"`) | Source checkout (`git clone` + `npm ci`) |
 |---|---|---|
 | CLI, `scenario.py` + assertion keys (enough for `lint` in CI) | ✓ | ✓ |
 | `SKILL.md`, all of `docs/`, `SPEC.md`/`DESIGN.md`/`AGENTS.md` | ✓ | ✓ |
@@ -53,6 +53,6 @@ global install puts nothing in your working directory. The matrix, answer-policy
 ones that still need a source checkout. (The marketplace
 skill install itself only pulls `.claude/skills/cowork-harness/` — SKILL.md + `references/` + `scenario.py`/
 assertion keys, per `.claude-plugin/marketplace.json`'s `source` — not the rest of this table; the full set
-above becomes available once the skill's first command self-bootstraps `npx "cowork-harness@^3.4.0"` — see
+above becomes available once the skill's first command self-bootstraps `npx "cowork-harness@^3.4.1"` — see
 [above](#install) — which pulls the same npm package as the global-install row.)
 

package/docs/fidelity-gaps.md

@@ -8,6 +8,37 @@ For how the harness *enforces* the limitations it does reproduce (sealed filesys
 
 ---
 
+## Which Cowork LANE this harness models — read first, it scopes everything below
+
+Every fidelity tier reproduces Cowork's **desktop-local** lane. Cowork also runs sessions on a
+**remote** lane, server-side in a cloud container that reaches the user's machine over a device
+bridge, and **which lane a real session gets is a Cowork setting** — "Only on this computer"
+(Settings → Cowork). Measured 2026-09-05 on a current install: that setting was **off**, so an
+otherwise-default Cowork session ran remote.
+
+That matters for how you read the rest of this file. Gaps documented here are gaps against the
+*local* lane. On the remote lane the environment is different in kind, not degree: the cloud
+container's cwd is `/home/claude` with no `mnt/` tree, delivery is `SendUserFile` rather than
+`present_files`, and the session reaches the user's disk through the `device_*` tools into a local
+VM (see "File delivery" and the device-tool section below). Its environment prompt is **authored by
+the server**, not by Desktop — the heading and markers a remote sub-agent reports are 0 occurrences
+in both the app bundle and the agent binary.
+
+**The harness cannot execute the remote lane and does not pretend to.** That container is
+Anthropic's; standing up a local imitation would be authoring an environment rather than reproducing
+one, with no production to verify it against. What exists instead is `lane: remote` on a scenario,
+which makes the affected assertions **refuse to grade** rather than pass — `file_absent` reports
+evidence-unavailable, delivery is reported unobservable.
+
+**Practical consequence.** Behaviour-shaped conclusions travel between lanes: whether a skill
+triggers, how it sequences tools, which questions it asks, whether it honours a permission gate.
+Environment-shaped conclusions do not: any assertion about a path, a mount, or a delivery mechanism
+is a claim about the local lane only. And if you are probing real Cowork to compare against this
+harness, **turn "Only on this computer" on first** — with it off you are measuring a lane this tool
+does not model, which has already cost one wasted probe.
+
+---
+
 ## Mid-session skill/plugin re-sync
 
 Cowork re-syncs skills and plugins from the host into the session **while the session is running** —

package/docs/maintenance.md

@@ -236,6 +236,13 @@ committed baseline and say why in that baseline's `$comment`.
    `vm` always mandatory; `manifest` and `suffix` mandatory together once either is recorded — a partial
    entry is itself a hard-fail), then re-run `cowork-harness sync`.
 
+   > **PRECONDITION for any live probe of real Cowork.** Cowork's "Only on this computer" setting
+   > (Settings → Cowork) selects the lane. With it **off** — observed to be the default state on a
+   > current install — a session runs server-side under a server-authored prompt with no
+   > `## Cowork environment` section at all, and you will be diffing a lane this harness does not
+   > model. Turn it on and start a FRESH session before probing. This cost one wasted probe on
+   > 2026-09-05.
+
    > **Then REPOINT the baseline at the new asset** — `spawn.subagentAppendHostLoop` (and/or
    > `spawn.subagentAppend`) in the freshly written `baselines/desktop-<new>.json`. These pointers are
    > hand-authored, so `sync` carries the PREVIOUS release's value forward untouched; writing the

package/examples/replays/README.md

@@ -16,7 +16,7 @@ DOES exercise a real gate exchange, see `example-multiselect-gate.cassette.json`
 
 Run it with:
 
-> Assumes the `cowork-harness` CLI is available — from a source checkout run `npm ci && npm run build && npm link` first, or `npm i -g "cowork-harness@^3.4.0"`. (`replay` itself needs nothing else — no token, no Docker.)
+> Assumes the `cowork-harness` CLI is available — from a source checkout run `npm ci && npm run build && npm link` first, or `npm i -g "cowork-harness@^3.4.1"`. (`replay` itself needs nothing else — no token, no Docker.)
 
 ```sh
 cowork-harness replay examples/replays/example-pdf-skill.cassette.json

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cowork-harness",
-  "version": "3.4.0",
+  "version": "3.4.1",
   "description": "Scriptable, CI-friendly harness for Claude Cowork's runtime contract for testing skills across scenarios \u2014 same agent, mounts, egress allowlist, permission protocol, and sandbox limitations.",
   "license": "MIT",
   "type": "module",