cowork-harness 3.4.0 → 3.5.0

package/.claude/skills/cowork-harness/SKILL.md

@@ -3,8 +3,8 @@ name: cowork-harness
 description: Test or debug a Claude Code skill/plugin under Claude Cowork's runtime — sandboxed agent, default-deny egress, the can_use_tool permission/question protocol — using the cowork-harness CLI. Use when validating or regression-testing a skill, authoring or debugging a scenario YAML (prompt + scripted answers + assert:), choosing a fidelity tier, scripting AskUserQuestion / tool-permission answers, or asserting artifacts, egress, or sub-agent dispatch. Especially when a harness run no-ops an assertion, fails on an unanswered gate, false-greens, a steered answer never reaches the model, or a web_fetch is unexpectedly denied or gated. Also when iterating or hardening a skill across fixes, or grounding a skill's self-critique against its own run evidence — including a document-analysis skill (cap table, deck, financial model, transcript) that needs an uploaded file attached to be critiqued at all. NOT for generic unit testing (pytest/vitest of your own scripts) or non-Cowork CI. Covers the skill / run / chat / record / replay / trace / decide / assertions / scaffold commands and the session-vs-scenario split.
 metadata:
   author: cowork-harness
-  version: 3.4.0
-  tracks-harness: cowork-harness 3.4.0 (baseline desktop-1.46388.3)
+  version: 3.5.0
+  tracks-harness: cowork-harness 3.5.0 (baseline desktop-1.46388.4)
 ---
 
 # cowork-harness
@@ -25,8 +25,8 @@ flagged with a loud `::warning::`, not silent — auto-answer a gate, observe an
 allowlist). This skill exists mostly to keep you out of those traps — the Gotchas section below is
 the highest-value part. Read it.
 
-> **Version note:** the facts and `file:line` pointers here track `cowork-harness 3.4.0` (baseline
-> `desktop-1.46388.3`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
+> **Version note:** the facts and `file:line` pointers here track `cowork-harness 3.5.0` (baseline
+> `desktop-1.46388.4`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
 > `SPEC.md` / `docs/*.md` over this snapshot, and re-run the bundled linter.
 
 ## Preflight — make sure the harness can actually run
@@ -42,7 +42,7 @@ Before the first command, confirm the CLI is reachable and **fail loud** (never
 
 - **One-shot check.** Run `cowork-harness doctor [--tier <tier>]` first — a read-only prerequisite check that inspects Docker, the staged agent, the token, and the baseline in one pass. The bullets below explain each thing it checks (and how to fix it).
 - **Replay-only? Skip `doctor`.** Replaying committed cassettes needs no Docker, no staged agent, and no token — and every tier's `doctor` validates the auth token (the live tiers also Docker + the staged agent), so a ✗ there is expected, not a blocker. Go straight to `cowork-harness replay <cassette>`.
-- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 3.4.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@^3.4.0" <cmd>` (Node ≥ 22), or install once with `npm i -g "cowork-harness@^3.4.0"`. **Pin `@^3.4.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
+- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 3.5.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@^3.5.0" <cmd>` (Node ≥ 22), or install once with `npm i -g "cowork-harness@^3.5.0"`. **Pin `@^3.5.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
 
   This skill documents the CURRENT surface, not release history. If `cowork-harness --version` is
   OLDER than the floor, the per-release record of what you are missing is [CHANGELOG.md](https://github.com/yaniv-golan/cowork-harness/blob/main/CHANGELOG.md)
@@ -158,6 +158,18 @@ Set the tier in the **scenario's `fidelity:` field**, not a flag — `run` rejec
 (it's a `skill`/`chat` flag; `run` takes fidelity only from the scenario). See
 `references/fidelity-and-answers.md`.
 
+**Every tier models Cowork's DESKTOP-LOCAL lane** — agent on the user's machine, shell rooted at
+`/sessions/<id>`, folders at `/sessions/<id>/mnt/<name>`, delivery via `present_files`. Cowork's
+**remote** lane runs server-side in a cloud container with a different filesystem (`$HOME/mnt/`),
+different delivery (`/mnt/user-data/outputs/` + `SendUserFile`) and a server-authored prompt; no tier
+reproduces it and none can — that container is not something a local tool can stand up. Which lane a
+real session gets is a Cowork setting ("Only on this computer"), observed **off** on a current install.
+So: behaviour conclusions (triggering, tool sequencing, gate handling) travel between lanes; anything
+asserting a **path, mount or delivery mechanism** is a claim about the local lane only. Declare
+`lane: remote` when the scenario is about that lane — the affected assertions then refuse to grade
+rather than passing (see the `delivery_unobservable` WARN and the `lane: remote` load-time rejections
+above).
+
 ### Choose an answer path (gates: AskUserQuestion + tool-permission)
 
 Default to **deterministic**: scripted `answers:` + `on_unanswered: fail`. Anything that brings a

package/.claude/skills/cowork-harness/references/ci-recipe.md

@@ -1,6 +1,6 @@
 # CI recipe — replay vs live lanes
 
-Self-contained reference. Tracks `cowork-harness 3.4.0` (baseline `desktop-1.46388.3`).
+Self-contained reference. Tracks `cowork-harness 3.5.0` (baseline `desktop-1.46388.4`).
 
 **Fastest path: the packaged Action.** One step gets you `replay`/`lint`/`verify-cassettes` plus a PR
 job-summary reporter (verdict table, staleness findings, cost/turns when available):
@@ -17,7 +17,7 @@ job-summary reporter (verdict table, staleness findings, cost/turns when availab
 CLI major reaches your workflow the moment it is promoted even though your `uses:` ref never changed — so a
 copy-pasted recipe that omits the input takes a major bump with no say in it. `^2` holds the major, needs no
 patch number to remember, and only wants a human decision at the next major. Pin an exact version
-(e.g. `version: "3.4.0"`) instead when you want byte-reproducible CI.
+(e.g. `version: "3.5.0"`) instead when you want byte-reproducible CI.
 
 Reach for the manual multi-step form below only when you need per-step control the Action's inputs don't
 cover (a custom flag combination, a different runner matrix per step, or `lint`/`verify-cassettes` gated
@@ -73,7 +73,7 @@ sha256-*checked* but not hard-blocking on mismatch — it's advisory for an inte
 GitHub-hosted runners, no token/Docker/agent:
 
 ```yaml
-- run: npm i -g "cowork-harness@^3.4.0"
+- run: npm i -g "cowork-harness@^3.5.0"
 - run: cowork-harness lint scenarios/*.yaml --strict --min-severity WARN
                                                     # no silent false-greens. WITHOUT --strict this
                                                     # step cannot fail on a WARN-class rule (e.g.
@@ -350,7 +350,7 @@ jobs:
         with: { node-version: '24' }
       - uses: actions/setup-python@v5
         with: { python-version: '3.x' }                                       # python3 only — PyYAML is bundled with the linter
-      - run: npm i -g "cowork-harness@^3.4.0"
+      - run: npm i -g "cowork-harness@^3.5.0"
       - run: cowork-harness lint scenarios/*.yaml                              # no-silent-false-green (needs python3; PyYAML bundled)
       - run: cowork-harness verify-cassettes cassettes/ --output-format json   # privacy + staleness gate
       - run: cowork-harness replay cassettes/ --output-format json             # token-free content/structure
@@ -379,7 +379,7 @@ jobs:
             echo "live=true" >> "$GITHUB_OUTPUT"
           fi
       - if: steps.guard.outputs.live == 'true'
-        run: npm i -g "cowork-harness@^3.4.0"
+        run: npm i -g "cowork-harness@^3.5.0"
       - if: steps.guard.outputs.live == 'true'
         run: cowork-harness run scenarios/ --output-format json
         env:

package/.claude/skills/cowork-harness/references/critique.md

@@ -1,6 +1,6 @@
 # Critique — the facts a plugin install can't otherwise reach
 
-Tracks `cowork-harness 3.4.0` (baseline `desktop-1.46388.3`). This is **not** a trim of the full
+Tracks `cowork-harness 3.5.0` (baseline `desktop-1.46388.4`). This is **not** a trim of the full
 [`docs/critique.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/critique.md) (repo-only —
 flags, cost, reproduction discipline, known limitations all live there). This file covers exactly what a
 plugin install cannot otherwise discover: the run-dir artifact a harvester actually reads, the report's

package/.claude/skills/cowork-harness/references/fidelity-and-answers.md

@@ -1,6 +1,6 @@
 # Fidelity tiers & answer paths
 
-Self-contained reference. Tracks `cowork-harness 3.4.0` (baseline `desktop-1.46388.3`).
+Self-contained reference. Tracks `cowork-harness 3.5.0` (baseline `desktop-1.46388.4`).
 
 ## Fidelity tiers (`fidelity:` in the scenario)
 

package/.claude/skills/cowork-harness/references/scenario-schema.md

@@ -1,7 +1,7 @@
 # Scenario & session schema, assertion catalog, web_fetch, authoring gotchas
 
-Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 3.4.0`
-(baseline `desktop-1.46388.3`). If your checkout is newer, prefer the live [`docs/scenario.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/scenario.md),
+Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 3.5.0`
+(baseline `desktop-1.46388.4`). If your checkout is newer, prefer the live [`docs/scenario.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/scenario.md),
 [`docs/session.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/session.md), and `SPEC.md`.
 
 **Minimal scenario** — `prompt` is the only required field:

package/.claude/skills/cowork-harness/references/task-recipes.md

@@ -2,7 +2,7 @@
 
 Each recipe composes facts that live scattered across SKILL.md and the other references into one
 decision path. Every one answers a question a real fleet owner had to work out the hard way.
-Tracks `cowork-harness 3.4.0` (baseline `desktop-1.46388.3`), same as SKILL.md's front-matter. Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
+Tracks `cowork-harness 3.5.0` (baseline `desktop-1.46388.4`), same as SKILL.md's front-matter. Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
 Recipe 3's `init-redact` shipped in 0.24.0 and are part of the current feature set — no version gate
 needed if your CLI meets SKILL.md's version floor.
 

package/.claude/skills/cowork-harness/scripts/assertion-keys.json

@@ -113,14 +113,43 @@
     "PreToolUse"
   ],
   "knownHookEvents": [
+    "ConfigChange",
+    "CwdChanged",
+    "DirectoryAdded",
+    "Elicitation",
+    "ElicitationResult",
+    "FileChanged",
+    "InstructionsLoaded",
+    "MessageDisplay",
     "Notification",
+    "PermissionDenied",
+    "PermissionRequest",
+    "PostCompact",
+    "PostModelSwitch",
+    "PostToolBatch",
     "PostToolUse",
+    "PostToolUseFailure",
     "PreCompact",
+    "PreModelSwitch",
     "PreToolUse",
     "SessionEnd",
     "SessionStart",
+    "Setup",
     "Stop",
+    "StopFailure",
+    "SubagentStart",
     "SubagentStop",
+    "TaskCompleted",
+    "TaskCreated",
+    "TeammateIdle",
+    "UserPromptExpansion",
+    "UserPromptSubmit",
+    "WorktreeCreate",
+    "WorktreeRemove"
+  ],
+  "liveVerifiedHookEvents": [
+    "PostToolUse",
+    "SessionStart",
     "UserPromptSubmit"
   ],
   "enums": {

package/.claude/skills/cowork-harness/scripts/scenario.py

@@ -215,26 +215,49 @@ ASSERT_KEYS = _load_assert_keys()
 # reason the key lists are: a hand-copied served-set silently stops warning about the event it was later
 # extended to cover — the exact drift this check exists to prevent.
 _FALLBACK_SERVED_HOOK_EVENTS = {"PreToolUse"}
+# Re-sourced 2026-09-06 from the agent's OWN hooks-config validator array (ELF 2.1.260), not from a grep
+# for event-name constants. The previous 9-name set reported the other 24 -- PostCompact and
+# MessageDisplay among them -- identically to a misspelling, at ERROR severity below.
 _FALLBACK_KNOWN_HOOK_EVENTS = {
-    "PreToolUse", "PostToolUse", "UserPromptSubmit", "SessionStart",
-    "SessionEnd", "SubagentStop", "PreCompact", "Notification", "Stop",
+    "PreToolUse", "PostToolUse", "PostToolUseFailure", "PostToolBatch",
+    "Notification", "UserPromptSubmit", "UserPromptExpansion", "SessionStart",
+    "SessionEnd", "Stop", "StopFailure", "SubagentStart", "SubagentStop",
+    "PreCompact", "PostCompact", "PreModelSwitch", "PostModelSwitch",
+    "PermissionRequest", "PermissionDenied", "Setup", "TeammateIdle",
+    "TaskCreated", "TaskCompleted", "Elicitation", "ElicitationResult",
+    "ConfigChange", "WorktreeCreate", "WorktreeRemove", "InstructionsLoaded",
+    "CwdChanged", "FileChanged", "DirectoryAdded", "MessageDisplay",
 }
+# The subset a plugin hook has been OBSERVED to fire for here (live-verified 2026-08-01, container +
+# hostloop). Kept apart from the known set because the message wording depends on which claim we can
+# make: accepted-by-the-validator is not reached-by-a-run.
+_FALLBACK_LIVE_VERIFIED_HOOK_EVENTS = {"SessionStart", "UserPromptSubmit", "PostToolUse"}
 
 
 def _load_hook_events():
-    """(served, known) hook-event sets, from the generated assertion-keys.json sidecar."""
+    """(served, known, live-verified) hook-event sets, from the generated assertion-keys.json sidecar."""
     p = Path(__file__).resolve().parent / "assertion-keys.json"
     try:
         d = json.loads(p.read_text(encoding="utf-8"))
         served, known = set(d["servedHookEvents"]), set(d["knownHookEvents"])
+        # Tolerate a sidecar generated before liveVerifiedHookEvents existed: fall back rather than
+        # dropping to the embedded KNOWN set wholesale, which would undo the 33-name fix. Membership
+        # test, NOT truthiness: an explicitly EMPTY list means the firing receipt was withdrawn, and
+        # `or` would silently restore the 3-name claim -- widening a receipt, which is the one direction
+        # this constant exists to prevent.
+        live = set(d["liveVerifiedHookEvents"]) if "liveVerifiedHookEvents" in d else set(_FALLBACK_LIVE_VERIFIED_HOOK_EVENTS)
         if served and known:
-            return served, known
+            return served, known, live
     except Exception:
         pass
-    return set(_FALLBACK_SERVED_HOOK_EVENTS), set(_FALLBACK_KNOWN_HOOK_EVENTS)
+    return (
+        set(_FALLBACK_SERVED_HOOK_EVENTS),
+        set(_FALLBACK_KNOWN_HOOK_EVENTS),
+        set(_FALLBACK_LIVE_VERIFIED_HOOK_EVENTS),
+    )
 
 
-SERVED_HOOK_EVENTS, KNOWN_HOOK_EVENTS = _load_hook_events()
+SERVED_HOOK_EVENTS, KNOWN_HOOK_EVENTS, LIVE_VERIFIED_HOOK_EVENTS = _load_hook_events()
 
 # Self-check: every valid assertion key must be classified, else the replay-class lint logic mishandles it.
 # Surfaced loudly at load AND as a lint ERROR in cmd_lint (so --strict / exit codes flow). Never sys.exit here.
@@ -1489,15 +1512,17 @@ def _lint_hook_events(path):
     """Flag hook events a plugin DECLARES that this harness does not SERVE.
 
     Why this exists: the harness installs `PreToolUse` only, while real Cowork installs three event types
-    and the agent binary understands nine. A plugin declaring `UserPromptSubmit` therefore mounted, ran,
+    and the agent binary accepts thirty-three. A plugin declaring `UserPromptSubmit` therefore mounted, ran,
     and produced no comment of any kind — the surface was discoverable only by grepping the harness's own
     compiled output, which is exactly what one consumer had to do.
 
-    Deliberately WARN, not ERROR, and deliberately worded as uncertainty: a declared-but-unserved event is
-    not a *skill* defect, and the harness cannot currently prove the event never fires. It only knows it
-    adds no handling of its own — the agent binary loads a plugin's hooks.json through its own
-    `--plugin-dir` channel, which is a separate path the harness neither serves nor blocks and which has
-    not been probed. Claiming "this will not fire" would assert more than is known; claiming nothing
+    Severity is three-way and each level means something different. A name the agent's validator ACCEPTS
+    but this harness does not serve is INFO, not a skill defect: the agent loads a plugin's hooks.json
+    through its own `--plugin-dir` channel, which the harness neither serves nor blocks. Of those, only
+    the events in LIVE_VERIFIED_HOOK_EVENTS have been observed firing here, so the confident wording is
+    scoped to them and every other accepted name says so. A name the validator REJECTS is ERROR — that
+    one genuinely never runs on any surface. Claiming "this will not fire" for an accepted event would
+    assert more than is known; claiming nothing
     leaves the consumer to reverse-engineer it. So say precisely what is known.
     """
     findings = []
@@ -1533,17 +1558,25 @@ def _lint_hook_events(path):
             continue
         line_no = next((i for i, ln in enumerate(lines, 1) if f'"{name}"' in ln), 1)
         if name in KNOWN_HOOK_EVENTS:
+            fires = (
+                "fires here — a plugin's own `hooks/hooks.json` is loaded and executed by the agent "
+                "binary (live-verified at both `container` and `hostloop`)"
+                if name in LIVE_VERIFIED_HOOK_EVENTS
+                else "is a hook event the agent accepts, and it loads a plugin's own `hooks/hooks.json` "
+                     "itself — though whether a harness run ever reaches this event's trigger has not "
+                     "been verified here"
+            )
             findings.append(Finding(
                 "INFO", "hook-event-not-served",
-                f"`{name}` fires here — a plugin's own `hooks/hooks.json` is loaded and executed by the "
-                f"agent binary (live-verified at both `container` and `hostloop`) — but cowork-harness "
+                f"`{name}` {fires} — but cowork-harness "
                 f"itself installs only {', '.join(sorted(SERVED_HOOK_EVENTS))} on `initialize`. Two "
                 f"consequences: there is no assertion key for this event, so a scenario cannot GATE on it; "
-                f"and the harness does not reproduce the additional `{name}` hooks real Cowork installs, so "
-                f"anything driven by those is absent here.",
-                "Your hook still runs — this is about assertability, not breakage. To gate on its effect, "
-                "assert the OBSERVABLE result instead (a file it writes, a tool it blocks), not the hook "
-                "itself.",
+                f"and if real Cowork installs a `{name}` hook of its own, the harness does not reproduce it, "
+                f"so anything driven by that is absent here. (Cowork installs hooks of its own for "
+                f"PreToolUse, PostToolUse and UserPromptSubmit only.)",
+                "The harness does not block your hook — this is about assertability, not breakage. To gate "
+                "on its effect, assert the OBSERVABLE result instead (a file it writes, a tool it blocks), "
+                "not the hook itself.",
                 path, line_no,
             ))
         elif name.lower() in {e.lower() for e in KNOWN_HOOK_EVENTS}:
@@ -1558,8 +1591,8 @@ def _lint_hook_events(path):
         else:
             findings.append(Finding(
                 "ERROR", "hook-event-unknown",
-                f"`{name}` is not a recognized hook event — an unrecognized event name is ignored, so this "
-                f"hook would never run on any surface.",
+                f"`{name}` is not a hook event the agent recognizes — an unrecognized event name is "
+                f"ignored, so this hook would never run on any surface.",
                 f"Check spelling and capitalization. Valid events: {', '.join(sorted(KNOWN_HOOK_EVENTS))}.",
                 path, line_no,
             ))

package/CHANGELOG.md

@@ -6,6 +6,179 @@ All notable changes to this project are documented here. The format is based on
 
 ## [Unreleased]
 
+## [3.5.0] — 2026-09-06
+
+**Live verification for this release** (macOS arm64, agent **2.1.260**, agent image `cowork-agent-base:2`,
+Desktop 1.46388.4):
+
+| Suite | Result |
+|---|---|
+| `boundary-check` | **6/6** — host-fs-sealed, direct-egress-denied, allowlist-enforced, allowlist-permits, loopback-not-proxied, hostloop-bash-egress |
+| `npm run test:live` | **4 files, 18 passed, 1 skipped** — the skip is `live-outputs-delete`'s silent-guard case, which reports SKIPPED when the agent issues no Bash call (documented as expected-rare, not a failure) |
+| `run examples/scenarios/` | **7/7 success** across `container`, `hostloop` and `protocol` |
+| e2e self-tests | **8/8 success** — askuserquestion, multiselect, multiselect-deciderdir, l1-container, l1-egress, present-files, semantic-evidence-files, canary-hostloop |
+
+**Two things stated rather than glossed.** (a) The first `test:live` run showed one red — a sub-agent
+WebSearch that the model simply did not perform — and the first scenario batch showed one red on
+`example-pdf-skill`. Both were **model variance**: each passed on re-run with nothing changed, which is
+the disposition the tests themselves prescribe for this class. They are recorded because a suite that
+only ever reports its green run is not evidence of anything. (b) `smoke-l2-microvm` was **not run** this
+release. It is the ninth e2e scenario and the tier CI can never cover (Apple-VZ is macOS-arm64 only); the
+most recent microvm pass remains the one recorded under 3.4.0.
+
+### Added
+
+- **`liveVerifiedHookEvents` in the generated `assertion-keys.json` sidecar.** A new key alongside
+  `servedHookEvents` and `knownHookEvents`, naming the subset of hook events a plugin's own hook has
+  actually been **observed** to fire for in a harness run (three, live-verified at `container` and
+  `hostloop`). It exists so the linter can distinguish "the agent's validator accepts this name" from "a
+  run reaches this trigger" — two claims a single list would have conflated. Additive: a consumer reading
+  only the two existing keys is unaffected, and an older `scenario.py` ignores it.
+- **`test/hook-events-elf-parity.test.ts`** — re-extracts the hook-event list from the staged agent binary
+  at test time instead of comparing two hand-maintained files. It **skips where no Desktop is staged**, CI
+  included, and says so in its own header: a green CI is not evidence for this invariant.
+- **Two rows in [`docs/invariants.md`](./docs/invariants.md)**: the hook-event invariant below, and
+  `provenance.spawnEnvKeys` + `spawnEnvSpreadCount` as the spawn-env drift alarm. The latter documents
+  machinery that has existed since Desktop 1.24012.1 but appeared **zero times** outside `src/` — which is
+  why a later design exercise set about re-inventing it. [`docs/maintenance.md`](./docs/maintenance.md)
+  now tells a maintainer to read those two values in a `sync` diff first, and why a key-set delta beats a
+  count: it names the key.
+
+### Fixed
+
+- **`lint-skill` and the mount-time hook warning reported 24 valid hook events as misspellings.**
+  `KNOWN_HOOK_EVENTS` held **9** names, assembled by grepping the agent binary for event-name constants;
+  the agent's own hooks-config validator accepts **33**. A plugin declaring `PostCompact` or
+  `MessageDisplay` — both accepted by the agent, both of which run — got "not a recognized hook event …
+  Check spelling/capitalization", at **ERROR** severity in `lint-skill` and as a `::warning::` on the run
+  path. **The message text changed on both paths**, so a CI job grepping for the old strings needs
+  updating: the ERROR now reads "is not a hook event the agent recognizes", and an accepted-but-unserved
+  event reports at INFO / `::notice::` with the confident "it WILL fire" wording reserved for the three
+  events actually observed firing here. The list is now sourced from the validator array itself, and
+  `test/hook-events-elf-parity.test.ts` re-reads it from the staged agent binary rather than from a
+  committed fixture, because a fixture-vs-const test compares two hand-maintained files and only moves
+  when someone re-extracts by hand — the step that had failed. That test **skips where no Desktop is
+  staged**, CI included, so a green CI is not evidence for this invariant.
+- **The sub-agent model precedence was documented backwards in three places.** `docs/session.md`,
+  `docs/subagents.md` and `src/session.ts` stated `env > dispatch param > frontmatter > inherit`. The
+  binary resolves **dispatch param > frontmatter > env > inherit** (verified in agent 2.1.260; promoting
+  the env override to the top is what `CLAUDE_CODE_SUBAGENT_MODEL_FORCE` does, and the Cowork spawn sets
+  neither that flag nor `CLAUDE_CODE_COORDINATOR_FORCE_WORKER_INHERIT_MODEL`). So
+  `agent_env.subagent_model` does **not** outrank a sub-agent's own `model:` frontmatter, contrary to
+  what the docs promised.
+- **Two model-forcing env vars leaked asymmetrically into `hostloop` and `protocol`.**
+  `SCRUBBED_AGENT_ENV_KEYS` matches exact keys, so `CLAUDE_CODE_SUBAGENT_MODEL` never covered
+  `CLAUDE_CODE_SUBAGENT_MODEL_FORCE` or `CLAUDE_CODE_COORDINATOR_FORCE_WORKER_INHERIT_MODEL`. An
+  operator with either exported got different sub-agent model resolution on the two inheriting tiers than
+  on `container`/`microvm`, which is the asymmetry that constant exists to prevent. Both are now scrubbed.
+  **Operator-visible consequence, and the reason it is filed as a fix rather than a cleanup:** unlike the
+  three keys already on that list, these two have **no `agent_env` knob**, so exporting one in your shell
+  now has it silently deleted with nothing authored to put it back. `docs/session.md` says so. If you
+  need either, set it inside the run rather than in the environment the harness inherits. Real Cowork
+  sets neither. Companion tests drive the real `hostloop` and `protocol` env builders with each key set —
+  not a hand-built object — and pin the exact-key *mechanism*, plus the deliberate decision to leave
+  `CLAUDE_CODE_COORDINATOR_MODE` (which enables one of them, and leaks the same way) unscrubbed while no
+  coordinator surface is modelled.
+
+### Documentation
+
+- **Corrected what this repo says about Cowork's force-ask PreToolUse hook.** It gates **nine** tools,
+  not four (the four named ones plus `create`/`update`/`delete_scheduled_task` and
+  `start`/`stop_watching`), and its decision is **not** unconditional: two gate-conditioned early returns
+  defer to the auto-mode permission classifier, so in a real auto-mode session 7 of the 9 raise no
+  prompt. The scheduled-task branch ships in Desktop 1.22209.0 — before 1.24012.9, the first baseline to
+  record this hook — so the note in `spawn.hooks` was already wrong for 5 of the 9 tools when it was
+  first written; the second branch lands three baselines later at 1.26832.0, making it wrong for all
+  nine from there on. Inaccurate in all fourteen baselines carrying it, either way.
+  **Nothing about the harness changes**: auto mode is structurally unreachable here, so for every mode a
+  scenario can express production still answers `ask`, and serving that hook unconditionally would remain
+  faithful. Corrected in `desktop-1.46388.3` forward; the older baselines keep their wording.
+- **`spawn.hooks` is documented as hand-pinned documentation, not as a drift tripwire.** It cannot be
+  one — `sync` spreads `spawn` forward from the base baseline, so the field carries through untouched and
+  nothing re-derives it from the app bundle. The claim was disproved by its own subject, above.
+- **The desktop-local lane boundary is stated as a missing transport flag rather than an entrypoint
+  string.** `--sdk-url` is absent from the entire app bundle and present 41× in the agent, and the
+  `ccr-session` host resolver throws without it — so features routed through that host (including
+  `cowork_memory_context`) are *structurally* unreachable locally, not merely disabled. An entrypoint
+  test can be relaxed in one release; a flag Desktop never passes cannot be worked around agent-side.
+- **New fidelity note: the silent-turn reminder.** Whether the agent narrates between tool calls is
+  decided by a server-delivered model capability, and that narration lands in the corpus
+  `semantic_matches` grades — so an assertion resting on the presence or wording of inter-tool text rests
+  on something an account-level capability can change. Assert the observable result instead.
+- **New fidelity note: auto-memory is delivered through four env keys the harness never sets.** When a
+  session has an auto-memory directory, Desktop ships it to the agent as `CLAUDE_COWORK_MEMORY_PATH_OVERRIDE`,
+  `CLAUDE_COWORK_MEMORY_INDEX_CONTENT`, `CLAUDE_COWORK_MEMORY_EXTRA_GUIDELINES` and — separately gated —
+  `CLAUDE_COWORK_MEMORY_GUIDELINES`. The last two carry **prompt text**: the agent reads them into its
+  memory prompt, so this is model-visible content rather than configuration. With no memory directory the
+  same branch sends `CLAUDE_CODE_DISABLE_AUTO_MEMORY:"1"` instead. `docs/fidelity-gaps.md` now also
+  tabulates the **three distinct gates** involved, which are easy to conflate: the one keyed on the memory
+  *directory* is not the one governing the guidelines env key, and neither is the one that gates only the
+  resolver's third branch — so a session can get a memory directory with that third gate off.
+- **Corrected an overstated divergence in how the agent's credential reaches it.** A comment in
+  `src/runtime/host-env.ts` said real Cowork passes only `CLAUDE_CODE_OAUTH_TOKEN`, without scoping the
+  claim. Desktop does swap that env var for a file descriptor — staging the token into a `0600` temp file,
+  opening it, and unlinking it — but that wrapper is reached from the **host-loop branch only**. At
+  `container` and `microvm`, production passes the plain token exactly as this harness does. The comment
+  now records the host-loop-only scope and why the divergence is deliberately not emulated: the env var
+  remains a first-class credential source for the agent, Desktop's own helper falls back to it on I/O
+  failure, and no boundary is crossed at host-loop that was not already open.
+- **Release-channel facts added to the recovery runbook.** `/stable` is a rollout pointer, not "latest";
+  not every published version is served (2.1.255 is 404 on both channels while its neighbours are 200),
+  so **a 404 is not evidence of a wrong channel** — use a positive control on a neighbouring version; and
+  `manifest.zst.json` is served *beside* `manifest.json`, additive rather than a migration.
+
+### Changed
+
+- **Parity sync to Desktop 1.46388.4** (agent **2.1.260**, unmoved from 1.46388.3). Baseline
+  `desktop-1.46388.4` written with zero unknown deltas; the whole app-bundle delta is three build chunks.
+  Two gates newly pinned and both recorded `force`/ON: `builtinToolsApprovableByAutoMode:4202409342` (the
+  unpinned sibling of `scheduledTaskToolsApprovableByAutoMode`, and one of the two gates that release
+  tools from the force-ask hook) and `cuCanUseToolEnabled:2486083521`, which had moved `off` → `ON` while
+  unpinned. Gates deliberately left unpinned now carry their reasoning in `cowork-sync.ts` rather than
+  being silently absent. Committed cassettes re-stamped rather than re-recorded, on a field-level diff of the two baselines:
+  the entire delta is `appVersion`, `capturedAt`, the `$comment` date, `provenance.asarFingerprint`,
+  `provenance.fcache.embeddedTimestamp` and the two new gate rows. Nothing a replay depends on —
+  `spawn.env`, `spawn.hooks`, `permissionMode`, `agentBinary.sha256`, the egress allowlist, the mount
+  layout — moved at all.
+
+### Security
+
+- **Bumped the transitive `fast-uri` 3.1.5 → 3.1.7**, clearing four Dependabot high-severity advisories.
+  Lockfile only — no direct dependency changed and no runtime behaviour is affected.
+
+## [3.4.1] — 2026-09-05
+
+### Documentation
+
+- **Which Cowork *lane* the harness models is now stated, in the places a consumer reads.** Every
+  fidelity tier reproduces the desktop-local lane; Cowork's remote lane runs server-side in a cloud
+  container with a different filesystem, shell tool, delivery mechanism and a server-authored prompt.
+  Which lane a real session gets is a Cowork setting ("Only on this computer"), and it was observed
+  **off** on a current install. README, the companion skill, `docs/fidelity-gaps.md` and
+  `docs/maintenance.md` now say so. The distinction that matters: behaviour conclusions (triggering,
+  tool sequencing, gate handling) travel between lanes; anything asserting a **path, mount or delivery
+  mechanism** is a local-lane claim only. No remote tier is planned — that container is Anthropic's, so
+  emulating it would mean authoring an environment rather than reproducing one; `lane: remote` already
+  makes the affected assertions refuse to grade instead of passing.
+
+### Changed
+
+- **The sub-agent override sentinel's note now carries a current probe.** Gate `124685897` reads ON,
+  which only enables a server-delivered replacement of the `## Cowork environment` section. Re-probed
+  against the 1.46388.3 composition in a real host-loop session: all three composed parts arrived
+  byte-identical to the shipped fallback, so the gate is on with no payload. The two non-overridable
+  parts are the control that makes it conclusive. The note also states the probe's precondition, which
+  it previously lacked.
+
+### Verification
+
+- **`microvm` exercised after the 3.4.0 tag** — `smoke-l2-microvm` passed 3/3 against the *published*
+  3.4.0 artifact (real Apple-VZ VM, separate kernel; guest egress reached allowlisted
+  `api.anthropic.com` and denied an off-list telemetry host). That completes all four tiers for the
+  1.46388.3 baseline; DESIGN.md's scope note is re-stamped accordingly. The 3.4.0 entry below is left
+  as the record of what was verified at tag time. This tier is macOS-arm64 only and CI runners are
+  Linux, so it is only ever exercised by hand.
+
 ## [3.4.0] — 2026-09-05
 
 ### Upgrade notes

package/DESIGN.md

@@ -47,7 +47,7 @@ in how a file reaches the user, which is what changes skill behaviour: see
 [docs/scenario.md](./docs/scenario.md)'s `lane:` key for holding a run to either contract. The local lane:
 
 - VM bundle: `~/Library/Application Support/Claude/vm_bundles/claudevm.bundle/` (`rootfs.img`, `sessiondata.img`, `efivars.fd`, `machineIdentifier`, `gvisorMacAddress`, `vmIP`); a warm pool at `vm_bundles/warm/<sha>/`.
-- In-VM agent: `~/Library/Application Support/Claude/claude-code-vm/<ver>/claude` (currently **2.1.260**, per `baselines/desktop-1.46388.3.json`, an **ELF aarch64** binary), spawned by the host **in cowork mode via the `CLAUDE_CODE_IS_COWORK=1` env var** — *not* a `--cowork` flag (that flag is plugin-scope and the staged agent rejects it; see the control-protocol note below). Each baseline records this ELF's `sha256` (`agentBinary.sha256`/`shaProvenance`), and the resolver integrity-checks the binary it's about to run against that hash by default (opt out `COWORK_HARNESS_VERIFY_AGENT_SHA=0`), so "the same pinned agent" is enforced, not just asserted. Old versions are re-downloadable + verifiable from the official release channel — from the channel that baseline's `agentBinary.releaseBaseUrl` names, which is **not always the stable path** (Desktop stages release candidates too); the exact command is in `docs/maintenance.md`.
+- In-VM agent: `~/Library/Application Support/Claude/claude-code-vm/<ver>/claude` (currently **2.1.260**, per `baselines/desktop-1.46388.4.json`, an **ELF aarch64** binary), spawned by the host **in cowork mode via the `CLAUDE_CODE_IS_COWORK=1` env var** — *not* a `--cowork` flag (that flag is plugin-scope and the staged agent rejects it; see the control-protocol note below). Each baseline records this ELF's `sha256` (`agentBinary.sha256`/`shaProvenance`), and the resolver integrity-checks the binary it's about to run against that hash by default (opt out `COWORK_HARNESS_VERIFY_AGENT_SHA=0`), so "the same pinned agent" is enforced, not just asserted. Old versions are re-downloadable + verifiable from the official release channel — from the channel that baseline's `agentBinary.releaseBaseUrl` names, which is **not always the stable path** (Desktop stages release candidates too); the exact command is in `docs/maintenance.md`.
 - Network: `vm_network_mode: "gvisor"`, egress through a userspace netstack with a **compiled domain allowlist**; off-list partners rejected (`partner rejected: entry not on compiled allowlist`).
 - Control plane: Electron renderer→main typed IPC on channels named `$eipc_message$_<per-build-UUID>_$_claude.web_$_<Class>_$_<method>`, every handler validating `event.senderFrame.url` against a trusted-origin allowlist. The session manager is `LocalAgentModeSessions` (80 methods: `start`, `sendMessage`, `setDraftSessionFolders`, `onToolPermissionRequest`, `respondToToolPermission`, `getTranscript`, `onEvent`, …), bridged to the renderer as `window.cowork`.
 
@@ -176,7 +176,7 @@ The policy that produces those `allow`/`deny` responses is the **Decider** seam
 
 ### Control protocol — VERIFIED end-to-end against the live host CLI (macOS. The staged in-VM agent that L1/L2 run is **2.1.246**, the native host app that `hostloop` runs is **2.1.246**, baseline **`desktop-1.37937.1`** — a fresh live end-to-end pass across the `protocol`, `container`, and `hostloop` tiers was run against this baseline on 2026-08-26, superseding the prior `1.32885.1` pin. Scope and caveats of that pass are in the note directly below; read it before citing this heading.) The subsequent `desktop-1.20186.1` baseline is a patch-only Desktop release (egress allowlist, spawn config, and the Cowork system-prompt fingerprint unchanged from 1.20186.0; the staged VM ELF re-synced 2.1.202 → 2.1.205) — the live pass is deliberately not restamped onto it.
 
-> **Scope of that claim, stated plainly.** `2026-09-05 / desktop-1.46388.3` is the baseline carrying the latest **full live end-to-end pass**, and it is also the newest committed baseline — **no baselines have shipped since**, so nothing committed here is live-unverified for want of a newer run. The pass ran against agent **2.1.260** (the staged VM ELF and the native `.app` both at that version) on macOS arm64, agent image `cowork-agent-base:2`, and covered **four** suites: `boundary-check` **6/6** (host-fs-sealed, direct-egress-denied, allowlist-enforced, allowlist-permits, loopback-not-proxied, hostloop-bash-egress); `npm run test:live` **4 files, 19 passed, 0 skipped**; `run examples/scenarios/` **7/7 success, 39 assertions, 0 failed** (csv-fx-normalize, csv-metrics, example-pdf-skill, hostloop-computer-links, protocol-smoke, skill-loads, subagent-manifest-probe); and the e2e self-tests **8/8 success** (smoke-askuserquestion, smoke-multiselect, smoke-multiselect-deciderdir, smoke-l1-container, smoke-l1-egress, smoke-present-files, smoke-semantic-evidence-files, canary-hostloop). **Zero skips** in the live lane is the part worth stating: every `describe` there is `skipIf`-gated on Docker, the staged-binary version and the token, so a gated case reports as SKIPPED rather than passing vacuously — vitest reported none. Tiers exercised: **`protocol`, `container`, `hostloop`**. **`microvm` was NOT exercised** — it needs a real VM and CI excludes it for the same reason, so the ninth e2e scenario (`smoke-l2-microvm`) did not run. **Scope-out, so this is not read as more than it is.** (a) `subagent-manifest-probe` is new in this release and is the first live coverage the sub-agent append has ever had; it proves the composed append is ACTIONABLE — a sub-agent reaches the right files through both tool families, and a bare relative write lands at the host cwd — **not** that the harness's paraphrase matches Desktop's wording, which is the `manifest`/`suffix` fingerprint axes' job. (b) A live pass verifies observed behaviour, not the whole spawn contract by construction. (c) These suites are model-dependent, so a single red is evidence of model variance until a re-run says otherwise, not of a regression — which is why the gated cases skip loudly rather than fail. Separately and not a live matter: `example-pdf-skill` was re-recorded against this baseline and the other two committed cassettes were re-stamped (see the CHANGELOG for why each), so nothing in `examples/replays/` is stale against it. Re-stamp this paragraph, naming the baseline, whenever a live pass is actually re-run.
+> **Scope of that claim, stated plainly.** `2026-09-06 / desktop-1.46388.4` is the baseline carrying the latest **full live end-to-end pass**, and it is also the newest committed baseline — **no baselines have shipped since**, so nothing committed here is live-unverified for want of a newer run. The pass ran against agent **2.1.260** (the staged VM ELF and the native `.app` both at that version) on macOS arm64, agent image `cowork-agent-base:2`, and covered **four** suites: `boundary-check` **6/6** (host-fs-sealed, direct-egress-denied, allowlist-enforced, allowlist-permits, loopback-not-proxied, hostloop-bash-egress); `npm run test:live` **4 files, 18 passed, 1 skipped**; `run examples/scenarios/` **7/7 success** (csv-fx-normalize, csv-metrics, example-pdf-skill, hostloop-computer-links, protocol-smoke, skill-loads, subagent-manifest-probe); and the e2e self-tests **9/9 success** (smoke-askuserquestion, smoke-multiselect, smoke-multiselect-deciderdir, smoke-l1-container, smoke-l1-egress, smoke-present-files, smoke-semantic-evidence-files, canary-hostloop, smoke-l2-microvm). **Zero skips** in the live lane is the part worth stating: every `describe` there is `skipIf`-gated on Docker, the staged-binary version and the token, so a gated case reports as SKIPPED rather than passing vacuously — vitest reported none. Tiers exercised: **all four — `protocol`, `container`, `hostloop` and `microvm`.** The microvm case ran AFTER the 3.4.0 tag, against the published artifact rather than the checkout, and is recorded here rather than in that release's CHANGELOG entry, which states what was verified at tag time. It is the tier CI can never cover — GitHub's runners are Linux and Apple-VZ is macOS-arm64 only — so it is only ever exercised by hand here: `smoke-l2-microvm` passed 3/3 in a real VM with its own kernel, and its guest egress behaved (allowlisted `api.anthropic.com` reached, an off-list telemetry host denied). **Scope-out, so this is not read as more than it is.** (a) `subagent-manifest-probe` is new in this release and is the first live coverage the sub-agent append has ever had; it proves the composed append is ACTIONABLE — a sub-agent reaches the right files through both tool families, and a bare relative write lands at the host cwd — **not** that the harness's paraphrase matches Desktop's wording, which is the `manifest`/`suffix` fingerprint axes' job. (b) A live pass verifies observed behaviour, not the whole spawn contract by construction. (c) These suites are model-dependent, so a single red is evidence of model variance until a re-run says otherwise, not of a regression — which is why the gated cases skip loudly rather than fail. Separately and not a live matter: `example-pdf-skill` was re-recorded against this baseline and the other two committed cassettes were re-stamped (see the CHANGELOG for why each), so nothing in `examples/replays/` is stale against it. Re-stamp this paragraph, naming the baseline, whenever a live pass is actually re-run.
 
 > The staged agent ELF is unchanged (2.1.181) across the 1.14271.0→1.15200.0 asar bump, and 2.1.187 across the 1.15200.0→1.15962.0 bump. The live scenario suite (`protocol` + `container` tiers) was re-run against the 1.15200.0 baseline; the 1.15962.0 bump was verified via asar analysis (content byte-identical: host-loop generator, system prompt, identity string, gates, and egress domains all unchanged) plus a full local test suite pass. The 1.15962.1→1.17377.1 bump moved the staged agent to **2.1.197** and added `api.claude.ai` to the egress allowlist; re-verified via `sync` (no unknown deltas) plus a manual asar spot-check of the reconstructed prompt content (substantively unchanged — see the Parity entry in CHANGELOG.md) and a full live scenario-suite pass (`protocol` + `container` tiers).
 

package/README.md

@@ -36,7 +36,7 @@ npm ci && npm run build
 node dist/cli.js replay examples/replays/example-pdf-skill.cassette.json
 ```
 
-(Installing globally — `npm install -g "cowork-harness@^3.4.0"` — gives you the `cowork-harness` CLI for your own
+(Installing globally — `npm install -g "cowork-harness@^3.5.0"` — gives you the `cowork-harness` CLI for your own
 scenarios and cassettes; the bundled example above also replays from a global install — see the `$(npm root -g)` path below.)
 
 Full setup → [Quick start](./docs/cli.md#quick-start).
@@ -49,8 +49,8 @@ Three ways to use this project. Each row is the whole hook — follow the link f
 
 | I want to… | Start here | Needs |
 |---|---|---|
-| **Run scenarios myself** from a terminal | **[docs/cli.md](./docs/cli.md)**<br><br>`npm i -g "cowork-harness@^3.4.0"`<br>`cowork-harness replay examples/replays/example-pdf-skill.cassette.json` | Node ≥ 22. The replay demo above is token-free and needs nothing else; live tiers above `protocol` need Docker + a staged agent binary |
-| **Have Claude Code drive it** for me | **[docs/companion-skill.md](./docs/companion-skill.md)**<br><br>`/plugin marketplace add yaniv-golan/cowork-harness`<br>`/plugin install cowork-harness@cowork-harness` | Claude Code. The skill self-bootstraps the CLI via `npx "cowork-harness@^3.4.0"` |
+| **Run scenarios myself** from a terminal | **[docs/cli.md](./docs/cli.md)**<br><br>`npm i -g "cowork-harness@^3.5.0"`<br>`cowork-harness replay examples/replays/example-pdf-skill.cassette.json` | Node ≥ 22. The replay demo above is token-free and needs nothing else; live tiers above `protocol` need Docker + a staged agent binary |
+| **Have Claude Code drive it** for me | **[docs/companion-skill.md](./docs/companion-skill.md)**<br><br>`/plugin marketplace add yaniv-golan/cowork-harness`<br>`/plugin install cowork-harness@cowork-harness` | Claude Code. The skill self-bootstraps the CLI via `npx "cowork-harness@^3.5.0"` |
 | **Gate my skill in CI** | **[docs/ci.md](./docs/ci.md)**<br><br>`- uses: yaniv-golan/cowork-harness@v3`<br>`  with: { command: replay, path: cassettes/ }` | Nothing for the token-free gate; the live lane needs a self-hosted runner with Docker + an agent binary |
 
 Not sure a harness is what you need? The next two sections are the argument.
@@ -215,6 +215,32 @@ L2  microvm parity    Optional. Agent inside a real Linux microVM (Lima/Apple-VZ
                       synced baseline. "Do what real Cowork does."
 ```
 
+### Which Cowork *lane* this models — read this before trusting an environment assertion
+
+Every tier above reproduces Cowork's **desktop-local lane**: the agent runs on your machine, shell
+commands land in a Linux sandbox rooted at `/sessions/<id>`, attached folders appear under
+`/sessions/<id>/mnt/<name>`, and finished files reach the user through `present_files`.
+
+Cowork also has a **remote lane**, where the session runs server-side in an ephemeral cloud container
+that reaches your machine over a link. There the filesystem, the shell tool, and file delivery are all
+different — folders arrive under `$HOME/mnt/`, deliverables go to `/mnt/user-data/outputs/` and are
+handed over with `SendUserFile`, and the environment prompt is authored by the server rather than by
+Desktop. **Which lane you get is a Cowork setting** ("Only on this computer", Settings → Cowork), and
+it has been observed **off** — i.e. remote — on a current install.
+
+The harness **cannot execute the remote lane**: that container is Anthropic's, not something a local
+tool can stand up. What it does instead is refuse to fake it. Declare `lane: remote` on a scenario and
+the assertions that depend on observing a local filesystem degrade honestly — `file_absent` reports
+evidence-unavailable rather than passing, and delivery is reported as unobservable — so a green never
+means more than it should.
+
+**What this means for you.** Behaviour-shaped conclusions travel between lanes: whether your skill
+triggers, how it sequences tools, which questions it asks, whether it respects a permission gate.
+Environment-shaped conclusions do not: anything asserting a path, a mount, or a delivery mechanism is a
+statement about the **local** lane specifically. Scope your claims accordingly, and if you are probing
+real Cowork to compare, turn "Only on this computer" **on** first or you will be measuring a lane this
+tool does not model.
+
 **Decision guide** — `fidelity:` takes exactly one of these five values (`protocol`/`container`/`microvm` vary isolation strength; `hostloop`/`cowork` are overlays that instead pick *where the loop runs* — there's no combining the two groups):
 
 | Question | Choose |
@@ -281,6 +307,7 @@ See [DESIGN.md](./DESIGN.md) for the full parity matrix, the known deltas vs. re
 
 ## Limitations
 
+- **One lane, deliberately.** Every tier models Cowork's desktop-local lane. The remote (cloud) lane runs server-side with a different filesystem, shell tool, delivery mechanism and a server-authored prompt; no tier reproduces it, and `lane: remote` exists to make the resulting blind spots refuse to grade rather than pass. See [Which Cowork lane this models](#which-cowork-lane-this-models--read-this-before-trusting-an-environment-assertion).
 - **Not the full Desktop network transport.** L1 is a container, not a VM; L2 *is* a real Apple-VZ microVM but still does not reproduce Cowork's gVisor netstack — its egress is the same allowlist proxy as L1 (with a guest iptables firewall in front). If your skill depends on VM-kernel specifics, validate at L2; if it depends on packet-level gVisor behavior, no tier reproduces it.
 - **Cowork in-guest context is partial.** Desktop supplies host-loop staging, runtime `mountPath` RPC, and the bridge. We reproduce the *filesystem and cowork mode*, not those host-side services. Skills that call Desktop-only host RPCs won't run here (they wouldn't be portable anyway).
 - **The agent binary is the staged ELF** (`claude-code-vm/<ver>/claude`), **bind-mounted** from your own Claude Desktop install — nothing Anthropic-owned is bundled or installed. There is **no npm path**; override the path with `COWORK_AGENT_BINARY`. Check licensing/ToS for your use.
@@ -353,6 +380,6 @@ inputs/outputs. Human-readable terminal text is explicitly **not** part of the c
 ## Status
 
 The latest shipped baseline — what `baseline: latest` resolves to (`cowork-harness list`) — is
-**`desktop-1.46388.3`**. Release-by-release verification notes (what was re-verified against
+**`desktop-1.46388.4`**. Release-by-release verification notes (what was re-verified against
 which live agent/asar) are recorded in [CHANGELOG.md](./CHANGELOG.md); the feature catalogue
 this section would otherwise duplicate lives in the sections above.