cowork-harness 3.4.1 → 3.6.0

package/.claude/skills/cowork-harness/SKILL.md

@@ -3,8 +3,8 @@ name: cowork-harness
 description: Test or debug a Claude Code skill/plugin under Claude Cowork's runtime — sandboxed agent, default-deny egress, the can_use_tool permission/question protocol — using the cowork-harness CLI. Use when validating or regression-testing a skill, authoring or debugging a scenario YAML (prompt + scripted answers + assert:), choosing a fidelity tier, scripting AskUserQuestion / tool-permission answers, or asserting artifacts, egress, or sub-agent dispatch. Especially when a harness run no-ops an assertion, fails on an unanswered gate, false-greens, a steered answer never reaches the model, or a web_fetch is unexpectedly denied or gated. Also when iterating or hardening a skill across fixes, or grounding a skill's self-critique against its own run evidence — including a document-analysis skill (cap table, deck, financial model, transcript) that needs an uploaded file attached to be critiqued at all. NOT for generic unit testing (pytest/vitest of your own scripts) or non-Cowork CI. Covers the skill / run / chat / record / replay / trace / decide / assertions / scaffold commands and the session-vs-scenario split.
 metadata:
   author: cowork-harness
-  version: 3.4.1
-  tracks-harness: cowork-harness 3.4.1 (baseline desktop-1.46388.3)
+  version: 3.6.0
+  tracks-harness: cowork-harness 3.6.0 (baseline desktop-2.2553.1)
 ---
 
 # cowork-harness
@@ -25,8 +25,8 @@ flagged with a loud `::warning::`, not silent — auto-answer a gate, observe an
 allowlist). This skill exists mostly to keep you out of those traps — the Gotchas section below is
 the highest-value part. Read it.
 
-> **Version note:** the facts and `file:line` pointers here track `cowork-harness 3.4.1` (baseline
-> `desktop-1.46388.3`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
+> **Version note:** the facts and `file:line` pointers here track `cowork-harness 3.6.0` (baseline
+> `desktop-2.2553.1`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
 > `SPEC.md` / `docs/*.md` over this snapshot, and re-run the bundled linter.
 
 ## Preflight — make sure the harness can actually run
@@ -42,7 +42,7 @@ Before the first command, confirm the CLI is reachable and **fail loud** (never
 
 - **One-shot check.** Run `cowork-harness doctor [--tier <tier>]` first — a read-only prerequisite check that inspects Docker, the staged agent, the token, and the baseline in one pass. The bullets below explain each thing it checks (and how to fix it).
 - **Replay-only? Skip `doctor`.** Replaying committed cassettes needs no Docker, no staged agent, and no token — and every tier's `doctor` validates the auth token (the live tiers also Docker + the staged agent), so a ✗ there is expected, not a blocker. Go straight to `cowork-harness replay <cassette>`.
-- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 3.4.1**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@^3.4.1" <cmd>` (Node ≥ 22), or install once with `npm i -g "cowork-harness@^3.4.1"`. **Pin `@^3.4.1`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
+- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 3.6.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@^3.6.0" <cmd>` (Node ≥ 22), or install once with `npm i -g "cowork-harness@^3.6.0"`. **Pin `@^3.6.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
 
   This skill documents the CURRENT surface, not release history. If `cowork-harness --version` is
   OLDER than the floor, the per-release record of what you are missing is [CHANGELOG.md](https://github.com/yaniv-golan/cowork-harness/blob/main/CHANGELOG.md)

package/.claude/skills/cowork-harness/references/ci-recipe.md

@@ -1,6 +1,6 @@
 # CI recipe — replay vs live lanes
 
-Self-contained reference. Tracks `cowork-harness 3.4.1` (baseline `desktop-1.46388.3`).
+Self-contained reference. Tracks `cowork-harness 3.6.0` (baseline `desktop-2.2553.1`).
 
 **Fastest path: the packaged Action.** One step gets you `replay`/`lint`/`verify-cassettes` plus a PR
 job-summary reporter (verdict table, staleness findings, cost/turns when available):
@@ -17,7 +17,7 @@ job-summary reporter (verdict table, staleness findings, cost/turns when availab
 CLI major reaches your workflow the moment it is promoted even though your `uses:` ref never changed — so a
 copy-pasted recipe that omits the input takes a major bump with no say in it. `^2` holds the major, needs no
 patch number to remember, and only wants a human decision at the next major. Pin an exact version
-(e.g. `version: "3.4.1"`) instead when you want byte-reproducible CI.
+(e.g. `version: "3.6.0"`) instead when you want byte-reproducible CI.
 
 Reach for the manual multi-step form below only when you need per-step control the Action's inputs don't
 cover (a custom flag combination, a different runner matrix per step, or `lint`/`verify-cassettes` gated
@@ -36,7 +36,7 @@ jobs:
       - uses: actions/checkout@v4
       - name: Stage the agent binary (official channel, sha256-verified against the pinned baseline)
         run: |
-          V=2.1.260   # match your scenario's pinned baseline's agentVersion
+          V=2.1.275   # match your scenario's pinned baseline's agentVersion
           # The release channel is NOT always the stable one. Desktop also stages release CANDIDATES,
           # served only from .../claude-code-releases/rc/<commit>/ — the stable path 404s for those, and
           # 2.1.255 is one. Take B from your pinned baseline's agentBinary.releaseBaseUrl; baselines
@@ -73,7 +73,7 @@ sha256-*checked* but not hard-blocking on mismatch — it's advisory for an inte
 GitHub-hosted runners, no token/Docker/agent:
 
 ```yaml
-- run: npm i -g "cowork-harness@^3.4.1"
+- run: npm i -g "cowork-harness@^3.6.0"
 - run: cowork-harness lint scenarios/*.yaml --strict --min-severity WARN
                                                     # no silent false-greens. WITHOUT --strict this
                                                     # step cannot fail on a WARN-class rule (e.g.
@@ -350,7 +350,7 @@ jobs:
         with: { node-version: '24' }
       - uses: actions/setup-python@v5
         with: { python-version: '3.x' }                                       # python3 only — PyYAML is bundled with the linter
-      - run: npm i -g "cowork-harness@^3.4.1"
+      - run: npm i -g "cowork-harness@^3.6.0"
       - run: cowork-harness lint scenarios/*.yaml                              # no-silent-false-green (needs python3; PyYAML bundled)
       - run: cowork-harness verify-cassettes cassettes/ --output-format json   # privacy + staleness gate
       - run: cowork-harness replay cassettes/ --output-format json             # token-free content/structure
@@ -379,7 +379,7 @@ jobs:
             echo "live=true" >> "$GITHUB_OUTPUT"
           fi
       - if: steps.guard.outputs.live == 'true'
-        run: npm i -g "cowork-harness@^3.4.1"
+        run: npm i -g "cowork-harness@^3.6.0"
       - if: steps.guard.outputs.live == 'true'
         run: cowork-harness run scenarios/ --output-format json
         env:

package/.claude/skills/cowork-harness/references/critique.md

@@ -1,6 +1,6 @@
 # Critique — the facts a plugin install can't otherwise reach
 
-Tracks `cowork-harness 3.4.1` (baseline `desktop-1.46388.3`). This is **not** a trim of the full
+Tracks `cowork-harness 3.6.0` (baseline `desktop-2.2553.1`). This is **not** a trim of the full
 [`docs/critique.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/critique.md) (repo-only —
 flags, cost, reproduction discipline, known limitations all live there). This file covers exactly what a
 plugin install cannot otherwise discover: the run-dir artifact a harvester actually reads, the report's

package/.claude/skills/cowork-harness/references/fidelity-and-answers.md

@@ -1,6 +1,6 @@
 # Fidelity tiers & answer paths
 
-Self-contained reference. Tracks `cowork-harness 3.4.1` (baseline `desktop-1.46388.3`).
+Self-contained reference. Tracks `cowork-harness 3.6.0` (baseline `desktop-2.2553.1`).
 
 ## Fidelity tiers (`fidelity:` in the scenario)
 

package/.claude/skills/cowork-harness/references/scenario-schema.md

@@ -1,7 +1,7 @@
 # Scenario & session schema, assertion catalog, web_fetch, authoring gotchas
 
-Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 3.4.1`
-(baseline `desktop-1.46388.3`). If your checkout is newer, prefer the live [`docs/scenario.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/scenario.md),
+Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 3.6.0`
+(baseline `desktop-2.2553.1`). If your checkout is newer, prefer the live [`docs/scenario.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/scenario.md),
 [`docs/session.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/session.md), and `SPEC.md`.
 
 **Minimal scenario** — `prompt` is the only required field:

package/.claude/skills/cowork-harness/references/task-recipes.md

@@ -2,7 +2,7 @@
 
 Each recipe composes facts that live scattered across SKILL.md and the other references into one
 decision path. Every one answers a question a real fleet owner had to work out the hard way.
-Tracks `cowork-harness 3.4.1` (baseline `desktop-1.46388.3`), same as SKILL.md's front-matter. Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
+Tracks `cowork-harness 3.6.0` (baseline `desktop-2.2553.1`), same as SKILL.md's front-matter. Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
 Recipe 3's `init-redact` shipped in 0.24.0 and are part of the current feature set — no version gate
 needed if your CLI meets SKILL.md's version floor.
 

package/.claude/skills/cowork-harness/scripts/assertion-keys.json

@@ -113,14 +113,43 @@
     "PreToolUse"
   ],
   "knownHookEvents": [
+    "ConfigChange",
+    "CwdChanged",
+    "DirectoryAdded",
+    "Elicitation",
+    "ElicitationResult",
+    "FileChanged",
+    "InstructionsLoaded",
+    "MessageDisplay",
     "Notification",
+    "PermissionDenied",
+    "PermissionRequest",
+    "PostCompact",
+    "PostModelSwitch",
+    "PostToolBatch",
     "PostToolUse",
+    "PostToolUseFailure",
     "PreCompact",
+    "PreModelSwitch",
     "PreToolUse",
     "SessionEnd",
     "SessionStart",
+    "Setup",
     "Stop",
+    "StopFailure",
+    "SubagentStart",
     "SubagentStop",
+    "TaskCompleted",
+    "TaskCreated",
+    "TeammateIdle",
+    "UserPromptExpansion",
+    "UserPromptSubmit",
+    "WorktreeCreate",
+    "WorktreeRemove"
+  ],
+  "liveVerifiedHookEvents": [
+    "PostToolUse",
+    "SessionStart",
     "UserPromptSubmit"
   ],
   "enums": {

package/.claude/skills/cowork-harness/scripts/scenario.py

@@ -215,26 +215,49 @@ ASSERT_KEYS = _load_assert_keys()
 # reason the key lists are: a hand-copied served-set silently stops warning about the event it was later
 # extended to cover — the exact drift this check exists to prevent.
 _FALLBACK_SERVED_HOOK_EVENTS = {"PreToolUse"}
+# Re-sourced 2026-09-06 from the agent's OWN hooks-config validator array (ELF 2.1.260), not from a grep
+# for event-name constants. The previous 9-name set reported the other 24 -- PostCompact and
+# MessageDisplay among them -- identically to a misspelling, at ERROR severity below.
 _FALLBACK_KNOWN_HOOK_EVENTS = {
-    "PreToolUse", "PostToolUse", "UserPromptSubmit", "SessionStart",
-    "SessionEnd", "SubagentStop", "PreCompact", "Notification", "Stop",
+    "PreToolUse", "PostToolUse", "PostToolUseFailure", "PostToolBatch",
+    "Notification", "UserPromptSubmit", "UserPromptExpansion", "SessionStart",
+    "SessionEnd", "Stop", "StopFailure", "SubagentStart", "SubagentStop",
+    "PreCompact", "PostCompact", "PreModelSwitch", "PostModelSwitch",
+    "PermissionRequest", "PermissionDenied", "Setup", "TeammateIdle",
+    "TaskCreated", "TaskCompleted", "Elicitation", "ElicitationResult",
+    "ConfigChange", "WorktreeCreate", "WorktreeRemove", "InstructionsLoaded",
+    "CwdChanged", "FileChanged", "DirectoryAdded", "MessageDisplay",
 }
+# The subset a plugin hook has been OBSERVED to fire for here (live-verified 2026-08-01, container +
+# hostloop). Kept apart from the known set because the message wording depends on which claim we can
+# make: accepted-by-the-validator is not reached-by-a-run.
+_FALLBACK_LIVE_VERIFIED_HOOK_EVENTS = {"SessionStart", "UserPromptSubmit", "PostToolUse"}
 
 
 def _load_hook_events():
-    """(served, known) hook-event sets, from the generated assertion-keys.json sidecar."""
+    """(served, known, live-verified) hook-event sets, from the generated assertion-keys.json sidecar."""
     p = Path(__file__).resolve().parent / "assertion-keys.json"
     try:
         d = json.loads(p.read_text(encoding="utf-8"))
         served, known = set(d["servedHookEvents"]), set(d["knownHookEvents"])
+        # Tolerate a sidecar generated before liveVerifiedHookEvents existed: fall back rather than
+        # dropping to the embedded KNOWN set wholesale, which would undo the 33-name fix. Membership
+        # test, NOT truthiness: an explicitly EMPTY list means the firing receipt was withdrawn, and
+        # `or` would silently restore the 3-name claim -- widening a receipt, which is the one direction
+        # this constant exists to prevent.
+        live = set(d["liveVerifiedHookEvents"]) if "liveVerifiedHookEvents" in d else set(_FALLBACK_LIVE_VERIFIED_HOOK_EVENTS)
         if served and known:
-            return served, known
+            return served, known, live
     except Exception:
         pass
-    return set(_FALLBACK_SERVED_HOOK_EVENTS), set(_FALLBACK_KNOWN_HOOK_EVENTS)
+    return (
+        set(_FALLBACK_SERVED_HOOK_EVENTS),
+        set(_FALLBACK_KNOWN_HOOK_EVENTS),
+        set(_FALLBACK_LIVE_VERIFIED_HOOK_EVENTS),
+    )
 
 
-SERVED_HOOK_EVENTS, KNOWN_HOOK_EVENTS = _load_hook_events()
+SERVED_HOOK_EVENTS, KNOWN_HOOK_EVENTS, LIVE_VERIFIED_HOOK_EVENTS = _load_hook_events()
 
 # Self-check: every valid assertion key must be classified, else the replay-class lint logic mishandles it.
 # Surfaced loudly at load AND as a lint ERROR in cmd_lint (so --strict / exit codes flow). Never sys.exit here.
@@ -1489,15 +1512,17 @@ def _lint_hook_events(path):
     """Flag hook events a plugin DECLARES that this harness does not SERVE.
 
     Why this exists: the harness installs `PreToolUse` only, while real Cowork installs three event types
-    and the agent binary understands nine. A plugin declaring `UserPromptSubmit` therefore mounted, ran,
+    and the agent binary accepts thirty-three. A plugin declaring `UserPromptSubmit` therefore mounted, ran,
     and produced no comment of any kind — the surface was discoverable only by grepping the harness's own
     compiled output, which is exactly what one consumer had to do.
 
-    Deliberately WARN, not ERROR, and deliberately worded as uncertainty: a declared-but-unserved event is
-    not a *skill* defect, and the harness cannot currently prove the event never fires. It only knows it
-    adds no handling of its own — the agent binary loads a plugin's hooks.json through its own
-    `--plugin-dir` channel, which is a separate path the harness neither serves nor blocks and which has
-    not been probed. Claiming "this will not fire" would assert more than is known; claiming nothing
+    Severity is three-way and each level means something different. A name the agent's validator ACCEPTS
+    but this harness does not serve is INFO, not a skill defect: the agent loads a plugin's hooks.json
+    through its own `--plugin-dir` channel, which the harness neither serves nor blocks. Of those, only
+    the events in LIVE_VERIFIED_HOOK_EVENTS have been observed firing here, so the confident wording is
+    scoped to them and every other accepted name says so. A name the validator REJECTS is ERROR — that
+    one genuinely never runs on any surface. Claiming "this will not fire" for an accepted event would
+    assert more than is known; claiming nothing
     leaves the consumer to reverse-engineer it. So say precisely what is known.
     """
     findings = []
@@ -1533,17 +1558,25 @@ def _lint_hook_events(path):
             continue
         line_no = next((i for i, ln in enumerate(lines, 1) if f'"{name}"' in ln), 1)
         if name in KNOWN_HOOK_EVENTS:
+            fires = (
+                "fires here — a plugin's own `hooks/hooks.json` is loaded and executed by the agent "
+                "binary (live-verified at both `container` and `hostloop`)"
+                if name in LIVE_VERIFIED_HOOK_EVENTS
+                else "is a hook event the agent accepts, and it loads a plugin's own `hooks/hooks.json` "
+                     "itself — though whether a harness run ever reaches this event's trigger has not "
+                     "been verified here"
+            )
             findings.append(Finding(
                 "INFO", "hook-event-not-served",
-                f"`{name}` fires here — a plugin's own `hooks/hooks.json` is loaded and executed by the "
-                f"agent binary (live-verified at both `container` and `hostloop`) — but cowork-harness "
+                f"`{name}` {fires} — but cowork-harness "
                 f"itself installs only {', '.join(sorted(SERVED_HOOK_EVENTS))} on `initialize`. Two "
                 f"consequences: there is no assertion key for this event, so a scenario cannot GATE on it; "
-                f"and the harness does not reproduce the additional `{name}` hooks real Cowork installs, so "
-                f"anything driven by those is absent here.",
-                "Your hook still runs — this is about assertability, not breakage. To gate on its effect, "
-                "assert the OBSERVABLE result instead (a file it writes, a tool it blocks), not the hook "
-                "itself.",
+                f"and if real Cowork installs a `{name}` hook of its own, the harness does not reproduce it, "
+                f"so anything driven by that is absent here. (Cowork installs hooks of its own for "
+                f"PreToolUse, PostToolUse and UserPromptSubmit only.)",
+                "The harness does not block your hook — this is about assertability, not breakage. To gate "
+                "on its effect, assert the OBSERVABLE result instead (a file it writes, a tool it blocks), "
+                "not the hook itself.",
                 path, line_no,
             ))
         elif name.lower() in {e.lower() for e in KNOWN_HOOK_EVENTS}:
@@ -1558,8 +1591,8 @@ def _lint_hook_events(path):
         else:
             findings.append(Finding(
                 "ERROR", "hook-event-unknown",
-                f"`{name}` is not a recognized hook event — an unrecognized event name is ignored, so this "
-                f"hook would never run on any surface.",
+                f"`{name}` is not a hook event the agent recognizes — an unrecognized event name is "
+                f"ignored, so this hook would never run on any surface.",
                 f"Check spelling and capitalization. Valid events: {', '.join(sorted(KNOWN_HOOK_EVENTS))}.",
                 path, line_no,
             ))

package/CHANGELOG.md

@@ -6,6 +6,252 @@ All notable changes to this project are documented here. The format is based on
 
 ## [Unreleased]
 
+## [3.6.0] — 2026-09-18
+
+### Upgrade notes
+
+- **If you run against Claude Desktop 2.2553.1 (agent 2.1.275), upgrade — `critique` and `--decider-llm`
+  are broken on 3.5.0 there.** That agent makes an auxiliary Haiku call in `-p` mode, and 3.5.0's LLM
+  transport hard-fails on the two-model envelope it produces (`critique` exits 2 with no error text).
+  3.6.0 identifies the primary model instead of counting keys. Nothing changes on older agents.
+- **`latest` now resolves to `desktop-2.2553.1`.** A cassette you recorded against `1.46388.4` with
+  `baseline: latest` reports `baseline` staleness on replay (warn by default; `--strict` fails). Re-record
+  it, or pin the scenario to `desktop-1.46388.4` if you are not ready to move.
+- **The spawned agent's env gains `CLAUDE_CODE_DESKTOP_APP_VERSION`** on baselines from 2.2553.1 on. It
+  is the value the agent uses for the `anthropic-client-version` request header; older baselines are
+  unaffected. If you snapshot the spawn env, expect the new key.
+- **Every `-p` call and every run on agent 2.1.275 now carries a ~$0.001 Haiku entry** in `modelUsage`
+  and in the run result's cost. Cost comparisons across the 2.1.260→2.1.275 bump will show it — it is
+  the agent's spend, not the harness's.
+
+### Added
+- **Parity: baseline `desktop-2.2553.1` (agent 2.1.275)** — the first `2.x` Claude Desktop. `sync` refused
+  to write with **10 unknown deltas**; all are resolved and the baseline is clean. Two of the ten turned
+  out to be defects in this repo's own extractor rather than changes in Desktop:
+  - **The S6c Artifact-gate flag was a false alarm.** The frame-artifacts predicate is byte-identical; it
+    merely stopped being its own statement (it now shares a declaration with the Artifact host-grant
+    binding). The sentinel's value capture ran past the top-level comma and swallowed the sibling binding,
+    so an anchored whole-expression match rejected an unchanged predicate — and the message it printed
+    ("cached-arm/HIPAA/trailing-term change") was simply wrong. The value is now sliced brace/paren/quote
+    aware to the first top-level `,` or `;`. Both directions are pinned by tests: the sibling-binding shape
+    stays clean, and a real widening hidden before the comma still fires.
+  - **The path-gate tool set and path keys were refactored, not removed.** Desktop replaced two array
+    literals with one tool→path-key map plus `Object.keys` / `[...new Set(Object.values(…))]` derivations,
+    which accounted for 4 of the 10 deltas at once. Same five tools, same two keys — no contract change.
+    The extractor now accepts either form. The map is matched **exactly and in order**, because
+    `Object.keys` order reaches the sub-agent prompt through `.join(", ")` while the manifest fingerprint
+    hashes generator source — a reordered map would otherwise change what the model reads with every check
+    still green. Keys and values must resolve to the *same* map, and an ambiguous binding flags rather than
+    taking the first match: the bundle carries two more same-shaped maps that add Bash/NotebookEdit/MultiEdit.
+
+- **`npm run check:claims` — a staleness report for this repo's "binary-verified" claims.** It lists every
+  version-stamped claim in `src/`, `scripts/` and `docs/` that is behind the currently pinned agent and
+  `app.asar` versions. First run: **42 of 49 claims behind the pin**, the oldest about 34 baselines back.
+  It **exits 0 by design and is not a gate** — a stale stamp is not a wrong claim, and hard-failing would
+  force a version bump every sync that anyone could satisfy by editing the digit without re-reading the
+  binary. Maintainers get it as step 3b of the parity-sync ritual; contributors need not run it.
+- **`test/subagent-model-precedence-elf.test.ts`** — pins the sub-agent model resolution order against the
+  agent binary itself, so the precedence corrected in 3.5.0 cannot silently drift back. It reads the
+  binary's own telemetry labels rather than a minified symbol (the gate accessor beside that code renamed
+  between two Desktop patch builds). Its second assertion is **not** gated on a staged binary: it fails if
+  `docs/session.md`, `docs/subagents.md` or `src/session.ts` reintroduces the reversed order, which is the
+  half CI can enforce and the way that claim went wrong in three places at once.
+
+**Why these two:** the repo carries ~49 version-stamped claims about the agent binary and,
+before 3.5.0, exactly one was re-derived from the binary by a test. Both claims spot-checked during that
+release turned out wrong — the hook-event list and the model precedence. Two for two is not a sample that
+justifies leaving the rest unexamined, but it also does not justify pretending a report verifies them: it
+shows the population and its age, and a human decides what to re-read.
+
+### Fixed
+
+- **The LLM decider transport no longer hard-fails on agent 2.1.275's two-model envelope.** The agent that
+  ships with Desktop 2.2553.1 makes an auxiliary Haiku call in `-p` mode, so `claude -p --output-format json`
+  now reports two `modelUsage` keys where 2.1.260 reported one — measured with the same prompt and flags
+  against both native binaries. The transport asserted exactly one key, which turned **every** critique
+  evaluator pass and every `--decider-llm` gate into an instrument failure on the new agent (`critique`
+  exited 2 with no error text; found by the live lane, which had this test gated off in the previous pass).
+  The primary model is now *identified* as the key that resolves the requested `--model` (exact id, or the
+  id carrying a floating alias like `sonnet` as a dash-separated segment) rather than *assumed* from the
+  count. Zero or several keys resolving the request still fails closed — that ambiguity is the contract
+  break the check exists to catch. The whole usage map is still passed through, so the auxiliary call's
+  cost is not lost.
+- **The spawned agent now sends the client-identity headers production sends.** Desktop 2.2553.1 sets
+  `CLAUDE_CODE_DESKTOP_APP_VERSION` unconditionally on first-party sessions, and the agent reads it on the
+  `local-agent` entrypoint — which the harness pins — as the fallback source of the `anthropic-client-version`
+  header (its companion `anthropic-client-platform` is the hard-coded literal `desktop_app`) whenever
+  `ANTHROPIC_CUSTOM_HEADERS` carries none, which is the harness's case. The key is host-derived (an Electron `app.getVersion()` call), so it is allowlisted in the sync
+  **and** injected from the baseline's `appVersion` in both the container and native spawn envs — **version-gated** to baselines from 2.2553.1 on, since injecting it on an older baseline would hand the agent a key that baseline's Desktop never set (not symmetric with `CLAUDE_CODE_HOST_PLATFORM`, which every asar on record sets). Allowlisting
+  it alone would have been silent: the allowlist is consulted before the pin list and the key is not
+  required, so the harness would simply have stopped sending those headers with nothing failing.
+- **`CLAUDE_ARTIFACT_HOST_GRANT` is guarded, not merely allowlisted.** The new key is allowlisted on the
+  grounds that a default session never receives it — a claim that rests entirely on its guard. A new
+  sentinel requires it to stay gated on the *same* predicate as the Artifact tool spread, and fires if it
+  is ever constructed unconditionally or re-keyed. (The existing frame-artifacts assertion could not reach
+  it: the two spreads have different shapes.)
+- **`CLAUDE_CODE_DISABLE_CRON` gained a second disjunct** (a managed-settings scheduled-tasks switch). The
+  pinned value is unchanged at `"1"`, and it is *earned* rather than assumed — the spawn window still passes
+  `disableCron:!0`, which short-circuits. The resolver and its anchor admit the new shape; the disjunct is
+  not inert in general, only under that short-circuit.
+
+### Changed
+
+
+- `CLAUDE_CODE_MODEL_CATALOG` (new, third-party-only branch) is allowlisted, matching the standing rule for
+  third-party-only keys.
+- **`design` added to the host-inventory scan's known-built-in skill roster.** It surfaced as a finding on
+  the first fresh `container` recording after this sync, on a cassette whose scenario declares no skills.
+  It qualifies under the roster's existing three criteria: the recording was sealed (`container`, so
+  `HOME=/tmp` and no host `~/.claude`), `"design"` is a bare literal in both the staged agent ELF and the
+  host CLI, and five personal skill names from the same machine are absent from that binary. It is not new
+  to this agent — the `design-consent` / `design-revoke` slash commands were already in the previously
+  shipped cassette; what changed is that the feature now also registers in `skills[]`, an axis the scan
+  treats more strictly.
+- **All three committed cassettes in `examples/replays/` are re-recorded against `desktop-2.2553.1`**, each reporting no behavioural change versus the recording it replaced. The `protocol` fixture was recorded on the hermetic managed config dir (`ANTHROPIC_API_KEY` path) and the `container` one in a sealed container; `verify-cassettes` reports zero host-inventory findings on all three.
+- **A full live pass was run against `desktop-2.2553.1` / agent 2.1.275**, all four suites and all four tiers: `boundary-check` 6/6; e2e self-tests 9/9 including `smoke-l2-microvm` in a real VM and `smoke-multiselect-deciderdir` through the `--decider-llm` path; `npm run test:live` 19 tests, 18 passed, 1 failed, **0 skipped** (the previous pass had one skip — the hostloop `critique` case — which this pass exercised for the first time and which found the transport defect fixed above); `run examples/scenarios/` 7/7. The one live red is a pre-existing `live-matrix` case on old baselines where the model sometimes answers as text instead of calling `AskUserQuestion` — model variance, re-run and flipped, logged for hardening.
+- **`test/model-provenance.test.ts`'s pre-coverage-note test now builds its own fixture.** Every committed cassette now carries `model` coverage, so no shipped fixture emits the note the test reads. Rather than asserting the note's shape only when one happens to be present — a test that could not fail — it rewrites a real cassette's session fingerprint to the pre-`model` hash in a temp tree that preserves the relative session layout.
+
+
+## [3.5.0] — 2026-09-06
+
+**Live verification for this release** (macOS arm64, agent **2.1.260**, agent image `cowork-agent-base:2`,
+Desktop 1.46388.4):
+
+| Suite | Result |
+|---|---|
+| `boundary-check` | **6/6** — host-fs-sealed, direct-egress-denied, allowlist-enforced, allowlist-permits, loopback-not-proxied, hostloop-bash-egress |
+| `npm run test:live` | **4 files, 18 passed, 1 skipped** — the skip is `live-outputs-delete`'s silent-guard case, which reports SKIPPED when the agent issues no Bash call (documented as expected-rare, not a failure) |
+| `run examples/scenarios/` | **7/7 success** across `container`, `hostloop` and `protocol` |
+| e2e self-tests | **8/8 success** — askuserquestion, multiselect, multiselect-deciderdir, l1-container, l1-egress, present-files, semantic-evidence-files, canary-hostloop |
+
+**Two things stated rather than glossed.** (a) The first `test:live` run showed one red — a sub-agent
+WebSearch that the model simply did not perform — and the first scenario batch showed one red on
+`example-pdf-skill`. Both were **model variance**: each passed on re-run with nothing changed, which is
+the disposition the tests themselves prescribe for this class. They are recorded because a suite that
+only ever reports its green run is not evidence of anything. (b) `smoke-l2-microvm` was **not run** this
+release. It is the ninth e2e scenario and the tier CI can never cover (Apple-VZ is macOS-arm64 only); the
+most recent microvm pass remains the one recorded under 3.4.0.
+
+### Added
+
+- **`liveVerifiedHookEvents` in the generated `assertion-keys.json` sidecar.** A new key alongside
+  `servedHookEvents` and `knownHookEvents`, naming the subset of hook events a plugin's own hook has
+  actually been **observed** to fire for in a harness run (three, live-verified at `container` and
+  `hostloop`). It exists so the linter can distinguish "the agent's validator accepts this name" from "a
+  run reaches this trigger" — two claims a single list would have conflated. Additive: a consumer reading
+  only the two existing keys is unaffected, and an older `scenario.py` ignores it.
+- **`test/hook-events-elf-parity.test.ts`** — re-extracts the hook-event list from the staged agent binary
+  at test time instead of comparing two hand-maintained files. It **skips where no Desktop is staged**, CI
+  included, and says so in its own header: a green CI is not evidence for this invariant.
+- **Two rows in [`docs/invariants.md`](./docs/invariants.md)**: the hook-event invariant below, and
+  `provenance.spawnEnvKeys` + `spawnEnvSpreadCount` as the spawn-env drift alarm. The latter documents
+  machinery that has existed since Desktop 1.24012.1 but appeared **zero times** outside `src/` — which is
+  why a later design exercise set about re-inventing it. [`docs/maintenance.md`](./docs/maintenance.md)
+  now tells a maintainer to read those two values in a `sync` diff first, and why a key-set delta beats a
+  count: it names the key.
+
+### Fixed
+
+- **`lint-skill` and the mount-time hook warning reported 24 valid hook events as misspellings.**
+  `KNOWN_HOOK_EVENTS` held **9** names, assembled by grepping the agent binary for event-name constants;
+  the agent's own hooks-config validator accepts **33**. A plugin declaring `PostCompact` or
+  `MessageDisplay` — both accepted by the agent, both of which run — got "not a recognized hook event …
+  Check spelling/capitalization", at **ERROR** severity in `lint-skill` and as a `::warning::` on the run
+  path. **The message text changed on both paths**, so a CI job grepping for the old strings needs
+  updating: the ERROR now reads "is not a hook event the agent recognizes", and an accepted-but-unserved
+  event reports at INFO / `::notice::` with the confident "it WILL fire" wording reserved for the three
+  events actually observed firing here. The list is now sourced from the validator array itself, and
+  `test/hook-events-elf-parity.test.ts` re-reads it from the staged agent binary rather than from a
+  committed fixture, because a fixture-vs-const test compares two hand-maintained files and only moves
+  when someone re-extracts by hand — the step that had failed. That test **skips where no Desktop is
+  staged**, CI included, so a green CI is not evidence for this invariant.
+- **The sub-agent model precedence was documented backwards in three places.** `docs/session.md`,
+  `docs/subagents.md` and `src/session.ts` stated `env > dispatch param > frontmatter > inherit`. The
+  binary resolves **dispatch param > frontmatter > env > inherit** (verified in agent 2.1.260; promoting
+  the env override to the top is what `CLAUDE_CODE_SUBAGENT_MODEL_FORCE` does, and the Cowork spawn sets
+  neither that flag nor `CLAUDE_CODE_COORDINATOR_FORCE_WORKER_INHERIT_MODEL`). So
+  `agent_env.subagent_model` does **not** outrank a sub-agent's own `model:` frontmatter, contrary to
+  what the docs promised.
+- **Two model-forcing env vars leaked asymmetrically into `hostloop` and `protocol`.**
+  `SCRUBBED_AGENT_ENV_KEYS` matches exact keys, so `CLAUDE_CODE_SUBAGENT_MODEL` never covered
+  `CLAUDE_CODE_SUBAGENT_MODEL_FORCE` or `CLAUDE_CODE_COORDINATOR_FORCE_WORKER_INHERIT_MODEL`. An
+  operator with either exported got different sub-agent model resolution on the two inheriting tiers than
+  on `container`/`microvm`, which is the asymmetry that constant exists to prevent. Both are now scrubbed.
+  **Operator-visible consequence, and the reason it is filed as a fix rather than a cleanup:** unlike the
+  three keys already on that list, these two have **no `agent_env` knob**, so exporting one in your shell
+  now has it silently deleted with nothing authored to put it back. `docs/session.md` says so. If you
+  need either, set it inside the run rather than in the environment the harness inherits. Real Cowork
+  sets neither. Companion tests drive the real `hostloop` and `protocol` env builders with each key set —
+  not a hand-built object — and pin the exact-key *mechanism*, plus the deliberate decision to leave
+  `CLAUDE_CODE_COORDINATOR_MODE` (which enables one of them, and leaks the same way) unscrubbed while no
+  coordinator surface is modelled.
+
+### Documentation
+
+- **Corrected what this repo says about Cowork's force-ask PreToolUse hook.** It gates **nine** tools,
+  not four (the four named ones plus `create`/`update`/`delete_scheduled_task` and
+  `start`/`stop_watching`), and its decision is **not** unconditional: two gate-conditioned early returns
+  defer to the auto-mode permission classifier, so in a real auto-mode session 7 of the 9 raise no
+  prompt. The scheduled-task branch ships in Desktop 1.22209.0 — before 1.24012.9, the first baseline to
+  record this hook — so the note in `spawn.hooks` was already wrong for 5 of the 9 tools when it was
+  first written; the second branch lands three baselines later at 1.26832.0, making it wrong for all
+  nine from there on. Inaccurate in all fourteen baselines carrying it, either way.
+  **Nothing about the harness changes**: auto mode is structurally unreachable here, so for every mode a
+  scenario can express production still answers `ask`, and serving that hook unconditionally would remain
+  faithful. Corrected in `desktop-1.46388.3` forward; the older baselines keep their wording.
+- **`spawn.hooks` is documented as hand-pinned documentation, not as a drift tripwire.** It cannot be
+  one — `sync` spreads `spawn` forward from the base baseline, so the field carries through untouched and
+  nothing re-derives it from the app bundle. The claim was disproved by its own subject, above.
+- **The desktop-local lane boundary is stated as a missing transport flag rather than an entrypoint
+  string.** `--sdk-url` is absent from the entire app bundle and present 41× in the agent, and the
+  `ccr-session` host resolver throws without it — so features routed through that host (including
+  `cowork_memory_context`) are *structurally* unreachable locally, not merely disabled. An entrypoint
+  test can be relaxed in one release; a flag Desktop never passes cannot be worked around agent-side.
+- **New fidelity note: the silent-turn reminder.** Whether the agent narrates between tool calls is
+  decided by a server-delivered model capability, and that narration lands in the corpus
+  `semantic_matches` grades — so an assertion resting on the presence or wording of inter-tool text rests
+  on something an account-level capability can change. Assert the observable result instead.
+- **New fidelity note: auto-memory is delivered through four env keys the harness never sets.** When a
+  session has an auto-memory directory, Desktop ships it to the agent as `CLAUDE_COWORK_MEMORY_PATH_OVERRIDE`,
+  `CLAUDE_COWORK_MEMORY_INDEX_CONTENT`, `CLAUDE_COWORK_MEMORY_EXTRA_GUIDELINES` and — separately gated —
+  `CLAUDE_COWORK_MEMORY_GUIDELINES`. The last two carry **prompt text**: the agent reads them into its
+  memory prompt, so this is model-visible content rather than configuration. With no memory directory the
+  same branch sends `CLAUDE_CODE_DISABLE_AUTO_MEMORY:"1"` instead. `docs/fidelity-gaps.md` now also
+  tabulates the **three distinct gates** involved, which are easy to conflate: the one keyed on the memory
+  *directory* is not the one governing the guidelines env key, and neither is the one that gates only the
+  resolver's third branch — so a session can get a memory directory with that third gate off.
+- **Corrected an overstated divergence in how the agent's credential reaches it.** A comment in
+  `src/runtime/host-env.ts` said real Cowork passes only `CLAUDE_CODE_OAUTH_TOKEN`, without scoping the
+  claim. Desktop does swap that env var for a file descriptor — staging the token into a `0600` temp file,
+  opening it, and unlinking it — but that wrapper is reached from the **host-loop branch only**. At
+  `container` and `microvm`, production passes the plain token exactly as this harness does. The comment
+  now records the host-loop-only scope and why the divergence is deliberately not emulated: the env var
+  remains a first-class credential source for the agent, Desktop's own helper falls back to it on I/O
+  failure, and no boundary is crossed at host-loop that was not already open.
+- **Release-channel facts added to the recovery runbook.** `/stable` is a rollout pointer, not "latest";
+  not every published version is served (2.1.255 is 404 on both channels while its neighbours are 200),
+  so **a 404 is not evidence of a wrong channel** — use a positive control on a neighbouring version; and
+  `manifest.zst.json` is served *beside* `manifest.json`, additive rather than a migration.
+
+### Changed
+
+- **Parity sync to Desktop 1.46388.4** (agent **2.1.260**, unmoved from 1.46388.3). Baseline
+  `desktop-1.46388.4` written with zero unknown deltas; the whole app-bundle delta is three build chunks.
+  Two gates newly pinned and both recorded `force`/ON: `builtinToolsApprovableByAutoMode:4202409342` (the
+  unpinned sibling of `scheduledTaskToolsApprovableByAutoMode`, and one of the two gates that release
+  tools from the force-ask hook) and `cuCanUseToolEnabled:2486083521`, which had moved `off` → `ON` while
+  unpinned. Gates deliberately left unpinned now carry their reasoning in `cowork-sync.ts` rather than
+  being silently absent. Committed cassettes re-stamped rather than re-recorded, on a field-level diff of the two baselines:
+  the entire delta is `appVersion`, `capturedAt`, the `$comment` date, `provenance.asarFingerprint`,
+  `provenance.fcache.embeddedTimestamp` and the two new gate rows. Nothing a replay depends on —
+  `spawn.env`, `spawn.hooks`, `permissionMode`, `agentBinary.sha256`, the egress allowlist, the mount
+  layout — moved at all.
+
+### Security
+
+- **Bumped the transitive `fast-uri` 3.1.5 → 3.1.7**, clearing four Dependabot high-severity advisories.
+  Lockfile only — no direct dependency changed and no runtime behaviour is affected.
+
 ## [3.4.1] — 2026-09-05
 
 ### Documentation

package/DESIGN.md

@@ -47,7 +47,7 @@ in how a file reaches the user, which is what changes skill behaviour: see
 [docs/scenario.md](./docs/scenario.md)'s `lane:` key for holding a run to either contract. The local lane:
 
 - VM bundle: `~/Library/Application Support/Claude/vm_bundles/claudevm.bundle/` (`rootfs.img`, `sessiondata.img`, `efivars.fd`, `machineIdentifier`, `gvisorMacAddress`, `vmIP`); a warm pool at `vm_bundles/warm/<sha>/`.
-- In-VM agent: `~/Library/Application Support/Claude/claude-code-vm/<ver>/claude` (currently **2.1.260**, per `baselines/desktop-1.46388.3.json`, an **ELF aarch64** binary), spawned by the host **in cowork mode via the `CLAUDE_CODE_IS_COWORK=1` env var** — *not* a `--cowork` flag (that flag is plugin-scope and the staged agent rejects it; see the control-protocol note below). Each baseline records this ELF's `sha256` (`agentBinary.sha256`/`shaProvenance`), and the resolver integrity-checks the binary it's about to run against that hash by default (opt out `COWORK_HARNESS_VERIFY_AGENT_SHA=0`), so "the same pinned agent" is enforced, not just asserted. Old versions are re-downloadable + verifiable from the official release channel — from the channel that baseline's `agentBinary.releaseBaseUrl` names, which is **not always the stable path** (Desktop stages release candidates too); the exact command is in `docs/maintenance.md`.
+- In-VM agent: `~/Library/Application Support/Claude/claude-code-vm/<ver>/claude` (currently **2.1.275**, per `baselines/desktop-2.2553.1.json`, an **ELF aarch64** binary), spawned by the host **in cowork mode via the `CLAUDE_CODE_IS_COWORK=1` env var** — *not* a `--cowork` flag (that flag is plugin-scope and the staged agent rejects it; see the control-protocol note below). Each baseline records this ELF's `sha256` (`agentBinary.sha256`/`shaProvenance`), and the resolver integrity-checks the binary it's about to run against that hash by default (opt out `COWORK_HARNESS_VERIFY_AGENT_SHA=0`), so "the same pinned agent" is enforced, not just asserted. Old versions are re-downloadable + verifiable from the official release channel — from the channel that baseline's `agentBinary.releaseBaseUrl` names, which is **not always the stable path** (Desktop stages release candidates too); the exact command is in `docs/maintenance.md`.
 - Network: `vm_network_mode: "gvisor"`, egress through a userspace netstack with a **compiled domain allowlist**; off-list partners rejected (`partner rejected: entry not on compiled allowlist`).
 - Control plane: Electron renderer→main typed IPC on channels named `$eipc_message$_<per-build-UUID>_$_claude.web_$_<Class>_$_<method>`, every handler validating `event.senderFrame.url` against a trusted-origin allowlist. The session manager is `LocalAgentModeSessions` (80 methods: `start`, `sendMessage`, `setDraftSessionFolders`, `onToolPermissionRequest`, `respondToToolPermission`, `getTranscript`, `onEvent`, …), bridged to the renderer as `window.cowork`.
 
@@ -174,9 +174,9 @@ The policy that produces those `allow`/`deny` responses is the **Decider** seam
 
 > **Machine-readable form:** the five shapes below are schema'd as `schema/protocol.v1.json`, with a golden vector pack at `fixtures/protocol/v1/` — see [docs/protocol.md](./docs/protocol.md) for scope, versioning, and how to conformance-test against them.
 
-### Control protocol — VERIFIED end-to-end against the live host CLI (macOS. The staged in-VM agent that L1/L2 run is **2.1.246**, the native host app that `hostloop` runs is **2.1.246**, baseline **`desktop-1.37937.1`** — a fresh live end-to-end pass across the `protocol`, `container`, and `hostloop` tiers was run against this baseline on 2026-08-26, superseding the prior `1.32885.1` pin. Scope and caveats of that pass are in the note directly below; read it before citing this heading.) The subsequent `desktop-1.20186.1` baseline is a patch-only Desktop release (egress allowlist, spawn config, and the Cowork system-prompt fingerprint unchanged from 1.20186.0; the staged VM ELF re-synced 2.1.202 → 2.1.205) — the live pass is deliberately not restamped onto it.
+### Control protocol — VERIFIED end-to-end against the live host CLI (macOS. **This heading deliberately carries no version or baseline figures**: it used to restate the agent version and baseline of the last live pass, and those went stale independently of the note below it — at one point naming three different agent versions across two adjacent sentences. The note directly below is the single authority for which baseline and agent were actually exercised, and what the pass did and did not cover. Read it before citing this heading.) The subsequent `desktop-1.20186.1` baseline is a patch-only Desktop release (egress allowlist, spawn config, and the Cowork system-prompt fingerprint unchanged from 1.20186.0; the staged VM ELF re-synced 2.1.202 → 2.1.205) — the live pass is deliberately not restamped onto it.
 
-> **Scope of that claim, stated plainly.** `2026-09-05 / desktop-1.46388.3` is the baseline carrying the latest **full live end-to-end pass**, and it is also the newest committed baseline — **no baselines have shipped since**, so nothing committed here is live-unverified for want of a newer run. The pass ran against agent **2.1.260** (the staged VM ELF and the native `.app` both at that version) on macOS arm64, agent image `cowork-agent-base:2`, and covered **four** suites: `boundary-check` **6/6** (host-fs-sealed, direct-egress-denied, allowlist-enforced, allowlist-permits, loopback-not-proxied, hostloop-bash-egress); `npm run test:live` **4 files, 19 passed, 0 skipped**; `run examples/scenarios/` **7/7 success, 39 assertions, 0 failed** (csv-fx-normalize, csv-metrics, example-pdf-skill, hostloop-computer-links, protocol-smoke, skill-loads, subagent-manifest-probe); and the e2e self-tests **9/9 success** (smoke-askuserquestion, smoke-multiselect, smoke-multiselect-deciderdir, smoke-l1-container, smoke-l1-egress, smoke-present-files, smoke-semantic-evidence-files, canary-hostloop, smoke-l2-microvm). **Zero skips** in the live lane is the part worth stating: every `describe` there is `skipIf`-gated on Docker, the staged-binary version and the token, so a gated case reports as SKIPPED rather than passing vacuously — vitest reported none. Tiers exercised: **all four — `protocol`, `container`, `hostloop` and `microvm`.** The microvm case ran AFTER the 3.4.0 tag, against the published artifact rather than the checkout, and is recorded here rather than in that release's CHANGELOG entry, which states what was verified at tag time. It is the tier CI can never cover — GitHub's runners are Linux and Apple-VZ is macOS-arm64 only — so it is only ever exercised by hand here: `smoke-l2-microvm` passed 3/3 in a real VM with its own kernel, and its guest egress behaved (allowlisted `api.anthropic.com` reached, an off-list telemetry host denied). **Scope-out, so this is not read as more than it is.** (a) `subagent-manifest-probe` is new in this release and is the first live coverage the sub-agent append has ever had; it proves the composed append is ACTIONABLE — a sub-agent reaches the right files through both tool families, and a bare relative write lands at the host cwd — **not** that the harness's paraphrase matches Desktop's wording, which is the `manifest`/`suffix` fingerprint axes' job. (b) A live pass verifies observed behaviour, not the whole spawn contract by construction. (c) These suites are model-dependent, so a single red is evidence of model variance until a re-run says otherwise, not of a regression — which is why the gated cases skip loudly rather than fail. Separately and not a live matter: `example-pdf-skill` was re-recorded against this baseline and the other two committed cassettes were re-stamped (see the CHANGELOG for why each), so nothing in `examples/replays/` is stale against it. Re-stamp this paragraph, naming the baseline, whenever a live pass is actually re-run.
+> **Scope of that claim.** `2026-09-18 / desktop-2.2553.1` is the baseline carrying the latest live pass, and it is also the newest committed baseline — **no baselines have shipped since**, so nothing committed here is live-unverified for want of a newer run. The pass ran against agent **2.1.275** (the staged VM ELF and the native `.app` both at that version) on macOS arm64, agent image `cowork-agent-base:2`. It covered **all four** suites: `boundary-check` **6/6** (host-fs-sealed, direct-egress-denied, allowlist-enforced, allowlist-permits, loopback-not-proxied, hostloop-bash-egress); `npm run test:live` **4 files, 19 tests — 18 passed, 1 failed, 0 skipped** (the fail is `live-matrix`'s 2-cell baseline-axis case on the OLD baselines 1.17377.2/1.18286.0, where `claude-opus-4-8` sometimes answers the prompt's question as text instead of calling `AskUserQuestion`; it passed 2 of 4 attempts on the 1.18286.0 cell and never wavered on the other — model variance on a test that predates this sync, logged for hardening); and `run examples/scenarios/` **7/7 success** on its first run (csv-fx-normalize, csv-metrics, example-pdf-skill, hostloop-computer-links, protocol-smoke, skill-loads, subagent-manifest-probe), then **6/7** on an accidental second run where `subagent-manifest-probe`'s sub-agent chose an absolute host path outside the connected folders and the hostloop path gate correctly denied it — the gate working as production does, on a model choice. and the e2e self-tests **9/9 success** (canary-hostloop, smoke-askuserquestion, smoke-l1-container, smoke-l1-egress, smoke-l2-microvm, smoke-multiselect-deciderdir, smoke-multiselect, smoke-present-files, smoke-semantic-evidence-files) — `smoke-multiselect-deciderdir` runs the `--decider-llm` path, so it is live confirmation that the transport fix holds there as well as in `critique`. **Zero skips** in the live lane is the part worth stating: every `describe` there is `skipIf`-gated on Docker, the staged-binary version and the token, so a gated case reports as SKIPPED rather than passing vacuously — and the previous pass HAD one skip, the hostloop `critique` case, which this pass exercised for the first time and which found a real defect (the LLM decider transport hard-failed on agent 2.1.275's two-model `-p` envelope; fixed in this release). Tiers exercised: **all four — `protocol`, `container`, `hostloop` and `microvm`** (`smoke-l2-microvm` passed in a real VM with its own kernel, 151.9s). **Scope-out, so this is not read as more than it is.** (a) A live pass verifies observed behaviour, not the whole spawn contract by construction. (b) These suites are model-dependent, so a single red is evidence of model variance until a re-run says otherwise — both reds above were re-run and both flipped. (c) `run examples/scenarios/` was accidentally run twice; the first run is the one counted, and the second's single red is described above for what it is. Separately and not a live matter: all three committed cassettes in `examples/replays/` were re-recorded against `desktop-2.2553.1` on 2026-09-18 (each reporting "no behavioural change — transcript wording only" versus the recording it replaced); the `protocol` fixture on the hermetic managed config dir and the `container` one in a sealed container; `verify-cassettes` reports `privacyScanned:true` and zero host-inventory findings on all three. Re-stamp this paragraph, naming the baseline, whenever a live pass is actually re-run.
 
 > The staged agent ELF is unchanged (2.1.181) across the 1.14271.0→1.15200.0 asar bump, and 2.1.187 across the 1.15200.0→1.15962.0 bump. The live scenario suite (`protocol` + `container` tiers) was re-run against the 1.15200.0 baseline; the 1.15962.0 bump was verified via asar analysis (content byte-identical: host-loop generator, system prompt, identity string, gates, and egress domains all unchanged) plus a full local test suite pass. The 1.15962.1→1.17377.1 bump moved the staged agent to **2.1.197** and added `api.claude.ai` to the egress allowlist; re-verified via `sync` (no unknown deltas) plus a manual asar spot-check of the reconstructed prompt content (substantively unchanged — see the Parity entry in CHANGELOG.md) and a full live scenario-suite pass (`protocol` + `container` tiers).