cowork-harness 3.6.0 → 3.8.0

package/.claude/skills/cowork-harness/SKILL.md

@@ -3,8 +3,8 @@ name: cowork-harness
 description: Test or debug a Claude Code skill/plugin under Claude Cowork's runtime — sandboxed agent, default-deny egress, the can_use_tool permission/question protocol — using the cowork-harness CLI. Use when validating or regression-testing a skill, authoring or debugging a scenario YAML (prompt + scripted answers + assert:), choosing a fidelity tier, scripting AskUserQuestion / tool-permission answers, or asserting artifacts, egress, or sub-agent dispatch. Especially when a harness run no-ops an assertion, fails on an unanswered gate, false-greens, a steered answer never reaches the model, or a web_fetch is unexpectedly denied or gated. Also when iterating or hardening a skill across fixes, or grounding a skill's self-critique against its own run evidence — including a document-analysis skill (cap table, deck, financial model, transcript) that needs an uploaded file attached to be critiqued at all. NOT for generic unit testing (pytest/vitest of your own scripts) or non-Cowork CI. Covers the skill / run / chat / record / replay / trace / decide / assertions / scaffold commands and the session-vs-scenario split.
 metadata:
   author: cowork-harness
-  version: 3.6.0
-  tracks-harness: cowork-harness 3.6.0 (baseline desktop-2.2553.1)
+  version: 3.8.0
+  tracks-harness: cowork-harness 3.8.0 (baseline desktop-2.7032.0)
 ---
 
 # cowork-harness
@@ -25,8 +25,8 @@ flagged with a loud `::warning::`, not silent — auto-answer a gate, observe an
 allowlist). This skill exists mostly to keep you out of those traps — the Gotchas section below is
 the highest-value part. Read it.
 
-> **Version note:** the facts and `file:line` pointers here track `cowork-harness 3.6.0` (baseline
-> `desktop-2.2553.1`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
+> **Version note:** the facts and `file:line` pointers here track `cowork-harness 3.8.0` (baseline
+> `desktop-2.7032.0`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
 > `SPEC.md` / `docs/*.md` over this snapshot, and re-run the bundled linter.
 
 ## Preflight — make sure the harness can actually run
@@ -42,7 +42,7 @@ Before the first command, confirm the CLI is reachable and **fail loud** (never
 
 - **One-shot check.** Run `cowork-harness doctor [--tier <tier>]` first — a read-only prerequisite check that inspects Docker, the staged agent, the token, and the baseline in one pass. The bullets below explain each thing it checks (and how to fix it).
 - **Replay-only? Skip `doctor`.** Replaying committed cassettes needs no Docker, no staged agent, and no token — and every tier's `doctor` validates the auth token (the live tiers also Docker + the staged agent), so a ✗ there is expected, not a blocker. Go straight to `cowork-harness replay <cassette>`.
-- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 3.6.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@^3.6.0" <cmd>` (Node ≥ 22), or install once with `npm i -g "cowork-harness@^3.6.0"`. **Pin `@^3.6.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
+- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 3.8.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@^3.8.0" <cmd>` (Node ≥ 22), or install once with `npm i -g "cowork-harness@^3.8.0"`. **Pin `@^3.8.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
 
   This skill documents the CURRENT surface, not release history. If `cowork-harness --version` is
   OLDER than the floor, the per-release record of what you are missing is [CHANGELOG.md](https://github.com/yaniv-golan/cowork-harness/blob/main/CHANGELOG.md)
@@ -81,7 +81,7 @@ CI-grade scenario, and the post-hoc debug loop; the rest are narrower tools that
   correct answers after you edit it?) → author `semantic_matches` scenarios and gate on the per-claim
   profile. See **Recipe 5** in `references/task-recipes.md` (validity, N≥3, discrimination — the traps).
 - **"What is WRONG with this skill?"** (a graded critique, not a pass/fail) → `cowork-harness critique
-  <folder> --prompt "<probe>"`. Four model workloads and 10–20 minutes; budget from
+  <folder> --prompt "<probe>"`. Up to four model workloads (zero with `--corpus-only`; pass 2 is skipped with no self-report) and 10–20 minutes; budget from
   `report.costUsd.totalUsd`. Reach for it when you want **findings**. **For "what does this skill
   **DO**" — routing, artifact location, narration — use `skill` instead**: no evaluator, a fraction of
   the cost, and it answers that question directly. Report and evidence-package shapes:
@@ -568,7 +568,9 @@ Recognize these before "fixing" a non-bug:
 - **`missing_capability`** — the lean `core` agent image is a deliberate partial mirror of real Cowork's
   rootfs, so a skill that used `soffice`/LibreOffice (`office_convert`), `tesseract` (`ocr`),
   `markitdown`/`magika` (`ml_extract`), `cv2` (`cv`), `camelot`/`tabula` (`pdf_tables`), or `wand`
-  (`magick`) can trip this even though real Cowork **ships** those. The message says so ("likely a FALSE
+  (`magick`) can trip this even though real Cowork **ships** those (per the rootfs manifest captured at
+  Desktop `2.7032.0` — `baselines/provisioning/rootfs-provisioning.json`, which is the dated evidence
+  behind that sentence). The message says so ("likely a FALSE
   NEGATIVE (real Cowork ships them)"). Fix: rebuild full parity (`--build-arg COWORK_FULL_PARITY=1`, point
   `COWORK_AGENT_IMAGE` at it), or — if the skill's fallback is genuinely equivalent — assert
   `allow_missing_capability: true`. (Two sources: a skill *observed using* an omitted family, live lane;

package/.claude/skills/cowork-harness/references/ci-recipe.md

@@ -1,6 +1,6 @@
 # CI recipe — replay vs live lanes
 
-Self-contained reference. Tracks `cowork-harness 3.6.0` (baseline `desktop-2.2553.1`).
+Self-contained reference. Tracks `cowork-harness 3.8.0` (baseline `desktop-2.7032.0`).
 
 **Fastest path: the packaged Action.** One step gets you `replay`/`lint`/`verify-cassettes` plus a PR
 job-summary reporter (verdict table, staleness findings, cost/turns when available):
@@ -17,7 +17,7 @@ job-summary reporter (verdict table, staleness findings, cost/turns when availab
 CLI major reaches your workflow the moment it is promoted even though your `uses:` ref never changed — so a
 copy-pasted recipe that omits the input takes a major bump with no say in it. `^2` holds the major, needs no
 patch number to remember, and only wants a human decision at the next major. Pin an exact version
-(e.g. `version: "3.6.0"`) instead when you want byte-reproducible CI.
+(e.g. `version: "3.8.0"`) instead when you want byte-reproducible CI.
 
 Reach for the manual multi-step form below only when you need per-step control the Action's inputs don't
 cover (a custom flag combination, a different runner matrix per step, or `lint`/`verify-cassettes` gated
@@ -36,13 +36,17 @@ jobs:
       - uses: actions/checkout@v4
       - name: Stage the agent binary (official channel, sha256-verified against the pinned baseline)
         run: |
-          V=2.1.275   # match your scenario's pinned baseline's agentVersion
+          V=2.1.280   # match your scenario's pinned baseline's agentVersion
           # The release channel is NOT always the stable one. Desktop also stages release CANDIDATES,
-          # served only from .../claude-code-releases/rc/<commit>/ — the stable path 404s for those, and
-          # 2.1.255 is one. Take B from your pinned baseline's agentBinary.releaseBaseUrl; baselines
-          # written before that field existed were stable-staged, so their base is the plain
-          # https://downloads.claude.ai/claude-code-releases.
-          B=https://downloads.claude.ai/claude-code-releases
+          # served from .../claude-code-releases/rc/<commit>/. For some versions the stable path 404s
+          # (2.1.255); for others it returns 200 and serves a DIFFERENT BUILD UNDER THE SAME VERSION
+          # NUMBER — measured for 2.1.280 on 2026-09-23: stable linux-arm64 233,103,352 B / 92f2b4fd…
+          # (commit 80abbfe7) vs RC 233,037,816 B / a1b25d70… (commit bddba3ab), and the staged binary is
+          # the RC one. So "the stable URL works" is NOT evidence you have the right build: always take B
+          # from your pinned baseline's agentBinary.releaseBaseUrl. The checksum step fails closed if you
+          # don't, but it cannot tell you why. Baselines written before that field existed were
+          # stable-staged, so their base is the plain https://downloads.claude.ai/claude-code-releases.
+          B=https://downloads.claude.ai/claude-code-releases/rc/bddba3abd5da53d0c540cfc76a8d18b44633d568
           # The expected digest is baselines/desktop-<ver>.json -> agentBinary.sha256. Paste it here, or
           # read it with jq if you vendor the baseline. An unverified download is an unverified agent:
           # this step FAILS rather than staging one, which is the whole point of naming it "verified".
@@ -73,7 +77,7 @@ sha256-*checked* but not hard-blocking on mismatch — it's advisory for an inte
 GitHub-hosted runners, no token/Docker/agent:
 
 ```yaml
-- run: npm i -g "cowork-harness@^3.6.0"
+- run: npm i -g "cowork-harness@^3.8.0"
 - run: cowork-harness lint scenarios/*.yaml --strict --min-severity WARN
                                                     # no silent false-greens. WITHOUT --strict this
                                                     # step cannot fail on a WARN-class rule (e.g.
@@ -322,6 +326,16 @@ A typical skill repo runs four stages, fastest/cheapest first:
    literal only when your scenarios name a `fidelity:`; one still in the deprecation window prints one
    defaulted-fidelity notice per scenario.) A scenario that lints with only
    warnings can still be unloadable, so a green `lint` is not evidence the suite runs.
+
+   **If the repo pays for `critique`, gate the evidence corpus here first, for free:**
+
+   ```bash
+   cowork-harness critique <folder> [--skill <name>] --corpus-only --output-format json \
+     | jq -e '.corpus.corpusBytes <= .corpus.corpusCeiling'
+   ```
+
+   The `jq -e` IS the gate — `--corpus-only` exits 0 on a measurement even over the ceiling. Same
+   packager, same git filter as the paid run; the number is a floor (a run-time read can only add).
 3. **Scenarios (replay)** — `cowork-harness replay cassettes/` on every PR (the committed `*.cassette.json`).
    Token-free; content + structure + gate delivery.
 4. **Parity / live (nightly, self-hosted)** — `cowork-harness run scenarios/` with a token + Docker +
@@ -350,7 +364,7 @@ jobs:
         with: { node-version: '24' }
       - uses: actions/setup-python@v5
         with: { python-version: '3.x' }                                       # python3 only — PyYAML is bundled with the linter
-      - run: npm i -g "cowork-harness@^3.6.0"
+      - run: npm i -g "cowork-harness@^3.8.0"
       - run: cowork-harness lint scenarios/*.yaml                              # no-silent-false-green (needs python3; PyYAML bundled)
       - run: cowork-harness verify-cassettes cassettes/ --output-format json   # privacy + staleness gate
       - run: cowork-harness replay cassettes/ --output-format json             # token-free content/structure
@@ -379,7 +393,7 @@ jobs:
             echo "live=true" >> "$GITHUB_OUTPUT"
           fi
       - if: steps.guard.outputs.live == 'true'
-        run: npm i -g "cowork-harness@^3.6.0"
+        run: npm i -g "cowork-harness@^3.8.0"
       - if: steps.guard.outputs.live == 'true'
         run: cowork-harness run scenarios/ --output-format json
         env:

package/.claude/skills/cowork-harness/references/critique.md

@@ -1,6 +1,6 @@
 # Critique — the facts a plugin install can't otherwise reach
 
-Tracks `cowork-harness 3.6.0` (baseline `desktop-2.2553.1`). This is **not** a trim of the full
+Tracks `cowork-harness 3.8.0` (baseline `desktop-2.7032.0`). This is **not** a trim of the full
 [`docs/critique.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/critique.md) (repo-only —
 flags, cost, reproduction discipline, known limitations all live there). This file covers exactly what a
 plugin install cannot otherwise discover: the run-dir artifact a harvester actually reads, the report's
@@ -22,9 +22,12 @@ finding's `evidence` excerpt must resolve verbatim against this package, or it l
 
 ## Cost across critiques — the index, not the reports
 
-A critique is FOUR model workloads but only TWO produce a run, so only two produce index rows; the
-evaluator passes produce none. Each critique therefore appends a **roll-up row** (`critiqueRole:"rollup"`)
-carrying `critiqueTotalUsd` — the whole four-workload spend. Its own `costUsd` is the **evaluator passes
+A critique is **up to FOUR** model workloads — two graded turns and two evaluator passes — but only the
+TWO graded turns produce a run, so only two produce index rows; the evaluator passes produce none. Each
+critique therefore appends a **roll-up row** (`critiqueRole:"rollup"`) carrying `critiqueTotalUsd` — the
+whole spend across whatever workloads actually ran. **Evaluator pass 2 is skipped entirely when no
+self-report was captured** (nothing to verify), so a completed critique can be three workloads and the
+roll-up covers three. Its own `costUsd` is the **evaluator passes
 only**, so `sum(costUsd)` over every row is exactly true spend with nothing double-counted or missed. The
 turn rows carry `critiqueRole:"task"` / `"reflection"`.
 
@@ -103,19 +106,48 @@ fingerprints differently).
 
 ## What the evaluator was actually shown — `evidenceBudget`
 
-Skill-authored content (`SKILL.md`, every `references/**` file, `agents/<skill>.md`) ships **WHOLE, not
-rationed** — up to a **512 KiB combined ceiling** across all three together. A breach cuts **loudly**: the
-named file and byte counts are reported, never silent, never refused. The **transcript** is bounded
+Skill-authored content ships **WHOLE, not rationed**: `SKILL.md`, every file under the skill's own
+`references/**`, every dispatchable `agents/**.md`, and — for a multi-skill plugin — the shared
+plugin-root `references/` files that the skill's own text, a packaged agent body, or the graded agent's
+own read of it actually points at, up to a **512 KiB combined ceiling** across all four together. A
+breach cuts **loudly**: the named file and byte counts are reported, never silent, never refused. The
+plugin-root class is narrow by design — packaging the WHOLE shared tree instead was measured and
+rejected: on a real 6-skill plugin it pushed one skill's corpus to 107% of the ceiling and cost that
+skill's own `SKILL.md` 37,295 B, and `already-covered` (below) judges by presence with no notion of
+authorship, so another skill's shared docs would silently excuse a real gap — a root file the rule leaves
+out is reported in `corpusOmitted` below, never dropped silently. The **transcript** is bounded
 separately at **128 KiB**, cut **head+tail with an elided middle**, so a run's setup and its conclusion
 both survive a cut instead of just one end.
 
 You do not need a paid run to find out where you stand: **`cowork-harness lint-skill <skill-dir>` sizes
 your corpus against the same ceiling**, reporting `skill-corpus-near-evidence-ceiling` (INFO) from 80%
-and `skill-corpus-over-evidence-ceiling` (WARN, so it fails `--strict`) past it. It counts the three
-classes the ceiling governs — `SKILL.md`, every file under `references/` (**any extension**: the packager
-applies no extension filter, so JSON schemas and rule packs count toward your total), and a plugin
-skill's `agents/<name>.md`. It does not apply staging's git-tracked filter, so an untracked reference
-inflates the figure; `corpusCuts` below stays the authority.
+and `skill-corpus-over-evidence-ceiling` (WARN, so it fails `--strict`) past it. It counts only the
+skill-local classes — `SKILL.md`, every file under `references/` (**any extension**: the packager
+applies no extension filter, so JSON schemas and rule packs count toward your total), and every
+dispatchable `agents/**.md` a plugin skill can dispatch, and every plugin-root `references/` file the
+skill links — the same four classes the packager ships. The one clause it cannot mirror is the
+run-dependent one (a root reference included only because the graded agent READ it), since a static lint
+has no run to read, so its number can under-report there. It also does not apply staging's git-tracked filter,
+so an untracked skill-local reference inflates the figure the other way; `corpusCuts`/`corpusOmitted`
+below stay the authority.
+
+**Cheaper, and the packager's own floor: `critique <folder> --corpus-only`.** NO SPEND — no session, no spawn — it runs the
+same `packageEvidence` call a paid critique makes, over an empty run dir, and prints these six fields
+directly (`--output-format json` for the standard payload envelope; text mode prints the one-line
+percent-of-ceiling summary + packaged-file count). `--prompt` becomes optional; every other flag is still
+parsed and type-checked, but a run-shaping one is ignored and named in `ignoredFlags` (a path value such as
+`--upload` is only checked when a turn stages). The number is a FLOOR — a plugin-root
+reference the agent READS during the graded turn is added at critique time, so a paid run's `corpusBytes`
+is `>=` this. Exit 0 = measured (even over the ceiling — gate yourself on `corpusBytes <= corpusCeiling`);
+exit 2 = usage error, unresolvable target, no readable SKILL.md, or a work tree with 0 tracked files (a
+non-git folder is measured raw, as staging copies it). Unlike `lint-skill`'s static count, it IS the
+packager: untracked files and symlinks outside the plugin are excluded by the same filter and containment
+rule a critique applies, bytes are the same UTF-8-decoded measurement, and the one clause no static
+instrument can see (a plugin-root reference read at run time) is stated as the floor rather than guessed
+at. Known gap: a skill that is a git submodule of its plugin (or any `--skill` subdirectory with nothing
+tracked under it) is REFUSED by `--corpus-only` in staging's terms, but a live critique's packager still
+accepts it from the directory's own index and grades a skill the mount never delivers — pre-existing,
+rare, not fixed here.
 
 The report's `evidenceBudget` object says exactly what was shown — read it instead of inferring budgets
 from `dist/` source:
@@ -124,7 +156,9 @@ from `dist/` source:
 |---|---|
 | `corpusBytes` | total skill-content bytes found, BEFORE any cut |
 | `corpusCeiling` | the 512 KiB combined ceiling |
+| `corpusPackaged` | every corpus file whose CONTENT shipped into the corpus sections, by the same key `corpusCuts`/`corpusOmitted` use — so a reader can see exactly which sub-agent bodies and shared references the grade rests on. A file the ceiling zeroed is NOT listed; a partially cut one is, with its loss in `corpusCuts`; a placeholder for an unreadable file is never a corpus entry at all |
 | `corpusCuts` | per-file cut record — empty on every real skill; non-empty only once the ceiling is actually breached |
+| `corpusOmitted` | plugin-root `references/` files present on the HOST under `<plugin>/references/` but NOT packaged (a raw walk, so an untracked file staging would not deliver is listed too — `alsoUntracked: true` says so, and the property is ABSENT rather than `false` when trackedness could not be evaluated), and why: `not-linked` (nothing in the skill's authored text, a packaged agent body, or the graded agent's own read points at it), `not-utf8` (fails to decode as clean UTF-8 — the skill's **own** `references/**` has no such filter), or `ambiguous-read` (the graded agent read a path that exists under both the skill's own `references/` and the plugin root's, so which tree it read cannot be attributed) |
 | `corpusExcluded` | skill files present on the host but never delivered to the agent (see below) |
 | `trimRecord` | which section the transcript trim shaved, and by how much |
 | `packageTruncated` | `true` if ANY section was cut — check this, not `corpusCuts`, for "was anything trimmed": a transcript-only cut leaves `corpusCuts` empty and would otherwise read as "nothing cut" |

package/.claude/skills/cowork-harness/references/fidelity-and-answers.md

@@ -1,6 +1,13 @@
 # Fidelity tiers & answer paths
 
-Self-contained reference. Tracks `cowork-harness 3.6.0` (baseline `desktop-2.2553.1`).
+Self-contained reference. Tracks `cowork-harness 3.8.0` (baseline `desktop-2.7032.0`).
+
+> **This page vs. the repo docs.** This is the **offline snapshot** that ships inside the installed
+> plugin — it is self-contained on purpose. The repo carries four other fidelity views, each answering a
+> different question: *which tier do I pick?* ([README → Fidelity tiers](https://github.com/yaniv-golan/cowork-harness/blob/main/README.md#fidelity-tiers-pick-per-scenario--per-ci-job)),
+> *what does a tier enforce?* ([docs/boundary.md](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/boundary.md)), *what does it NOT reproduce?*
+> ([docs/fidelity-gaps.md](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/fidelity-gaps.md)), and *why is it built this way?*
+> ([DESIGN.md § 2](https://github.com/yaniv-golan/cowork-harness/blob/main/DESIGN.md#2-parity-matrix-per-tier)).
 
 ## Fidelity tiers (`fidelity:` in the scenario)
 

package/.claude/skills/cowork-harness/references/scenario-schema.md

@@ -1,7 +1,7 @@
 # Scenario & session schema, assertion catalog, web_fetch, authoring gotchas
 
-Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 3.6.0`
-(baseline `desktop-2.2553.1`). If your checkout is newer, prefer the live [`docs/scenario.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/scenario.md),
+Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 3.8.0`
+(baseline `desktop-2.7032.0`). If your checkout is newer, prefer the live [`docs/scenario.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/scenario.md),
 [`docs/session.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/session.md), and `SPEC.md`.
 
 **Minimal scenario** — `prompt` is the only required field:
@@ -369,6 +369,8 @@ same set live from the schema.
 | `gate_answer_count_min: <N>` | at least N AskUserQuestion gates fired AND were delivered non-error — presence companion to `gate_answers_delivered`'s vacuous-pass. **`: 0` asserts nothing** and does not satisfy that pairing; `>= 1` is **mutually exclusive** with `questions_count_max: 0` (refused by `run`/`skill`/`record`) |
 | `hook_blocked: <regex>` | a PreToolUse hook blocked a tool whose name matches the regex (`RunResult.hookEvents`) — evidence-unavailable if hook telemetry is absent. Replay: needs a `controlOut` cassette (a custom hook's decision lives only there, not the recorded stream) |
 | `no_hook_blocked: true` | no tool was hook-blocked during the run (distinguishes a real tool crash from an intentional hook block) — evidence-unavailable if hook telemetry is absent. Replay: needs a `controlOut` cassette. **Only `true` is valid** |
+| `hook_event_fired: <HookEvent>` | a **command hook** for this event (a plugin's `hooks/hooks.json` or manifest hook — `Stop`, `SessionStart`, `PostToolUse`, …) ran: a `hook_response` system frame with that `hook_event` was recorded (`RunResult.contextEvents`). Any outcome counts. The harness passes `--include-hook-events` whenever a staged plugin declares hooks — that is what puts events other than SessionStart/Setup on the stream — so a recording made without it reports "never fired". Content-class, grades on replay. Recorded end-to-end for `Stop` ([stop-hook-probe.scenario.yaml](https://github.com/yaniv-golan/cowork-harness/blob/main/examples/probes/stop-hook-probe.scenario.yaml)); the other names match the same frame but have not each been recorded |
+| `hook_event_blocked: <HookEvent>` | that command hook **blocked** at least once — a `hook_response` frame for the event carried `exit_code: 2`. Fails naming the exit codes seen when it fired without blocking (a frame with no `exit_code` is reported as such, never counted); fails "never fired" otherwise; cannot-verify when the run has no context events. Content-class |
 | `vm_path_denied: true` | **`fidelity: hostloop` only** — at least one recorded path denial (`RunResult.pathDenials`, any source) targeted a `/sessions` VM path — evidence-unavailable if path-denial telemetry is absent. Replay: needs a `controlOut` cassette. Any other tier FAILS "cannot verify". **Only `true` is valid** |
 | `path_denied: {tool?, path_matches?, source?, agent_scope?}` | **`fidelity: hostloop` only** — a path denial matching ALL given matchers (`tool` glob, `path_matches` regex, `source` ∈ pretooluse/can_use_tool/permission_denied, `agent_scope` ∈ main/subagent/any) was recorded. Replay: needs a `controlOut` cassette. Any other tier FAILS "cannot verify" |
 | `no_path_denied: true` | **`fidelity: hostloop` only** — NO path denial was recorded at all (the channel is already path-scoped, unlike `no_hook_blocked`'s indiscriminate reject). Replay: needs a `controlOut` cassette. Any other tier FAILS "cannot verify". **Only `true` is valid** |
@@ -454,7 +456,7 @@ sourcing ≠ evaluation (replay warns when you edit one). `verify-run` is the on
 `no_vm_path_file_op`, `dispatch_count_max`,
 `skill_triggered`, `no_skill_triggered`, `skill_available`, `connector_available`, `tool_available`,
 `skill_tool_used`, `max_cost_usd`, `max_tokens`, `tool_calls_max`, `tool_no_error`,
-`max_tool_errors`, `max_redundant_tool_calls`, `max_turns`, `compaction_occurred`, `all_tasks_completed`, `task_status`, `task_count_min`, `no_scratchpad_leak`, `present_files_called`, `result`
+`max_tool_errors`, `max_redundant_tool_calls`, `max_turns`, `compaction_occurred`, `hook_event_fired`, `hook_event_blocked`, `all_tasks_completed`, `task_status`, `task_count_min`, `no_scratchpad_leak`, `present_files_called`, `result`
 (`max_cost_usd`/`max_tokens` assert the frozen recording's spend on replay, not fresh spend). The verdict
 modifiers `allow_permissive_auto_allow` / `allow_missing_capability` / `allow_l0_host_config_contamination` /
 `allow_stall` are also kept on replay, evaluated as no-op passes.

package/.claude/skills/cowork-harness/references/task-recipes.md

@@ -2,7 +2,7 @@
 
 Each recipe composes facts that live scattered across SKILL.md and the other references into one
 decision path. Every one answers a question a real fleet owner had to work out the hard way.
-Tracks `cowork-harness 3.6.0` (baseline `desktop-2.2553.1`), same as SKILL.md's front-matter. Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
+Tracks `cowork-harness 3.8.0` (baseline `desktop-2.7032.0`), same as SKILL.md's front-matter. Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
 Recipe 3's `init-redact` shipped in 0.24.0 and are part of the current feature set — no version gate
 needed if your CLI meets SKILL.md's version floor.
 

package/.claude/skills/cowork-harness/scripts/assertion-keys.json

@@ -23,6 +23,8 @@
     "gate_answer_count_min",
     "gate_answers_delivered",
     "hook_blocked",
+    "hook_event_blocked",
+    "hook_event_fired",
     "input_unmodified",
     "max_cost_usd",
     "max_peak_rss_bytes",
@@ -150,6 +152,7 @@
   "liveVerifiedHookEvents": [
     "PostToolUse",
     "SessionStart",
+    "Stop",
     "UserPromptSubmit"
   ],
   "enums": {
@@ -165,6 +168,76 @@
       "once",
       "domain"
     ],
+    "assert.hook_event_blocked": [
+      "PreToolUse",
+      "PostToolUse",
+      "PostToolUseFailure",
+      "PostToolBatch",
+      "Notification",
+      "UserPromptSubmit",
+      "UserPromptExpansion",
+      "SessionStart",
+      "SessionEnd",
+      "Stop",
+      "StopFailure",
+      "SubagentStart",
+      "SubagentStop",
+      "PreCompact",
+      "PostCompact",
+      "PreModelSwitch",
+      "PostModelSwitch",
+      "PermissionRequest",
+      "PermissionDenied",
+      "Setup",
+      "TeammateIdle",
+      "TaskCreated",
+      "TaskCompleted",
+      "Elicitation",
+      "ElicitationResult",
+      "ConfigChange",
+      "WorktreeCreate",
+      "WorktreeRemove",
+      "InstructionsLoaded",
+      "CwdChanged",
+      "FileChanged",
+      "DirectoryAdded",
+      "MessageDisplay"
+    ],
+    "assert.hook_event_fired": [
+      "PreToolUse",
+      "PostToolUse",
+      "PostToolUseFailure",
+      "PostToolBatch",
+      "Notification",
+      "UserPromptSubmit",
+      "UserPromptExpansion",
+      "SessionStart",
+      "SessionEnd",
+      "Stop",
+      "StopFailure",
+      "SubagentStart",
+      "SubagentStop",
+      "PreCompact",
+      "PostCompact",
+      "PreModelSwitch",
+      "PostModelSwitch",
+      "PermissionRequest",
+      "PermissionDenied",
+      "Setup",
+      "TeammateIdle",
+      "TaskCreated",
+      "TaskCompleted",
+      "Elicitation",
+      "ElicitationResult",
+      "ConfigChange",
+      "WorktreeCreate",
+      "WorktreeRemove",
+      "InstructionsLoaded",
+      "CwdChanged",
+      "FileChanged",
+      "DirectoryAdded",
+      "MessageDisplay"
+    ],
     "assert.path_denied.agent_scope": [
       "main",
       "subagent",