cowork-harness 3.7.0 → 3.8.1

package/.claude/skills/cowork-harness/SKILL.md

@@ -3,8 +3,8 @@ name: cowork-harness
 description: Test or debug a Claude Code skill/plugin under Claude Cowork's runtime — sandboxed agent, default-deny egress, the can_use_tool permission/question protocol — using the cowork-harness CLI. Use when validating or regression-testing a skill, authoring or debugging a scenario YAML (prompt + scripted answers + assert:), choosing a fidelity tier, scripting AskUserQuestion / tool-permission answers, or asserting artifacts, egress, or sub-agent dispatch. Especially when a harness run no-ops an assertion, fails on an unanswered gate, false-greens, a steered answer never reaches the model, or a web_fetch is unexpectedly denied or gated. Also when iterating or hardening a skill across fixes, or grounding a skill's self-critique against its own run evidence — including a document-analysis skill (cap table, deck, financial model, transcript) that needs an uploaded file attached to be critiqued at all. NOT for generic unit testing (pytest/vitest of your own scripts) or non-Cowork CI. Covers the skill / run / chat / record / replay / trace / decide / assertions / scaffold commands and the session-vs-scenario split.
 metadata:
   author: cowork-harness
-  version: 3.7.0
-  tracks-harness: cowork-harness 3.7.0 (baseline desktop-2.2553.1)
+  version: 3.8.1
+  tracks-harness: cowork-harness 3.8.1 (baseline desktop-2.7032.0)
 ---
 
 # cowork-harness
@@ -25,8 +25,8 @@ flagged with a loud `::warning::`, not silent — auto-answer a gate, observe an
 allowlist). This skill exists mostly to keep you out of those traps — the Gotchas section below is
 the highest-value part. Read it.
 
-> **Version note:** the facts and `file:line` pointers here track `cowork-harness 3.7.0` (baseline
-> `desktop-2.2553.1`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
+> **Version note:** the facts and `file:line` pointers here track `cowork-harness 3.8.1` (baseline
+> `desktop-2.7032.0`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
 > `SPEC.md` / `docs/*.md` over this snapshot, and re-run the bundled linter.
 
 ## Preflight — make sure the harness can actually run
@@ -42,7 +42,7 @@ Before the first command, confirm the CLI is reachable and **fail loud** (never
 
 - **One-shot check.** Run `cowork-harness doctor [--tier <tier>]` first — a read-only prerequisite check that inspects Docker, the staged agent, the token, and the baseline in one pass. The bullets below explain each thing it checks (and how to fix it).
 - **Replay-only? Skip `doctor`.** Replaying committed cassettes needs no Docker, no staged agent, and no token — and every tier's `doctor` validates the auth token (the live tiers also Docker + the staged agent), so a ✗ there is expected, not a blocker. Go straight to `cowork-harness replay <cassette>`.
-- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 3.7.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@^3.7.0" <cmd>` (Node ≥ 22), or install once with `npm i -g "cowork-harness@^3.7.0"`. **Pin `@^3.7.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
+- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 3.8.1**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@^3.8.1" <cmd>` (Node ≥ 22), or install once with `npm i -g "cowork-harness@^3.8.1"`. **Pin `@^3.8.1`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
 
   This skill documents the CURRENT surface, not release history. If `cowork-harness --version` is
   OLDER than the floor, the per-release record of what you are missing is [CHANGELOG.md](https://github.com/yaniv-golan/cowork-harness/blob/main/CHANGELOG.md)
@@ -81,7 +81,7 @@ CI-grade scenario, and the post-hoc debug loop; the rest are narrower tools that
   correct answers after you edit it?) → author `semantic_matches` scenarios and gate on the per-claim
   profile. See **Recipe 5** in `references/task-recipes.md` (validity, N≥3, discrimination — the traps).
 - **"What is WRONG with this skill?"** (a graded critique, not a pass/fail) → `cowork-harness critique
-  <folder> --prompt "<probe>"`. Four model workloads and 10–20 minutes; budget from
+  <folder> --prompt "<probe>"`. Up to four model workloads (zero with `--corpus-only`; pass 2 is skipped with no self-report) and 10–20 minutes; budget from
   `report.costUsd.totalUsd`. Reach for it when you want **findings**. **For "what does this skill
   **DO**" — routing, artifact location, narration — use `skill` instead**: no evaluator, a fraction of
   the cost, and it answers that question directly. Report and evidence-package shapes:
@@ -568,7 +568,9 @@ Recognize these before "fixing" a non-bug:
 - **`missing_capability`** — the lean `core` agent image is a deliberate partial mirror of real Cowork's
   rootfs, so a skill that used `soffice`/LibreOffice (`office_convert`), `tesseract` (`ocr`),
   `markitdown`/`magika` (`ml_extract`), `cv2` (`cv`), `camelot`/`tabula` (`pdf_tables`), or `wand`
-  (`magick`) can trip this even though real Cowork **ships** those. The message says so ("likely a FALSE
+  (`magick`) can trip this even though real Cowork **ships** those (per the rootfs manifest captured at
+  Desktop `2.7032.0` — `baselines/provisioning/rootfs-provisioning.json`, which is the dated evidence
+  behind that sentence). The message says so ("likely a FALSE
   NEGATIVE (real Cowork ships them)"). Fix: rebuild full parity (`--build-arg COWORK_FULL_PARITY=1`, point
   `COWORK_AGENT_IMAGE` at it), or — if the skill's fallback is genuinely equivalent — assert
   `allow_missing_capability: true`. (Two sources: a skill *observed using* an omitted family, live lane;

package/.claude/skills/cowork-harness/references/ci-recipe.md

@@ -1,6 +1,6 @@
 # CI recipe — replay vs live lanes
 
-Self-contained reference. Tracks `cowork-harness 3.7.0` (baseline `desktop-2.2553.1`).
+Self-contained reference. Tracks `cowork-harness 3.8.1` (baseline `desktop-2.7032.0`).
 
 **Fastest path: the packaged Action.** One step gets you `replay`/`lint`/`verify-cassettes` plus a PR
 job-summary reporter (verdict table, staleness findings, cost/turns when available):
@@ -17,7 +17,7 @@ job-summary reporter (verdict table, staleness findings, cost/turns when availab
 CLI major reaches your workflow the moment it is promoted even though your `uses:` ref never changed — so a
 copy-pasted recipe that omits the input takes a major bump with no say in it. `^2` holds the major, needs no
 patch number to remember, and only wants a human decision at the next major. Pin an exact version
-(e.g. `version: "3.7.0"`) instead when you want byte-reproducible CI.
+(e.g. `version: "3.8.1"`) instead when you want byte-reproducible CI.
 
 Reach for the manual multi-step form below only when you need per-step control the Action's inputs don't
 cover (a custom flag combination, a different runner matrix per step, or `lint`/`verify-cassettes` gated
@@ -36,13 +36,17 @@ jobs:
       - uses: actions/checkout@v4
       - name: Stage the agent binary (official channel, sha256-verified against the pinned baseline)
         run: |
-          V=2.1.275   # match your scenario's pinned baseline's agentVersion
+          V=2.1.280   # match your scenario's pinned baseline's agentVersion
           # The release channel is NOT always the stable one. Desktop also stages release CANDIDATES,
-          # served only from .../claude-code-releases/rc/<commit>/ — the stable path 404s for those, and
-          # 2.1.255 is one. Take B from your pinned baseline's agentBinary.releaseBaseUrl; baselines
-          # written before that field existed were stable-staged, so their base is the plain
-          # https://downloads.claude.ai/claude-code-releases.
-          B=https://downloads.claude.ai/claude-code-releases
+          # served from .../claude-code-releases/rc/<commit>/. For some versions the stable path 404s
+          # (2.1.255); for others it returns 200 and serves a DIFFERENT BUILD UNDER THE SAME VERSION
+          # NUMBER — measured for 2.1.280 on 2026-09-23: stable linux-arm64 233,103,352 B / 92f2b4fd…
+          # (commit 80abbfe7) vs RC 233,037,816 B / a1b25d70… (commit bddba3ab), and the staged binary is
+          # the RC one. So "the stable URL works" is NOT evidence you have the right build: always take B
+          # from your pinned baseline's agentBinary.releaseBaseUrl. The checksum step fails closed if you
+          # don't, but it cannot tell you why. Baselines written before that field existed were
+          # stable-staged, so their base is the plain https://downloads.claude.ai/claude-code-releases.
+          B=https://downloads.claude.ai/claude-code-releases/rc/bddba3abd5da53d0c540cfc76a8d18b44633d568
           # The expected digest is baselines/desktop-<ver>.json -> agentBinary.sha256. Paste it here, or
           # read it with jq if you vendor the baseline. An unverified download is an unverified agent:
           # this step FAILS rather than staging one, which is the whole point of naming it "verified".
@@ -73,7 +77,7 @@ sha256-*checked* but not hard-blocking on mismatch — it's advisory for an inte
 GitHub-hosted runners, no token/Docker/agent:
 
 ```yaml
-- run: npm i -g "cowork-harness@^3.7.0"
+- run: npm i -g "cowork-harness@^3.8.1"
 - run: cowork-harness lint scenarios/*.yaml --strict --min-severity WARN
                                                     # no silent false-greens. WITHOUT --strict this
                                                     # step cannot fail on a WARN-class rule (e.g.
@@ -322,6 +326,16 @@ A typical skill repo runs four stages, fastest/cheapest first:
    literal only when your scenarios name a `fidelity:`; one still in the deprecation window prints one
    defaulted-fidelity notice per scenario.) A scenario that lints with only
    warnings can still be unloadable, so a green `lint` is not evidence the suite runs.
+
+   **If the repo pays for `critique`, gate the evidence corpus here first, for free:**
+
+   ```bash
+   cowork-harness critique <folder> [--skill <name>] --corpus-only --output-format json \
+     | jq -e '.corpus.corpusBytes <= .corpus.corpusCeiling'
+   ```
+
+   The `jq -e` IS the gate — `--corpus-only` exits 0 on a measurement even over the ceiling. Same
+   packager, same git filter as the paid run; the number is a floor (a run-time read can only add).
 3. **Scenarios (replay)** — `cowork-harness replay cassettes/` on every PR (the committed `*.cassette.json`).
    Token-free; content + structure + gate delivery.
 4. **Parity / live (nightly, self-hosted)** — `cowork-harness run scenarios/` with a token + Docker +
@@ -350,7 +364,7 @@ jobs:
         with: { node-version: '24' }
       - uses: actions/setup-python@v5
         with: { python-version: '3.x' }                                       # python3 only — PyYAML is bundled with the linter
-      - run: npm i -g "cowork-harness@^3.7.0"
+      - run: npm i -g "cowork-harness@^3.8.1"
       - run: cowork-harness lint scenarios/*.yaml                              # no-silent-false-green (needs python3; PyYAML bundled)
       - run: cowork-harness verify-cassettes cassettes/ --output-format json   # privacy + staleness gate
       - run: cowork-harness replay cassettes/ --output-format json             # token-free content/structure
@@ -379,7 +393,7 @@ jobs:
             echo "live=true" >> "$GITHUB_OUTPUT"
           fi
       - if: steps.guard.outputs.live == 'true'
-        run: npm i -g "cowork-harness@^3.7.0"
+        run: npm i -g "cowork-harness@^3.8.1"
       - if: steps.guard.outputs.live == 'true'
         run: cowork-harness run scenarios/ --output-format json
         env:

package/.claude/skills/cowork-harness/references/critique.md

@@ -1,6 +1,6 @@
 # Critique — the facts a plugin install can't otherwise reach
 
-Tracks `cowork-harness 3.7.0` (baseline `desktop-2.2553.1`). This is **not** a trim of the full
+Tracks `cowork-harness 3.8.1` (baseline `desktop-2.7032.0`). This is **not** a trim of the full
 [`docs/critique.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/critique.md) (repo-only —
 flags, cost, reproduction discipline, known limitations all live there). This file covers exactly what a
 plugin install cannot otherwise discover: the run-dir artifact a harvester actually reads, the report's
@@ -22,9 +22,12 @@ finding's `evidence` excerpt must resolve verbatim against this package, or it l
 
 ## Cost across critiques — the index, not the reports
 
-A critique is FOUR model workloads but only TWO produce a run, so only two produce index rows; the
-evaluator passes produce none. Each critique therefore appends a **roll-up row** (`critiqueRole:"rollup"`)
-carrying `critiqueTotalUsd` — the whole four-workload spend. Its own `costUsd` is the **evaluator passes
+A critique is **up to FOUR** model workloads — two graded turns and two evaluator passes — but only the
+TWO graded turns produce a run, so only two produce index rows; the evaluator passes produce none. Each
+critique therefore appends a **roll-up row** (`critiqueRole:"rollup"`) carrying `critiqueTotalUsd` — the
+whole spend across whatever workloads actually ran. **Evaluator pass 2 is skipped entirely when no
+self-report was captured** (nothing to verify), so a completed critique can be three workloads and the
+roll-up covers three. Its own `costUsd` is the **evaluator passes
 only**, so `sum(costUsd)` over every row is exactly true spend with nothing double-counted or missed. The
 turn rows carry `critiqueRole:"task"` / `"reflection"`.
 
@@ -128,6 +131,24 @@ has no run to read, so its number can under-report there. It also does not apply
 so an untracked skill-local reference inflates the figure the other way; `corpusCuts`/`corpusOmitted`
 below stay the authority.
 
+**Cheaper, and the packager's own floor: `critique <folder> --corpus-only`.** NO SPEND — no session, no spawn — it runs the
+same `packageEvidence` call a paid critique makes, over an empty run dir, and prints these six fields
+directly (`--output-format json` for the standard payload envelope; text mode prints the one-line
+percent-of-ceiling summary + packaged-file count). `--prompt` becomes optional; every other flag is still
+parsed and type-checked, but a run-shaping one is ignored and named in `ignoredFlags` (a path value such as
+`--upload` is only checked when a turn stages). The number is a FLOOR — a plugin-root
+reference the agent READS during the graded turn is added at critique time, so a paid run's `corpusBytes`
+is `>=` this. Exit 0 = measured (even over the ceiling — gate yourself on `corpusBytes <= corpusCeiling`);
+exit 2 = usage error, unresolvable target, no readable SKILL.md, or a work tree with 0 tracked files (a
+non-git folder is measured raw, as staging copies it). Unlike `lint-skill`'s static count, it IS the
+packager: untracked files and symlinks outside the plugin are excluded by the same filter and containment
+rule a critique applies, bytes are the same UTF-8-decoded measurement, and the one clause no static
+instrument can see (a plugin-root reference read at run time) is stated as the floor rather than guessed
+at. Known gap: a skill that is a git submodule of its plugin (or any `--skill` subdirectory with nothing
+tracked under it) is REFUSED by `--corpus-only` in staging's terms, but a live critique's packager still
+accepts it from the directory's own index and grades a skill the mount never delivers — pre-existing,
+rare, not fixed here.
+
 The report's `evidenceBudget` object says exactly what was shown — read it instead of inferring budgets
 from `dist/` source:
 

package/.claude/skills/cowork-harness/references/fidelity-and-answers.md

@@ -1,6 +1,6 @@
 # Fidelity tiers & answer paths
 
-Self-contained reference. Tracks `cowork-harness 3.7.0` (baseline `desktop-2.2553.1`).
+Self-contained reference. Tracks `cowork-harness 3.8.1` (baseline `desktop-2.7032.0`).
 
 > **This page vs. the repo docs.** This is the **offline snapshot** that ships inside the installed
 > plugin — it is self-contained on purpose. The repo carries four other fidelity views, each answering a

package/.claude/skills/cowork-harness/references/scenario-schema.md

@@ -1,7 +1,7 @@
 # Scenario & session schema, assertion catalog, web_fetch, authoring gotchas
 
-Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 3.7.0`
-(baseline `desktop-2.2553.1`). If your checkout is newer, prefer the live [`docs/scenario.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/scenario.md),
+Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 3.8.1`
+(baseline `desktop-2.7032.0`). If your checkout is newer, prefer the live [`docs/scenario.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/scenario.md),
 [`docs/session.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/session.md), and `SPEC.md`.
 
 **Minimal scenario** — `prompt` is the only required field:
@@ -192,7 +192,7 @@ plugins:
 skills:
   local: []                      # extra host skill dirs
   suggest_enabled: true          # gate 245679952 override — `mcp__skills__suggest_skills` on/off (default true)
-  proactive_suggest_enabled: false  # gate 1598976391 override — proactive description + `trigger` param; unset = synced baseline gate (ON from 1.24012.11)
+  proactive_suggest_enabled: false  # gate 1598976391 override — proactive description + `trigger` param; unset = always on from the 1.46388.3 baseline (where `false` models a surface production does not ship there), synced gate before it
 mcp:
   config: null                   # --mcp-config file (standard mcpServers map)
   enabled: []
@@ -369,6 +369,8 @@ same set live from the schema.
 | `gate_answer_count_min: <N>` | at least N AskUserQuestion gates fired AND were delivered non-error — presence companion to `gate_answers_delivered`'s vacuous-pass. **`: 0` asserts nothing** and does not satisfy that pairing; `>= 1` is **mutually exclusive** with `questions_count_max: 0` (refused by `run`/`skill`/`record`) |
 | `hook_blocked: <regex>` | a PreToolUse hook blocked a tool whose name matches the regex (`RunResult.hookEvents`) — evidence-unavailable if hook telemetry is absent. Replay: needs a `controlOut` cassette (a custom hook's decision lives only there, not the recorded stream) |
 | `no_hook_blocked: true` | no tool was hook-blocked during the run (distinguishes a real tool crash from an intentional hook block) — evidence-unavailable if hook telemetry is absent. Replay: needs a `controlOut` cassette. **Only `true` is valid** |
+| `hook_event_fired: <HookEvent>` | a **command hook** for this event (a plugin's `hooks/hooks.json` or manifest hook — `Stop`, `SessionStart`, `PostToolUse`, …) ran: a `hook_response` system frame with that `hook_event` was recorded (`RunResult.contextEvents`). Any outcome counts. The harness passes `--include-hook-events` whenever a staged plugin declares hooks — that is what puts events other than SessionStart/Setup on the stream — so a recording made without it reports "never fired". Content-class, grades on replay. Recorded end-to-end for `Stop` ([stop-hook-probe.scenario.yaml](https://github.com/yaniv-golan/cowork-harness/blob/main/examples/probes/stop-hook-probe.scenario.yaml)); the other names match the same frame but have not each been recorded |
+| `hook_event_blocked: <HookEvent>` | that command hook **blocked** at least once — a `hook_response` frame for the event carried `exit_code: 2`. Fails naming the exit codes seen when it fired without blocking (a frame with no `exit_code` is reported as such, never counted); fails "never fired" otherwise; cannot-verify when the run has no context events. Content-class |
 | `vm_path_denied: true` | **`fidelity: hostloop` only** — at least one recorded path denial (`RunResult.pathDenials`, any source) targeted a `/sessions` VM path — evidence-unavailable if path-denial telemetry is absent. Replay: needs a `controlOut` cassette. Any other tier FAILS "cannot verify". **Only `true` is valid** |
 | `path_denied: {tool?, path_matches?, source?, agent_scope?}` | **`fidelity: hostloop` only** — a path denial matching ALL given matchers (`tool` glob, `path_matches` regex, `source` ∈ pretooluse/can_use_tool/permission_denied, `agent_scope` ∈ main/subagent/any) was recorded. Replay: needs a `controlOut` cassette. Any other tier FAILS "cannot verify" |
 | `no_path_denied: true` | **`fidelity: hostloop` only** — NO path denial was recorded at all (the channel is already path-scoped, unlike `no_hook_blocked`'s indiscriminate reject). Replay: needs a `controlOut` cassette. Any other tier FAILS "cannot verify". **Only `true` is valid** |
@@ -454,7 +456,7 @@ sourcing ≠ evaluation (replay warns when you edit one). `verify-run` is the on
 `no_vm_path_file_op`, `dispatch_count_max`,
 `skill_triggered`, `no_skill_triggered`, `skill_available`, `connector_available`, `tool_available`,
 `skill_tool_used`, `max_cost_usd`, `max_tokens`, `tool_calls_max`, `tool_no_error`,
-`max_tool_errors`, `max_redundant_tool_calls`, `max_turns`, `compaction_occurred`, `all_tasks_completed`, `task_status`, `task_count_min`, `no_scratchpad_leak`, `present_files_called`, `result`
+`max_tool_errors`, `max_redundant_tool_calls`, `max_turns`, `compaction_occurred`, `hook_event_fired`, `hook_event_blocked`, `all_tasks_completed`, `task_status`, `task_count_min`, `no_scratchpad_leak`, `present_files_called`, `result`
 (`max_cost_usd`/`max_tokens` assert the frozen recording's spend on replay, not fresh spend). The verdict
 modifiers `allow_permissive_auto_allow` / `allow_missing_capability` / `allow_l0_host_config_contamination` /
 `allow_stall` are also kept on replay, evaluated as no-op passes.

package/.claude/skills/cowork-harness/references/task-recipes.md

@@ -2,7 +2,7 @@
 
 Each recipe composes facts that live scattered across SKILL.md and the other references into one
 decision path. Every one answers a question a real fleet owner had to work out the hard way.
-Tracks `cowork-harness 3.7.0` (baseline `desktop-2.2553.1`), same as SKILL.md's front-matter. Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
+Tracks `cowork-harness 3.8.1` (baseline `desktop-2.7032.0`), same as SKILL.md's front-matter. Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
 Recipe 3's `init-redact` shipped in 0.24.0 and are part of the current feature set — no version gate
 needed if your CLI meets SKILL.md's version floor.
 

package/.claude/skills/cowork-harness/scripts/assertion-keys.json

@@ -23,6 +23,8 @@
     "gate_answer_count_min",
     "gate_answers_delivered",
     "hook_blocked",
+    "hook_event_blocked",
+    "hook_event_fired",
     "input_unmodified",
     "max_cost_usd",
     "max_peak_rss_bytes",
@@ -150,6 +152,7 @@
   "liveVerifiedHookEvents": [
     "PostToolUse",
     "SessionStart",
+    "Stop",
     "UserPromptSubmit"
   ],
   "enums": {
@@ -165,6 +168,76 @@
       "once",
       "domain"
     ],
+    "assert.hook_event_blocked": [
+      "PreToolUse",
+      "PostToolUse",
+      "PostToolUseFailure",
+      "PostToolBatch",
+      "Notification",
+      "UserPromptSubmit",
+      "UserPromptExpansion",
+      "SessionStart",
+      "SessionEnd",
+      "Stop",
+      "StopFailure",
+      "SubagentStart",
+      "SubagentStop",
+      "PreCompact",
+      "PostCompact",
+      "PreModelSwitch",
+      "PostModelSwitch",
+      "PermissionRequest",
+      "PermissionDenied",
+      "Setup",
+      "TeammateIdle",
+      "TaskCreated",
+      "TaskCompleted",
+      "Elicitation",
+      "ElicitationResult",
+      "ConfigChange",
+      "WorktreeCreate",
+      "WorktreeRemove",
+      "InstructionsLoaded",
+      "CwdChanged",
+      "FileChanged",
+      "DirectoryAdded",
+      "MessageDisplay"
+    ],
+    "assert.hook_event_fired": [
+      "PreToolUse",
+      "PostToolUse",
+      "PostToolUseFailure",
+      "PostToolBatch",
+      "Notification",
+      "UserPromptSubmit",
+      "UserPromptExpansion",
+      "SessionStart",
+      "SessionEnd",
+      "Stop",
+      "StopFailure",
+      "SubagentStart",
+      "SubagentStop",
+      "PreCompact",
+      "PostCompact",
+      "PreModelSwitch",
+      "PostModelSwitch",
+      "PermissionRequest",
+      "PermissionDenied",
+      "Setup",
+      "TeammateIdle",
+      "TaskCreated",
+      "TaskCompleted",
+      "Elicitation",
+      "ElicitationResult",
+      "ConfigChange",
+      "WorktreeCreate",
+      "WorktreeRemove",
+      "InstructionsLoaded",
+      "CwdChanged",
+      "FileChanged",
+      "DirectoryAdded",
+      "MessageDisplay"
+    ],
     "assert.path_denied.agent_scope": [
       "main",
       "subagent",

package/.claude/skills/cowork-harness/scripts/scenario.py

@@ -111,6 +111,8 @@ CONTENT_KEYS = {
     "max_redundant_tool_calls",
     "max_turns",
     "compaction_occurred",
+    "hook_event_fired",
+    "hook_event_blocked",
     "all_tasks_completed",
     "task_count_min",
     "task_status",
@@ -218,7 +220,9 @@ _FALLBACK_SERVED_HOOK_EVENTS = {"PreToolUse"}
 # Re-sourced 2026-09-06 from the agent's OWN hooks-config validator array (ELF 2.1.260), not from a grep
 # for event-name constants. The previous 9-name set reported the other 24 -- PostCompact and
 # MessageDisplay among them -- identically to a misspelling, at ERROR severity below.
-_FALLBACK_KNOWN_HOOK_EVENTS = {
+# Ordered exactly like the TS `KNOWN_HOOK_EVENTS` array: the `hook_event_fired`/`hook_event_blocked` enum
+# values in _EMBEDDED_ENUMS are derived from this list and must compare equal to the generated map.
+_FALLBACK_KNOWN_HOOK_EVENTS_ORDERED = [
     "PreToolUse", "PostToolUse", "PostToolUseFailure", "PostToolBatch",
     "Notification", "UserPromptSubmit", "UserPromptExpansion", "SessionStart",
     "SessionEnd", "Stop", "StopFailure", "SubagentStart", "SubagentStop",
@@ -227,11 +231,12 @@ _FALLBACK_KNOWN_HOOK_EVENTS = {
     "TaskCreated", "TaskCompleted", "Elicitation", "ElicitationResult",
     "ConfigChange", "WorktreeCreate", "WorktreeRemove", "InstructionsLoaded",
     "CwdChanged", "FileChanged", "DirectoryAdded", "MessageDisplay",
-}
+]
+_FALLBACK_KNOWN_HOOK_EVENTS = set(_FALLBACK_KNOWN_HOOK_EVENTS_ORDERED)
 # The subset a plugin hook has been OBSERVED to fire for here (live-verified 2026-08-01, container +
 # hostloop). Kept apart from the known set because the message wording depends on which claim we can
 # make: accepted-by-the-validator is not reached-by-a-run.
-_FALLBACK_LIVE_VERIFIED_HOOK_EVENTS = {"SessionStart", "UserPromptSubmit", "PostToolUse"}
+_FALLBACK_LIVE_VERIFIED_HOOK_EVENTS = {"SessionStart", "UserPromptSubmit", "PostToolUse", "Stop"}
 
 
 def _load_hook_events():
@@ -350,6 +355,8 @@ _EMBEDDED_ENUMS = {
     "assert.path_denied.source": ["pretooluse", "can_use_tool", "permission_denied"],
     "assert.path_denied.agent_scope": ["main", "subagent", "any"],
     "assert.question_options.order": ["exact", "any"],
+    "assert.hook_event_fired": list(_FALLBACK_KNOWN_HOOK_EVENTS_ORDERED),
+    "assert.hook_event_blocked": list(_FALLBACK_KNOWN_HOOK_EVENTS_ORDERED),
 }
 
 
@@ -1569,14 +1576,15 @@ def _lint_hook_events(path):
             findings.append(Finding(
                 "INFO", "hook-event-not-served",
                 f"`{name}` {fires} — but cowork-harness "
-                f"itself installs only {', '.join(sorted(SERVED_HOOK_EVENTS))} on `initialize`. Two "
-                f"consequences: there is no assertion key for this event, so a scenario cannot GATE on it; "
-                f"and if real Cowork installs a `{name}` hook of its own, the harness does not reproduce it, "
-                f"so anything driven by that is absent here. (Cowork installs hooks of its own for "
+                f"itself installs only {', '.join(sorted(SERVED_HOOK_EVENTS))} on `initialize`. "
+                f"`hook_event_fired: {name}` / `hook_event_blocked: {name}` grade it from the agent's own "
+                f"hook_response frames (the harness passes --include-hook-events because this plugin declares "
+                f"hooks); but if real Cowork installs a `{name}` hook of its own, the harness does not reproduce "
+                f"it, so anything driven by that is absent here. (Cowork installs hooks of its own for "
                 f"PreToolUse, PostToolUse and UserPromptSubmit only.)",
-                "The harness does not block your hook — this is about assertability, not breakage. To gate "
-                "on its effect, assert the OBSERVABLE result instead (a file it writes, a tool it blocks), "
-                "not the hook itself.",
+                "The harness does not block your hook — this is about what is reproduced, not breakage. Assert "
+                "the hook with those keys, and its OBSERVABLE result as well (a file it writes, a tool it blocks) "
+                "for anything Cowork's own hooks would have driven.",
                 path, line_no,
             ))
         elif name.lower() in {e.lower() for e in KNOWN_HOOK_EVENTS}:
@@ -2269,9 +2277,16 @@ def _lint_skill_corpus_size(md_path):
     content the packager would cut. A proximity check that greens a corpus destined to be cut is worse
     than no check.
 
-    Still approximate in ONE direction only, and it now over- rather than under-counts: the packager
-    applies staging's git-tracked filter, so an untracked reference inflates this figure. That errs
-    toward warning early. The report's corpusCuts stays the authority."""
+    It diverges from what a critique actually packages on four axes, two each way. OVER-counts: an untracked reference that staging would never deliver (the
+    packager applies staging's git-tracked filter; this walk does not), and a symlink pointing outside
+    the plugin, which the packager's containment rule refuses to follow. UNDER-counts: a plugin-root
+    reference the graded agent only reaches by reading it during the run (added to the corpus at
+    critique time -- invisible to any static count), and any byte that fails strict UTF-8 decoding, which
+    the packager replaces with a 3-byte U+FFFD that st_size never sees (clean multibyte text round-trips
+    byte-exact, so this axis is zero on ordinary markdown). `cowork-harness critique
+    <folder> --corpus-only` runs the packager's own packageEvidence call over an empty run and prints the
+    six corpus fields directly: the packager's own git filter, containment rule and byte measurement,
+    and a stated FLOOR for the run-time-read clause (a read can only add to it)."""
     skill_dir = Path(md_path).parent
     total = 0
     files = [Path(md_path)]