cowork-harness 4.0.0 → 4.1.0

package/.claude/skills/cowork-harness/SKILL.md

@@ -3,8 +3,8 @@ name: cowork-harness
 description: Test or debug a Claude Code skill/plugin under Claude Cowork's runtime — sandboxed agent, default-deny egress, the can_use_tool permission/question protocol — using the cowork-harness CLI. Use when validating or regression-testing a skill, authoring or debugging a scenario YAML (prompt + scripted answers + assert:), choosing a fidelity tier, scripting AskUserQuestion / tool-permission answers, asserting artifacts, egress, or sub-agent dispatch, measuring how long each tool call took (toolDurations / trace), or debugging a failed run or verdict from its result.json or transcript. Especially when a harness run no-ops an assertion, fails on an unanswered gate, false-greens, a steered answer never reaches the model, or a web_fetch is unexpectedly denied or gated. Also when iterating or hardening a skill across fixes, or grounding a skill's self-critique against its own run evidence — including a document-analysis skill (cap table, deck, financial model, transcript) that needs an uploaded file attached to be critiqued at all. NOT for generic unit testing (pytest/vitest of your own scripts) or non-Cowork CI. Covers the skill / run / chat / record / replay / trace / decide / assertions / scaffold commands and the session-vs-scenario split.
 metadata:
   author: cowork-harness
-  version: 4.0.0
-  tracks-harness: cowork-harness 4.0.0 (baseline desktop-2.9939.4)
+  version: 4.1.0
+  tracks-harness: cowork-harness 4.1.0 (baseline desktop-2.9939.4)
 ---
 
 # cowork-harness
@@ -26,7 +26,7 @@ allowlist). This skill exists mostly to keep you out of those traps — the *Inv
 full landmine catalog in [`references/gotchas.md`](references/gotchas.md) are the highest-value part.
 Read them.
 
-> **Version note:** the facts and `file:line` pointers here track `cowork-harness 4.0.0` (baseline
+> **Version note:** the facts and `file:line` pointers here track `cowork-harness 4.1.0` (baseline
 > `desktop-2.9939.4`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
 > `SPEC.md` / `docs/*.md` over this snapshot, and re-run the bundled linter.
 
@@ -43,7 +43,7 @@ Before the first command, confirm the CLI is reachable and **fail loud** (never
 
 - **One-shot check.** Run `cowork-harness doctor [--tier <tier>]` first — a read-only prerequisite check that inspects Docker, the staged agent, the token, and the baseline in one pass. The bullets below explain each thing it checks (and how to fix it).
 - **Replay-only? Skip `doctor`.** Replaying committed cassettes needs no Docker, no staged agent, and no token — and every tier's `doctor` validates the auth token (the live tiers also Docker + the staged agent), so a ✗ there is expected, not a blocker. Go straight to `cowork-harness replay <cassette>`.
-- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 4.0.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@^4.0.0" <cmd>` (Node ≥ 22), or install once with `npm i -g "cowork-harness@^4.0.0"`. **Pin `@^4.0.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
+- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 4.1.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@^4.1.0" <cmd>` (Node ≥ 22), or install once with `npm i -g "cowork-harness@^4.1.0"`. **Pin `@^4.1.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
 
   This skill documents the CURRENT surface, not release history. If `cowork-harness --version` is
   OLDER than the floor, the per-release record of what you are missing is [CHANGELOG.md](https://github.com/yaniv-golan/cowork-harness/blob/main/CHANGELOG.md)
@@ -67,14 +67,11 @@ CI-grade scenario, and the post-hoc debug loop; the rest are narrower tools that
   no scenario file.
 - **Repeatable, asserted regression** → author a `scenarios/*.yaml` and run `cowork-harness run`.
   This is the CI-grade path and most of this skill.
-- **A run failed — or greened and you don't trust it** (the debugging loop) → don't re-run and hope.
-  The run already wrote its evidence to a **kept run dir** (`~/.cowork-harness/runs/…`; `--keep` prints
-  the path, `trace <run-id>` finds it). **Localize the failure post-hoc** from that evidence:
-  `cowork-harness trace <run-dir>`'s views + the emitted `result.json` to see what the run actually did,
-  then `verify-run` to re-check a suspect assertion — all token-free, no Docker, no re-record. This is
-  the loop 0.32.0's observability is built for; the *Triage* and *Inspecting a run's observability
-  output* sections in [`references/debugging.md`](references/debugging.md) are the detail (the fuller human-facing map lives in
-  [`docs/debugging.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/debugging.md) — repo-only, not shipped with the installed skill).
+- **A run failed — or greened and you don't trust it** (the debugging loop) → **Read
+  [`references/debugging.md`](references/debugging.md) before touching the run.** Its *Triage* table first
+  splits "the skill misbehaved" from "a green you don't trust" — they need different tools — then names the
+  tool for each, all token-free over the **kept run dir** (`~/.cowork-harness/runs/…`; `--keep` prints the
+  path, `trace <run-id>` finds it). Don't re-run and hope.
   **"Evidence" here means the RUN's own record** — events, trace, transcript. `critique`'s evaluator
   grades against a different artifact, `critique-evidence-package.txt`, which none of these tools
   surface; see `references/critique.md`.
@@ -136,8 +133,8 @@ behind each, is [`references/gotchas.md`](references/gotchas.md).
   (a cassette cannot be moved) → `replay` on the PR gate.
 - **Fix answers without paying:** `--keep` one run → `trace <run-dir> --view questions` → edit
   `answers:` → `verify-run <run-dir> <scenario.yaml>` → record once.
-- **Debug:** the triage table in `references/debugging.md` → `inspect`, `trace --view …`,
-  `verify-run`, `diff`. For a green you don't trust: `replay --explain`, then the gotchas.
+- **Debug:** Read `references/debugging.md` first — its triage table picks the tool (`inspect`,
+  `trace --view …`, `verify-run`, `diff`, `replay --explain`).
 - **Measure:** `--repeat N` for flakiness. `--ablate-skill` runs the control arm only; run the treatment
   arm yourself, with the model pinned and a recoverable source frozen.
 

package/.claude/skills/cowork-harness/references/assertion-catalog.md

@@ -1,6 +1,6 @@
 # Assertion catalog
 
-Tracks `cowork-harness 4.0.0` (baseline `desktop-2.9939.4`). Every `assert:` key with its semantics, and the
+Tracks `cowork-harness 4.1.0` (baseline `desktop-2.9939.4`). Every `assert:` key with its semantics, and the
 verdict-signal table. Which keys survive `replay` is in [`scenario-schema.md`](./scenario-schema.md#replay-class);
 the scenario and session YAML fields are there too.
 
@@ -102,7 +102,7 @@ same set live from the schema.
 | `allow_undelivered_deliverables: true` | verdict modifier — suppresses the `undelivered_deliverables` WARN. Working in the scratchpad is Cowork's designed pattern, so a skill that legitimately leaves intermediates, caches or downloaded inputs behind can say so instead of carrying permanent noise. The signal is warn-only and never fails a run on its own; reach for this when the scratch activity is intentional, not to silence a real delivery gap |
 | `allow_outputs_delete: true` | verdict modifier — accepts a detected outputs delete instead of failing the run, for a skill whose deletion is intended. Omitting `no_delete_in_outputs` does **not** permit deletes (a detected delete fails via the `outputs_delete` signal precisely because the key was not authored), so this is the way to accept one. **Mutually exclusive** with `no_delete_in_outputs`. Silences `outputs_delete`, `outputs_delete_unconfirmed` and `outputs_diff_unavailable`. Waives the harness's post-hoc detection; it does not model Cowork's `allow_cowork_file_delete` approval handshake |
 | `allow_delete_in: [<mount>…]` | verdict modifier — accepts detected deletes in the named mounts (the per-mount analogue of `allow_outputs_delete`, mirroring production's `fileDeleteApprovedMounts`). Waives the verdict only; detection still runs and the hits stay in `result.json`. Listing `outputs` conflicts with `no_delete_in_outputs` |
-| `transcript_no_host_path: true` | no host path (`/Users/`, `/opt/cowork/`, `/home/`, `/root/`, and the macOS `/private/var/`, `/private/tmp/`, `/var/folders/`, `/Volumes/` roots — also inside a `file://` or `computer://` link) leaked into model-visible text — **incompatible with `hostloop` AND `protocol`**: hostloop's native file tools legitimately expose real host paths, and protocol (L0) runs the agent's file tools on the real host cwd with no sealed filesystem, so this fails BY DESIGN on both (the harness warns at run start if asserted anyway); use `container`/`microvm` for this check |
+| `transcript_no_host_path: true` | no host path (`/Users/`, `/opt/cowork/`, `/home/`, `/root/`, and the macOS `/private/var/`, `/private/tmp/`, `/var/folders/`, `/Volumes/` roots — also inside a `file://` or `computer://` link) leaked into model-visible text (a path that came verbatim from the scenario's input files or prompt is exempt; `scan.hostPathsFromInputs` counts such paths) — **incompatible with `hostloop` AND `protocol`**: hostloop's native file tools legitimately expose real host paths, and protocol (L0) runs the agent's file tools on the real host cwd with no sealed filesystem, so this fails BY DESIGN on both (the harness warns at run start if asserted anyway); use `container`/`microvm` for this check |
 | `egress_denied: <host>` | the host was blocked by the egress proxy |
 | `egress_allowed: <host>` | the host was allowed through |
 | `no_mcp_error: true` | no MCP round-trip failed (`RunResult.mcpErrors` is empty — no unhandled server, no handler throw) — live-only: MCP round-trips are harness-computed, not in the SDK stdout stream, so evidence-unavailable on replay (never a vacuous pass). **Only `true` is valid** |
@@ -140,7 +140,7 @@ codes (`VerdictSignal["code"]` in `src/run/verdict.ts`):
 | `outputs_delete_unconfirmed` | warn | A delete-shaped command near `mnt/outputs` nothing confirms: no output present at turn start was deleted and no flagged delete has an outputs path as its own operand (e.g. a Python variable named `rm` next to an outputs path, quoted prose, a `sed`/`grep` pattern). A *statement* is a fragment split on newline/`;`/`&&`/`\|\|`, quote-blind, so some real deletes also land here — a loop body whose operand is the loop variable (`for f in …; do rm "$f"; done`), a `cd` then a relative path, chained variables (`A=…; B=$A/x; rm "$B"`), a Python path held in a variable set on another line (`p = …` then `os.remove(p)`, or `for p in …:` then `p.unlink()`), wrappers with flag combinations the classifier does not model (`sudo -Hu user rm`, `git -C dir rm`), and calls outside the modelled set such as Node's `fs.promises.rm(…)` — read the command. Raised even when `no_delete_in_outputs` is authored (that assertion passes on it). Kept false positives that still fail `outputs_delete`: quoted text in which a delete command with an outputs operand follows a shell separator, subshell or keyword — the classifier does not track quotes (`echo 'note; rm mnt/outputs/x'`, `echo "a & rm …/outputs/x"`), and a heredoc that *writes* a script rather than running it (`cat <<EOF > clean.sh` with an `rm …/outputs/x` line). Waive: `allow_outputs_delete` |
 | `outputs_diff_unavailable` | warn | The per-turn filesystem diff of `outputs/` could not verify this turn and the text scan flagged nothing — a delete made without a bash command would have gone undetected. With a text hit the turn fails `outputs_delete` instead |
 | `mount_delete` | warn | A delete touched a delete-denied mount other than `outputs` (a `rw` connected folder). Production denies `unlink`/`rmdir` there until per-mount approval, so the run diverged. Warn, not fail: the harness detects post-hoc what production enforces. Author `no_delete_in_mounts` to hard-fail, or `allow_delete_in` to waive |
-| `host_path_leak` | fail | A host path leaked into model-visible text (opt out: author `transcript_no_host_path`) |
+| `host_path_leak` | fail | A host path leaked into model-visible text (opt out: author `transcript_no_host_path`). A path copied verbatim from the scenario's own uploads, connected folders or prompt is not a leak |
 | `l0_host_config_contamination` | fail | `protocol` ran against the operator's REAL config dir, so host-installed plugins/skills/memory/MCP may have answered instead of the thing under test — the run did not necessarily measure it (opt out: `allow_l0_host_config_contamination`). Name predates the meaning: delivery at L0 works, contamination is what this reports |
 | `missing_capability` | fail | A `requires_capabilities` need was unmet, or the skill used a capability the image omits (opt out: `allow_missing_capability`, or `skill --allow-missing-capability` on an open-ended run) |
 | `infra_error` | fail | A supervising process died mid-run (VM/egress sidecar) — the run's evidence is contaminated, not author-suppressible |

package/.claude/skills/cowork-harness/references/assertions-guide.md

@@ -1,6 +1,6 @@
 # Assertions guide
 
-Tracks `cowork-harness 4.0.0` (baseline `desktop-2.9939.4`). Read it when choosing assertion keys: the two orthogonal axes and the goal → key map. The full catalog is `assertion-catalog.md`.
+Tracks `cowork-harness 4.1.0` (baseline `desktop-2.9939.4`). Read it when choosing assertion keys: the two orthogonal axes and the goal → key map. The full catalog is `assertion-catalog.md`.
 
 ### Assertions: two orthogonal axes
 

package/.claude/skills/cowork-harness/references/authoring.md

@@ -1,6 +1,6 @@
 # Authoring a scenario
 
-Tracks `cowork-harness 4.0.0` (baseline `desktop-2.9939.4`). Read it when composing a `scenarios/*.yaml`: session vs scenario, discovery, the fidelity tier, the answer path, `web_fetch`, and scaffold + lint.
+Tracks `cowork-harness 4.1.0` (baseline `desktop-2.9939.4`). Read it when composing a `scenarios/*.yaml`: session vs scenario, discovery, the fidelity tier, the answer path, `web_fetch`, and scaffold + lint.
 
 ## Part I — AUTHOR a scenario
 

package/.claude/skills/cowork-harness/references/ci-recipe.md

@@ -1,6 +1,6 @@
 # CI recipe — replay vs live lanes
 
-Self-contained reference. Tracks `cowork-harness 4.0.0` (baseline `desktop-2.9939.4`).
+Self-contained reference. Tracks `cowork-harness 4.1.0` (baseline `desktop-2.9939.4`).
 
 **Fastest path: the packaged Action.** One step gets you `replay`/`lint`/`verify-cassettes` plus a PR
 job-summary reporter (verdict table, staleness findings, cost/turns when available):
@@ -17,7 +17,7 @@ job-summary reporter (verdict table, staleness findings, cost/turns when availab
 CLI major reaches your workflow the moment it is promoted even though your `uses:` ref never changed — so a
 copy-pasted recipe that omits the input takes a major bump with no say in it. `^4` holds the major, needs no
 patch number to remember, and only wants a human decision at the next major. Pin an exact version
-(e.g. `version: "4.0.0"`) instead when you want byte-reproducible CI.
+(e.g. `version: "4.1.0"`) instead when you want byte-reproducible CI.
 
 Reach for the manual multi-step form below only when you need per-step control the Action's inputs don't
 cover (a custom flag combination, a different runner matrix per step, or `lint`/`verify-cassettes` gated
@@ -82,7 +82,7 @@ sha256-*checked* but not hard-blocking on mismatch — it's advisory for an inte
 GitHub-hosted runners, no token/Docker/agent:
 
 ```yaml
-- run: npm i -g "cowork-harness@^4.0.0"
+- run: npm i -g "cowork-harness@^4.1.0"
 - run: cowork-harness lint scenarios/*.yaml --strict --min-severity WARN
                                                     # no silent false-greens. WITHOUT --strict this
                                                     # step cannot fail on a WARN-class rule (e.g.
@@ -93,7 +93,16 @@ GitHub-hosted runners, no token/Docker/agent:
                                                     # 3.x CLI bare `--strict` also fails on INFO, so keep
                                                     # the pair explicit. `--min-severity INFO` gates on
                                                     # INFO as well. (`lint-skill --strict` never fails
-                                                    # on INFO and has no floor to widen.)
+                                                    # on INFO and has no floor to widen; to accept a
+                                                    # reviewed lint-skill WARN, keep --strict and add
+                                                    # `--ignore-rule <rule>[=<skill-dir>/<path>]` or an
+                                                    # ignore-start/ignore-end marker in the SKILL.md.)
+- run: cowork-harness lint scenarios/*.yaml --strict --min-severity INFO --cassette-dir cassettes/
+                                                    # committed *.cassette.json evidence suppresses only
+                                                    # replay advisories proven by every matching cassette;
+                                                    # skipped or malformed cassettes stay visible.
+                                                    # Staleness does not affect this existence check;
+                                                    # verify-cassettes checks freshness and drift.
 - run: cowork-harness verify-cassettes cassettes/    # privacy + staleness — FAILS on a stale recording
                                                     # ALSO fails on a leaked host inventory: recording at
                                                     # protocol/hostloop freezes YOUR machine's MCP servers,
@@ -332,7 +341,16 @@ A typical skill repo runs four stages, fastest/cheapest first:
 
    This is the shape a CI step wants: **silent on success (no output, exit 0), loud and specific on
    failure** — `--quiet` suppresses the readiness preview but never the `✗ broken:` lines, which name the
-   offending file *and* the rejected key, one line per file, and the step still exits 1. Point `lint`
+   offending file *and* the rejected key, one line per file, and the step still exits 1. It exits 0,
+   though, on an input the real record would refuse (a missing path, an unknown baseline name, a
+   tier-vacuous `tool_not_called`): that prints a `⚠ input error:` line and lands in `inputErrors[]`. To
+   gate on those too, use the JSON form (4.1.0 and later):
+
+   ```bash
+   cowork-harness record scenarios/ --dry-run --output-format json | jq -e '.ok and (.inputErrors == [])'
+   ```
+
+   Point `lint`
    at scenarios only: a session or matrix YAML in the linted set is reported as a file that does not
    load.
 
@@ -373,7 +391,7 @@ jobs:
         with: { node-version: '24' }
       - uses: actions/setup-python@v5
         with: { python-version: '3.x' }                                       # python3 only — PyYAML is bundled with the linter
-      - run: npm i -g "cowork-harness@^4.0.0"
+      - run: npm i -g "cowork-harness@^4.1.0"
       - run: cowork-harness lint scenarios/*.yaml                              # no-silent-false-green (needs python3; PyYAML bundled)
       - run: cowork-harness verify-cassettes cassettes/ --output-format json   # privacy + staleness gate
       - run: cowork-harness replay cassettes/ --output-format json             # token-free content/structure
@@ -402,7 +420,7 @@ jobs:
             echo "live=true" >> "$GITHUB_OUTPUT"
           fi
       - if: steps.guard.outputs.live == 'true'
-        run: npm i -g "cowork-harness@^4.0.0"
+        run: npm i -g "cowork-harness@^4.1.0"
       - if: steps.guard.outputs.live == 'true'
         run: cowork-harness run scenarios/ --output-format json
         env:

package/.claude/skills/cowork-harness/references/critique.md

@@ -1,6 +1,6 @@
 # Critique — the facts a plugin install can't otherwise reach
 
-Tracks `cowork-harness 4.0.0` (baseline `desktop-2.9939.4`). This is **not** a trim of the full
+Tracks `cowork-harness 4.1.0` (baseline `desktop-2.9939.4`). This is **not** a trim of the full
 [`docs/critique.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/critique.md) (repo-only —
 flags, cost, reproduction discipline, known limitations all live there). This file covers exactly what a
 plugin install cannot otherwise discover: the run-dir artifact a harvester actually reads, the report's

package/.claude/skills/cowork-harness/references/debugging.md

@@ -1,13 +1,15 @@
 # Debugging a run
 
-Tracks `cowork-harness 4.0.0` (baseline `desktop-2.9939.4`). Read it when a run misbehaved or a green looks wrong: triage, the observability output, and `chat`.
+Tracks `cowork-harness 4.1.0` (baseline `desktop-2.9939.4`). Read it when a run misbehaved or a green looks wrong: triage, the observability output, and `chat`.
 
 ## Part III — Debug
 
 A run misbehaved, or greened when you don't trust it. Debugging is a first-class loop, not an
 afterthought: the run already wrote its evidence, so you **localize the failure post-hoc** rather than
 re-run and hope. Start at the triage below, then use the observability output and, when you need to
-reproduce interactively, `chat`.
+reproduce interactively, `chat`. (The fuller human-facing map is
+[`docs/debugging.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/debugging.md) — repo-only,
+not shipped with the installed skill.)
 
 > **"Evidence" below means the run's own record** — events, trace, transcript; what `trace` / `inspect` /
 > `diff` / `verify-run` / `replay --explain` read. `critique`'s **evaluator** grades against a separate,
@@ -32,6 +34,11 @@ agent stderr) — read those before re-running; a re-record rarely tells you mor
 already does.
 <!-- END triage-canonical -->
 
+**microvm: "control-protocol write failed" with `env: 'claude': No such file or directory` in the agent
+stderr** usually means the VM never finished provisioning (the agent never reached PATH). Check
+`cowork-harness vm status` — a `provisioning` other than `ready` confirms it — and if a run does not
+recover it on its own, `cowork-harness vm delete` and retry.
+
 **Is it your skill's bug, or a known harness gap?** Before deep-debugging a wrong behavior, rule out a
 **deliberate fidelity gap** — the harness intentionally does *not* reproduce a few real-Cowork behaviors,
 so a "bug" you see here that real Cowork also has isn't yours to fix. The tier semantics are in

package/.claude/skills/cowork-harness/references/fidelity-and-answers.md

@@ -1,6 +1,6 @@
 # Fidelity tiers & answer paths
 
-Self-contained reference. Tracks `cowork-harness 4.0.0` (baseline `desktop-2.9939.4`).
+Self-contained reference. Tracks `cowork-harness 4.1.0` (baseline `desktop-2.9939.4`).
 
 > **This page vs. the repo docs.** This is the **offline snapshot** that ships inside the installed
 > plugin — it is self-contained on purpose. The repo carries four other fidelity views, each answering a
@@ -73,7 +73,9 @@ The instance is `cowork-vm-<config-hash>` — a config or agent-version change y
 stale VM is never silently reused (the old one is orphaned until `vm prune`). Pin a fixed name with
 `COWORK_LIMA_INSTANCE`. The optional argument to every `vm` subcommand is a **baseline**
 (`desktop-<version>`, default `latest`), never the `cowork-vm-<hash>` VM name — passing a VM name is a
-usage error that names the baseline(s) deriving it.
+usage error that names the baseline(s) deriving it. A Running VM is used only once its provisioning has
+finished (a run waits up to `COWORK_VM_PROVISION_TIMEOUT_S`, default 900 s); `microvm <instance> never
+finished provisioning (…)` means it will not — `cowork-harness vm delete` and retry.
 
 ## Answer paths (resolving gates: AskUserQuestion + tool-permission)
 
@@ -325,7 +327,7 @@ up often enough to spell out:
 - `COWORK_HARNESS_SCRUB_KEYS` / `COWORK_HARNESS_SCRUB_VALUES` — extra env names / literal values to
   redact from logs (beyond the auth tokens + `ANTHROPIC_CUSTOM_HEADERS`).
 - `COWORK_HARNESS_SOFT_MISSING` — downgrade a missing mount source from hard-error to warn-and-skip.
-- `COWORK_VM_GATEWAY` / `COWORK_VM_PROXY_PORT` / `COWORK_LIMA_INSTANCE` — L2 (microVM) knobs.
+- `COWORK_VM_GATEWAY` / `COWORK_VM_PROXY_PORT` / `COWORK_LIMA_INSTANCE` / `COWORK_VM_PROVISION_TIMEOUT_S` — L2 (microVM) knobs.
 - `COWORK_LOCKDOWN` — default `on`: gates sandbox hardening on every isolated tier — **aborts loudly**
   if the L2 guest firewall fails to apply (no silent unprotected run), and also gates the
   `container`/`hostloop` Docker hardening. Set `=off` to opt out and run without isolation deliberately.

package/.claude/skills/cowork-harness/references/gotchas.md

@@ -1,6 +1,6 @@
 # Gotchas
 
-Tracks `cowork-harness 4.0.0` (baseline `desktop-2.9939.4`). The full "✓ passed ≠ correct" landmine catalog.
+Tracks `cowork-harness 4.1.0` (baseline `desktop-2.9939.4`). The full "✓ passed ≠ correct" landmine catalog.
 
 ## Gotchas — the "✓ passed ≠ correct" landmines
 
@@ -214,13 +214,17 @@ authorable). Reach for this list when debugging a run's behavior, that one while
 
 22. **`lint` floods CI with INFO advisories that don't apply to you.** *Why:* two rules —
     `manifest-needs-snapshot` and `gate-needs-controlout` — fire on the mere presence of manifest/gate
-    assertion keys. The linter is **static**: it never reads your cassettes, so it cannot know whether
-    yours already carry an `artifacts` manifest and `controlOut` (a current cassette does). On a healthy
-    fleet every one of those lines is a false alarm. One exception: `manifest-needs-snapshot` is
-    suppressed for `user_visible_artifact` on `lane: remote` — the only manifest-backed key that lane also
-    rejects outright (`lane-remote-incompatible-key`, an ERROR), so the INFO would be redundant advice
-    about a key the scenario can never even load with. `gate-needs-controlout` has no such exception. *Fix:*
-    `lint --min-severity WARN` in CI (≥1.11.0) — the INFO advisories stay one flag away for interactive use.
+    assertion keys. The linter is **static** until you opt in to cassette evidence. With committed
+    recordings, pass `lint --cassette-dir <dir>` (or one cassette file): it scans the same `*.cassette.json`
+    shape as replay and verify-cassettes, resolves each exact `scenarioSource` relative to its cassette,
+    and suppresses an advisory only when **all** matching cassettes carry the evidence the replay lane
+    needs. A malformed, wrong-shaped, unsupported-version, or provenance-less cassette is reported as INFO
+    and keeps the advisory visible — even beside a healthy sibling. The two dedicated diff assertions also
+    require their respective `preRunPaths` / `preRunHashes` baselines, and a non-empty `controlOut` /
+    artifact manifest is required where replay needs it. For a strict CI gate that keeps actionable INFO
+    rules visible while suppressing only proven replay noise, use `lint --strict --min-severity INFO
+    --cassette-dir <dir>`. Without the opt-in path, use `lint --min-severity WARN` in CI (≥1.11.0) to hide
+    the INFO class.
     From 4.0.0 WARN is `--strict`'s default floor, so bare `lint --strict` hides and passes INFO; add
     `--min-severity INFO` to fail on it. `--strict --min-severity ERROR` behaves as a plain lint, not a
     contradiction.

package/.claude/skills/cowork-harness/references/measurement.md

@@ -1,6 +1,6 @@
 # Measurement
 
-Tracks `cowork-harness 4.0.0` (baseline `desktop-2.9939.4`). Read it before comparing runs: `--repeat`, `--ablate-skill`, and the hygiene that keeps a batch valid.
+Tracks `cowork-harness 4.1.0` (baseline `desktop-2.9939.4`). Read it before comparing runs: `--repeat`, `--ablate-skill`, and the hygiene that keeps a batch valid.
 
 ### Measure — before/after, with/without (`--repeat`, `--ablate-skill`)
 

package/.claude/skills/cowork-harness/references/run-record-replay.md

@@ -1,6 +1,6 @@
 # Run, record and lock
 
-Tracks `cowork-harness 4.0.0` (baseline `desktop-2.9939.4`). Read it when running a scenario, recording or placing a cassette, reading verdict signals, checking a background run, or choosing CI lanes.
+Tracks `cowork-harness 4.1.0` (baseline `desktop-2.9939.4`). Read it when running a scenario, recording or placing a cassette, reading verdict signals, checking a background run, or choosing CI lanes.
 
 ## Part II — RUN, RECORD & LOCK
 
@@ -29,8 +29,11 @@ one a paid run would give. On a **directory** the path-dependent verdicts (host-
 portability) are reported as `⚠ would-refuse (advisory)` / `⚠ would-warn (advisory)` notes — the label follows
 the verdict kind, and portability can only ever warn — that do NOT affect the exit code — a dir target
 takes no `--out`, so the destination is a guess — and only the path-independent ones (prompt policy, assert
-contradiction, duplicate cassette target) gate the batch. So a directory dry-run CAN exit 0 on a scenario the
-real `record` would refuse; re-run that one file with its real flags for a binding answer. A directory also
+contradiction, duplicate cassette target) gate the batch. An input the real record would refuse — a missing
+path, an unknown baseline name, a `tool_not_called` the tier can never violate — is listed under
+`inputErrors[]` with a `⚠ input error:` line, also at exit 0. So a directory dry-run CAN exit 0 on a scenario the
+real `record` would refuse; re-run that one file with its real flags for a binding answer, or gate on
+`.ok and (.inputErrors == [])` in the JSON payload (4.1.0 and later). A directory also
 reports every offender and the batch cost estimate. `lint` checks the assertion invariants AND that each file loads (the same loader, plus a named `baseline:`), but not the pre-spend refusals.
 
 **Which arm to reach for.** They answer different questions, and picking the wrong one is why a consumer
@@ -249,7 +252,9 @@ Recognize these before "fixing" a non-bug:
   `container`/`microvm`, but only *fires* on an actual scanned leak with no authored
   `transcript_no_host_path`. At `fidelity: cowork` the skip follows the **resolved** tier, so a `cowork`
   run that lands on `container` is armed. Author `transcript_no_host_path` to enforce cleanliness where
-  it's valid.
+  it's valid. A host path that came verbatim from the scenario's own uploads, connected folders or prompt
+  is not a leak (whole-token match; a token cut short where the path goes on, or one naming a location the
+  harness created for the run, is never exempt); `scan.hostPathsFromInputs` counts the paths exempted.
 - **`exec_infra_error`** (`WARN`, host-loop) — one or more container `exec` calls failed for
   infrastructure reasons (daemon/container-level), so those tool calls returned an error to the agent
   rather than the command's own output. Warn-severity because the run's other evidence is intact — unlike

package/.claude/skills/cowork-harness/references/scenario-schema.md

@@ -1,6 +1,6 @@
 # Scenario & session schema, replay class, web_fetch, authoring gotchas
 
-Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 4.0.0`
+Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 4.1.0`
 (baseline `desktop-2.9939.4`). If your checkout is newer, prefer the live [`docs/scenario.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/scenario.md),
 [`docs/session.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/session.md), and `SPEC.md`.
 
@@ -73,7 +73,7 @@ answers:                            # scripted answers (see below)
   - when_question: "Which output format"
     choose: "Markdown"
   - when_tool: Bash
-    allow_if: "!command.includes('rm')"
+    allow_if: '!/\brm\b/.test(command)' # a word match; `includes('rm')` also denies "normalize"
     else: deny
   - when_tool: Write
     decide: allow
@@ -238,7 +238,8 @@ with no session file, the CLI flags `--folder <dir>` and `--upload <file>` are t
 `plugins.remote_plugins` instead — Cowork serves an installed plugin from `.remote-plugins/plugin_<id>`
 (named by id, not plugin name), while `local_plugins` mounts two levels deeper
 (`.local-plugins/marketplaces/local-desktop-app-uploads/<plugin>`). The choice matters to a skill that
-locates its own files from the shell (`$CLAUDE_PLUGIN_ROOT` is unset in the VM shell on every tier).
+locates its own files from the shell (at host-loop, Cowork's default, the braced `${CLAUDE_PLUGIN_ROOT}` is
+replaced with a HOST path and a bare `$CLAUDE_PLUGIN_ROOT` is empty in the VM shell).
 Search for the skill's own `SKILL.md`, not for a directory named after the plugin — that finds nothing
 under `.remote-plugins/plugin_<id>` — and set no `-maxdepth` that stops short of the deeper local layout:
 `find /sessions/*/mnt/.local-plugins /sessions/*/mnt/.remote-plugins -path '*/skills/<skill-name>/SKILL.md' 2>/dev/null | head -1`.
@@ -281,7 +282,7 @@ label validation by intent (mutually exclusive with `choose`):
 - when_tool: Write
   decide: allow                   # allow | deny
 - when_tool: Bash
-  allow_if: "!command.includes('rm') && !command.includes('curl')"  # JS predicate over tool input
+  allow_if: '!/\brm\b/.test(command) && !command.includes("curl")'  # JS predicate over tool input
   else: deny                      # decision when predicate is false (default deny)
 - when_tool: "webfetch:example.com"   # a web_fetch approval (provenance-miss gate)
   decide: allow

package/.claude/skills/cowork-harness/references/task-recipes.md

@@ -2,7 +2,7 @@
 
 Each recipe composes facts that live scattered across SKILL.md and the other references into one
 decision path. Every one answers a question a real fleet owner had to work out the hard way.
-Tracks `cowork-harness 4.0.0` (baseline `desktop-2.9939.4`), same as SKILL.md's front-matter. Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
+Tracks `cowork-harness 4.1.0` (baseline `desktop-2.9939.4`), same as SKILL.md's front-matter. Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
 Recipe 3's `init-redact` shipped in 0.24.0 and are part of the current feature set — no version gate
 needed if your CLI meets SKILL.md's version floor.