cowork-harness 4.0.0 → 4.1.1

package/.claude/skills/cowork-harness/SKILL.md

@@ -3,8 +3,8 @@ name: cowork-harness
 description: Test or debug a Claude Code skill/plugin under Claude Cowork's runtime — sandboxed agent, default-deny egress, the can_use_tool permission/question protocol — using the cowork-harness CLI. Use when validating or regression-testing a skill, authoring or debugging a scenario YAML (prompt + scripted answers + assert:), choosing a fidelity tier, scripting AskUserQuestion / tool-permission answers, asserting artifacts, egress, or sub-agent dispatch, measuring how long each tool call took (toolDurations / trace), or debugging a failed run or verdict from its result.json or transcript. Especially when a harness run no-ops an assertion, fails on an unanswered gate, false-greens, a steered answer never reaches the model, or a web_fetch is unexpectedly denied or gated. Also when iterating or hardening a skill across fixes, or grounding a skill's self-critique against its own run evidence — including a document-analysis skill (cap table, deck, financial model, transcript) that needs an uploaded file attached to be critiqued at all. NOT for generic unit testing (pytest/vitest of your own scripts) or non-Cowork CI. Covers the skill / run / chat / record / replay / trace / decide / assertions / scaffold commands and the session-vs-scenario split.
 metadata:
   author: cowork-harness
-  version: 4.0.0
-  tracks-harness: cowork-harness 4.0.0 (baseline desktop-2.9939.4)
+  version: 4.1.1
+  tracks-harness: cowork-harness 4.1.1 (baseline desktop-2.9939.4)
 ---
 
 # cowork-harness
@@ -26,7 +26,7 @@ allowlist). This skill exists mostly to keep you out of those traps — the *Inv
 full landmine catalog in [`references/gotchas.md`](references/gotchas.md) are the highest-value part.
 Read them.
 
-> **Version note:** the facts and `file:line` pointers here track `cowork-harness 4.0.0` (baseline
+> **Version note:** the facts and `file:line` pointers here track `cowork-harness 4.1.1` (baseline
 > `desktop-2.9939.4`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
 > `SPEC.md` / `docs/*.md` over this snapshot, and re-run the bundled linter.
 
@@ -43,7 +43,7 @@ Before the first command, confirm the CLI is reachable and **fail loud** (never
 
 - **One-shot check.** Run `cowork-harness doctor [--tier <tier>]` first — a read-only prerequisite check that inspects Docker, the staged agent, the token, and the baseline in one pass. The bullets below explain each thing it checks (and how to fix it).
 - **Replay-only? Skip `doctor`.** Replaying committed cassettes needs no Docker, no staged agent, and no token — and every tier's `doctor` validates the auth token (the live tiers also Docker + the staged agent), so a ✗ there is expected, not a blocker. Go straight to `cowork-harness replay <cassette>`.
-- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 4.0.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@^4.0.0" <cmd>` (Node ≥ 22), or install once with `npm i -g "cowork-harness@^4.0.0"`. **Pin `@^4.0.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
+- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 4.1.1**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@^4.1.1" <cmd>` (Node ≥ 22), or install once with `npm i -g "cowork-harness@^4.1.1"`. **Pin `@^4.1.1`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
 
   This skill documents the CURRENT surface, not release history. If `cowork-harness --version` is
   OLDER than the floor, the per-release record of what you are missing is [CHANGELOG.md](https://github.com/yaniv-golan/cowork-harness/blob/main/CHANGELOG.md)
@@ -67,14 +67,11 @@ CI-grade scenario, and the post-hoc debug loop; the rest are narrower tools that
   no scenario file.
 - **Repeatable, asserted regression** → author a `scenarios/*.yaml` and run `cowork-harness run`.
   This is the CI-grade path and most of this skill.
-- **A run failed — or greened and you don't trust it** (the debugging loop) → don't re-run and hope.
-  The run already wrote its evidence to a **kept run dir** (`~/.cowork-harness/runs/…`; `--keep` prints
-  the path, `trace <run-id>` finds it). **Localize the failure post-hoc** from that evidence:
-  `cowork-harness trace <run-dir>`'s views + the emitted `result.json` to see what the run actually did,
-  then `verify-run` to re-check a suspect assertion — all token-free, no Docker, no re-record. This is
-  the loop 0.32.0's observability is built for; the *Triage* and *Inspecting a run's observability
-  output* sections in [`references/debugging.md`](references/debugging.md) are the detail (the fuller human-facing map lives in
-  [`docs/debugging.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/debugging.md) — repo-only, not shipped with the installed skill).
+- **A run failed — or greened and you don't trust it** (the debugging loop) → **Read
+  [`references/debugging.md`](references/debugging.md) before touching the run.** Its *Triage* table first
+  splits "the skill misbehaved" from "a green you don't trust" — they need different tools — then names the
+  tool for each, all token-free over the **kept run dir** (`~/.cowork-harness/runs/…`; `--keep` prints the
+  path, `trace <run-id>` finds it). Don't re-run and hope.
   **"Evidence" here means the RUN's own record** — events, trace, transcript. `critique`'s evaluator
   grades against a different artifact, `critique-evidence-package.txt`, which none of these tools
   surface; see `references/critique.md`.
@@ -136,8 +133,8 @@ behind each, is [`references/gotchas.md`](references/gotchas.md).
   (a cassette cannot be moved) → `replay` on the PR gate.
 - **Fix answers without paying:** `--keep` one run → `trace <run-dir> --view questions` → edit
   `answers:` → `verify-run <run-dir> <scenario.yaml>` → record once.
-- **Debug:** the triage table in `references/debugging.md` → `inspect`, `trace --view …`,
-  `verify-run`, `diff`. For a green you don't trust: `replay --explain`, then the gotchas.
+- **Debug:** Read `references/debugging.md` first — its triage table picks the tool (`inspect`,
+  `trace --view …`, `verify-run`, `diff`, `replay --explain`).
 - **Measure:** `--repeat N` for flakiness. `--ablate-skill` runs the control arm only; run the treatment
   arm yourself, with the model pinned and a recoverable source frozen.
 

package/.claude/skills/cowork-harness/references/assertion-catalog.md

@@ -1,6 +1,6 @@
 # Assertion catalog
 
-Tracks `cowork-harness 4.0.0` (baseline `desktop-2.9939.4`). Every `assert:` key with its semantics, and the
+Tracks `cowork-harness 4.1.1` (baseline `desktop-2.9939.4`). Every `assert:` key with its semantics, and the
 verdict-signal table. Which keys survive `replay` is in [`scenario-schema.md`](./scenario-schema.md#replay-class);
 the scenario and session YAML fields are there too.
 
@@ -102,7 +102,7 @@ same set live from the schema.
 | `allow_undelivered_deliverables: true` | verdict modifier — suppresses the `undelivered_deliverables` WARN. Working in the scratchpad is Cowork's designed pattern, so a skill that legitimately leaves intermediates, caches or downloaded inputs behind can say so instead of carrying permanent noise. The signal is warn-only and never fails a run on its own; reach for this when the scratch activity is intentional, not to silence a real delivery gap |
 | `allow_outputs_delete: true` | verdict modifier — accepts a detected outputs delete instead of failing the run, for a skill whose deletion is intended. Omitting `no_delete_in_outputs` does **not** permit deletes (a detected delete fails via the `outputs_delete` signal precisely because the key was not authored), so this is the way to accept one. **Mutually exclusive** with `no_delete_in_outputs`. Silences `outputs_delete`, `outputs_delete_unconfirmed` and `outputs_diff_unavailable`. Waives the harness's post-hoc detection; it does not model Cowork's `allow_cowork_file_delete` approval handshake |
 | `allow_delete_in: [<mount>…]` | verdict modifier — accepts detected deletes in the named mounts (the per-mount analogue of `allow_outputs_delete`, mirroring production's `fileDeleteApprovedMounts`). Waives the verdict only; detection still runs and the hits stay in `result.json`. Listing `outputs` conflicts with `no_delete_in_outputs` |
-| `transcript_no_host_path: true` | no host path (`/Users/`, `/opt/cowork/`, `/home/`, `/root/`, and the macOS `/private/var/`, `/private/tmp/`, `/var/folders/`, `/Volumes/` roots — also inside a `file://` or `computer://` link) leaked into model-visible text — **incompatible with `hostloop` AND `protocol`**: hostloop's native file tools legitimately expose real host paths, and protocol (L0) runs the agent's file tools on the real host cwd with no sealed filesystem, so this fails BY DESIGN on both (the harness warns at run start if asserted anyway); use `container`/`microvm` for this check |
+| `transcript_no_host_path: true` | no host path (`/Users/`, `/opt/cowork/`, `/home/`, `/root/`, and the macOS `/private/var/`, `/private/tmp/`, `/var/folders/`, `/Volumes/` roots — also inside a `file://` or `computer://` link) leaked into model-visible text (a path that came verbatim from the scenario's input files or prompt is exempt; `scan.hostPathsFromInputs` counts such paths) — **incompatible with `hostloop` AND `protocol`**: hostloop's native file tools legitimately expose real host paths, and protocol (L0) runs the agent's file tools on the real host cwd with no sealed filesystem, so this fails BY DESIGN on both (the harness warns at run start if asserted anyway); use `container`/`microvm` for this check |
 | `egress_denied: <host>` | the host was blocked by the egress proxy |
 | `egress_allowed: <host>` | the host was allowed through |
 | `no_mcp_error: true` | no MCP round-trip failed (`RunResult.mcpErrors` is empty — no unhandled server, no handler throw) — live-only: MCP round-trips are harness-computed, not in the SDK stdout stream, so evidence-unavailable on replay (never a vacuous pass). **Only `true` is valid** |
@@ -140,7 +140,7 @@ codes (`VerdictSignal["code"]` in `src/run/verdict.ts`):
 | `outputs_delete_unconfirmed` | warn | A delete-shaped command near `mnt/outputs` nothing confirms: no output present at turn start was deleted and no flagged delete has an outputs path as its own operand (e.g. a Python variable named `rm` next to an outputs path, quoted prose, a `sed`/`grep` pattern). A *statement* is a fragment split on newline/`;`/`&&`/`\|\|`, quote-blind, so some real deletes also land here — a loop body whose operand is the loop variable (`for f in …; do rm "$f"; done`), a `cd` then a relative path, chained variables (`A=…; B=$A/x; rm "$B"`), a Python path held in a variable set on another line (`p = …` then `os.remove(p)`, or `for p in …:` then `p.unlink()`), wrappers with flag combinations the classifier does not model (`sudo -Hu user rm`, `git -C dir rm`), and calls outside the modelled set such as Node's `fs.promises.rm(…)` — read the command. Raised even when `no_delete_in_outputs` is authored (that assertion passes on it). Kept false positives that still fail `outputs_delete`: quoted text in which a delete command with an outputs operand follows a shell separator, subshell or keyword — the classifier does not track quotes (`echo 'note; rm mnt/outputs/x'`, `echo "a & rm …/outputs/x"`), and a heredoc that *writes* a script rather than running it (`cat <<EOF > clean.sh` with an `rm …/outputs/x` line). Waive: `allow_outputs_delete` |
 | `outputs_diff_unavailable` | warn | The per-turn filesystem diff of `outputs/` could not verify this turn and the text scan flagged nothing — a delete made without a bash command would have gone undetected. With a text hit the turn fails `outputs_delete` instead |
 | `mount_delete` | warn | A delete touched a delete-denied mount other than `outputs` (a `rw` connected folder). Production denies `unlink`/`rmdir` there until per-mount approval, so the run diverged. Warn, not fail: the harness detects post-hoc what production enforces. Author `no_delete_in_mounts` to hard-fail, or `allow_delete_in` to waive |
-| `host_path_leak` | fail | A host path leaked into model-visible text (opt out: author `transcript_no_host_path`) |
+| `host_path_leak` | fail | A host path leaked into model-visible text (opt out: author `transcript_no_host_path`). A path copied verbatim from the scenario's own uploads, connected folders or prompt is not a leak |
 | `l0_host_config_contamination` | fail | `protocol` ran against the operator's REAL config dir, so host-installed plugins/skills/memory/MCP may have answered instead of the thing under test — the run did not necessarily measure it (opt out: `allow_l0_host_config_contamination`). Name predates the meaning: delivery at L0 works, contamination is what this reports |
 | `missing_capability` | fail | A `requires_capabilities` need was unmet, or the skill used a capability the image omits (opt out: `allow_missing_capability`, or `skill --allow-missing-capability` on an open-ended run) |
 | `infra_error` | fail | A supervising process died mid-run (VM/egress sidecar) — the run's evidence is contaminated, not author-suppressible |

package/.claude/skills/cowork-harness/references/assertions-guide.md

@@ -1,6 +1,6 @@
 # Assertions guide
 
-Tracks `cowork-harness 4.0.0` (baseline `desktop-2.9939.4`). Read it when choosing assertion keys: the two orthogonal axes and the goal → key map. The full catalog is `assertion-catalog.md`.
+Tracks `cowork-harness 4.1.1` (baseline `desktop-2.9939.4`). Read it when choosing assertion keys: the two orthogonal axes and the goal → key map. The full catalog is `assertion-catalog.md`.
 
 ### Assertions: two orthogonal axes
 

package/.claude/skills/cowork-harness/references/authoring.md

@@ -1,6 +1,6 @@
 # Authoring a scenario
 
-Tracks `cowork-harness 4.0.0` (baseline `desktop-2.9939.4`). Read it when composing a `scenarios/*.yaml`: session vs scenario, discovery, the fidelity tier, the answer path, `web_fetch`, and scaffold + lint.
+Tracks `cowork-harness 4.1.1` (baseline `desktop-2.9939.4`). Read it when composing a `scenarios/*.yaml`: session vs scenario, discovery, the fidelity tier, the answer path, `web_fetch`, and scaffold + lint.
 
 ## Part I — AUTHOR a scenario
 
@@ -220,25 +220,75 @@ so a file `run`/`record` would refuse fails lint too (running `scenario.py lint`
 cowork-harness lint scenarios/*.yaml
 ```
 
-`lint` flags: filesystem/egress-only assertions on a `replay` gate (silent no-op), bad regex
-quoting, an egress assert on `protocol` fidelity, `transcript_no_host_path` on `hostloop`/`protocol`
-(ERROR — fails by design at those tiers; WARN on `fidelity: cowork`, whose tier resolves per the
-baseline's host-loop gate), non-empty `requires_capabilities` on `protocol` without
-`allow_missing_capability` (ERROR — the capability probe can't run there, so the run hard-fails as
-unverifiable), `no_scratchpad_leak` off `container` (ERROR on `protocol`/`microvm`/`hostloop` — hostloop's
-`present_files` passes a validated path through without promoting, so there is no scratch→outputs copy
-to leak; WARN on `cowork`, whose tier resolves per the baseline gate) or `present_files_called` on
-`protocol`/`microvm` (ERROR — served only at `container`/`hostloop`), or `present_files_called`/`no_scratchpad_leak`/`user_visible_artifact` on `lane: remote` (ERROR — the runtime rejects those at scenario load time, so the tier rules are suppressed there), a `controlOut`-gated key on a non-`controlOut` replay, mixed-class assertion items,
-and hallucinated schema (`assertions:` vs `assert:`, unknown keys). Exit code is non-zero on errors
-(CI-friendly). `scaffold` auto-upgrades the tier if you ask for egress on `protocol`, so it never
-emits a scenario `lint` would reject.
+`lint` exits non-zero on any ERROR (CI-friendly); `--strict` also fails on WARN. Every rule it reports:
+
+| Rule | Severity | Fires on |
+|---|---|---|
+| `assert-contradiction` | ERROR | assert items no single run can satisfy together |
+| `assertions-key` | ERROR | `assertions:` instead of `assert:` — none of the checks would run |
+| `authored-replay-fidelity` | ERROR | an authored `replay_protocol_fidelity` (only the replay lane synthesizes it) |
+| `capabilities-on-protocol` | ERROR | non-empty `requires_capabilities` on `protocol` without `allow_missing_capability` — the probe cannot run there, so the run fails as unverifiable |
+| `cassette-evidence-skipped` | INFO | with `--cassette-dir`: a cassette (or the directory) could not be read, so it cannot quiet replay-evidence advice |
+| `container-only-key-off-container` | ERROR | `no_scratchpad_leak` off `container` — hostloop's `present_files` never promotes, so there is nothing to leak (WARN on `cowork`, whose tier resolves per the baseline gate) |
+| `egress-on-protocol` | ERROR | an egress assertion (`egress_*` / `expect_denied`) on `protocol`, which enforces no egress |
+| `enum-value-invalid` | ERROR | a field value outside its allowed set |
+| `fidelity-missing` | ERROR | no `fidelity:` (required since 4.0.0) |
+| `file-absent-contradiction` | ERROR | one path under both `file_exists` and `file_absent` |
+| `gate-needs-controlout` | INFO | gate assertions, which evaluate on replay only when the cassette has `controlOut` |
+| `host-path-assert-cowork` | WARN | `transcript_no_host_path` on `cowork` — it fails by design if the tier resolves to hostloop |
+| `host-path-assert-tier` | ERROR | `transcript_no_host_path` on `hostloop` / `protocol`, where it fails by design |
+| `lane-remote-incompatible-key` | ERROR | `present_files_called` / `no_scratchpad_leak` / `user_visible_artifact` on `lane: remote` (the runtime rejects them at load, so the tier rules are suppressed there) |
+| `linter-extra-findings-invalid` | ERROR | the loader findings `cowork-harness lint` hands the linter could not be read |
+| `linter-unclassified-key` | ERROR | a valid assertion key this linter cannot classify (the linter is out of date) |
+| `manifest-needs-snapshot` | INFO | manifest-backed keys, which evaluate on replay only when the cassette carries an `artifacts` manifest |
+| `mixed-assert-item` | WARN | one assert item mixing replay-checkable and live-only keys (replay drops the live-only half) |
+| `no-scenarios` | ERROR | a linted directory with no `*.yaml` / `*.yml` |
+| `not-found` | ERROR | a named file that does not exist |
+| `parse` | ERROR | a file that is not YAML, or not a mapping |
+| `positional-choose-order` | INFO | an answer rule with a positional `choose` (first / index), which option re-ordering can move |
+| `present-files-key-off-tier` | ERROR | `present_files_called` on `protocol` / `microvm` (served only at `container` / `hostloop`) |
+| `prompt-slash-not-leading` | WARN | a `prompt:` that names `/<skill>` without starting with it, so it is never expanded |
+| `reference-access-contradiction` | ERROR | one reference under both `reference_read` and `no_observed_reference_access` |
+| `regex-double-quoted` | WARN | a double-quoted regex with an unescaped backslash (YAML strips it) |
+| `replay-noop` | WARN | every assertion is live-only or a verdict modifier, so a replay gate verifies nothing |
+| `tool-called-always-passes` | INFO | `tool_called` with `count: {min: 0}` and no `max` — it asserts nothing |
+| `tool-input-regex-redactable` | WARN | a `tool_not_called` input literal the redaction policy rewrites in the committed cassette (or a policy pattern it cannot check offline) |
+| `tool-input-shell-tier` | INFO | the object form with `tool: Bash` and a `command` on `hostloop` / `cowork`, where shell runs as `mcp__workspace__bash` — list both |
+| `tool-not-called-tier-vacuous` | WARN | `tool_not_called` / `subagent_tool_absent` naming a tool the tier never serves |
+| `transcript-command-shaped` | WARN | a `transcript_*` value shaped like a shell command — those keys read prose only, never a tool call |
+| `unknown-assert-key` | WARN | an assertion key not in the catalog (the loader rejects it) |
+| `unknown-top-key` | WARN | a scenario key not in the schema |
+| `vacuous-gate-assert` | WARN | `gate_answers_delivered` with no presence companion (zero gates passes it), or inert beside `questions_count_max: 0` |
+| `scenario-invalid` | ERROR | the harness's scenario loader refuses the file (via `cowork-harness lint` only — see below) |
+| `baseline-unknown` | ERROR | `baseline:` names no baseline this CLI ships (via `cowork-harness lint` only) |
+| `lint-loader-internal` | ERROR | the wrapper could not run its loader check on a file — a harness bug; it never falls back to a lint that skipped the loader |
+
+`scaffold` auto-upgrades the tier if you ask for egress on `protocol`, so it never emits a scenario `lint`
+would reject.
+
+**Lint the skill itself: `cowork-harness lint-skill <skill-dir>`.** It checks the skill, not a scenario:
+Cowork host-loop footguns (`${CLAUDE_PLUGIN_ROOT}` in a VM bash step, hook events, a misplaced
+`hooks.json`, an unresolvable `subagent_type`), the evidence corpus a `critique` can package
+(`references/critique.md`), and two size caps. `skill-body-over-reattach-cap` (WARN) fires when the
+`SKILL.md` body, frontmatter excluded, passes 19,000 B — after a compaction the agent re-attaches only the
+start of an invoked skill — and `skill-body-near-reattach-cap` (INFO) from 80% of that;
+`skill-reference-over-read-cap` (WARN) fires on a `references/**.md` over 60,000 B, past which a
+whole-file Read returns a partial view. `--strict` fails on WARN, never on INFO. To accept a reviewed
+judgement-call finding, pass `--ignore-rule <rule>[=<glob>]` (repeatable; the glob matches the finding's
+file) or fence the text in `SKILL.md` with `<!-- lint-skill: ignore-start <rule>[,<rule>…]: <reason> -->`
+… `<!-- lint-skill: ignore-end -->` (outside any code fence). A suppressed finding is still printed; it
+stops gating. A provable rule (an ERROR, a misplaced `hooks.json`, a missing pinned agent) cannot be
+suppressed: naming it, or an unknown rule, in `--ignore-rule` is a usage error (exit 2); in a marker it is
+WARN `lint-skill-ignore-invalid`, as is any other malformed marker. An unclosed marker is WARN
+`lint-skill-ignore-unclosed`, and one that suppresses nothing is INFO `lint-skill-ignore-unused`.
 
 **`cowork-harness lint` runs the loader: a file it calls clean is one `run`/`record` will load.** Anything
 the loader refuses — an unknown key, a wrong value type (a scalar `semantic_matches.rubric`), a bad regex,
 a reserved value — is ✗ ERROR `scenario-invalid` (exit 1, with or without `--strict`), and a `baseline:`
 naming no baseline this installed CLI ships is ✗ ERROR `baseline-unknown` (`latest` always resolves). It
 does not check what depends on the machine the run happens on (the session file and its mounts, an
-absolute `baseline:` path, environment variables). A session or matrix YAML in a linted directory is not
+absolute `baseline:` path that does not exist here — one that exists is checked (4.1.1 and later) —
+environment variables). A session or matrix YAML in a linted directory is not
 a scenario and is reported as one that does not load — keep those out of the linted set. `python3
 scenario.py lint` run directly stays offline and lenient: there an unknown key is only a ⚠ WARN (exit 0).
 `cowork-harness record <file.yaml> --dry-run` also runs the loader and adds the pre-spend refusals (exit 2

package/.claude/skills/cowork-harness/references/ci-recipe.md

@@ -1,6 +1,6 @@
 # CI recipe — replay vs live lanes
 
-Self-contained reference. Tracks `cowork-harness 4.0.0` (baseline `desktop-2.9939.4`).
+Self-contained reference. Tracks `cowork-harness 4.1.1` (baseline `desktop-2.9939.4`).
 
 **Fastest path: the packaged Action.** One step gets you `replay`/`lint`/`verify-cassettes` plus a PR
 job-summary reporter (verdict table, staleness findings, cost/turns when available):
@@ -17,7 +17,7 @@ job-summary reporter (verdict table, staleness findings, cost/turns when availab
 CLI major reaches your workflow the moment it is promoted even though your `uses:` ref never changed — so a
 copy-pasted recipe that omits the input takes a major bump with no say in it. `^4` holds the major, needs no
 patch number to remember, and only wants a human decision at the next major. Pin an exact version
-(e.g. `version: "4.0.0"`) instead when you want byte-reproducible CI.
+(e.g. `version: "4.1.1"`) instead when you want byte-reproducible CI.
 
 Reach for the manual multi-step form below only when you need per-step control the Action's inputs don't
 cover (a custom flag combination, a different runner matrix per step, or `lint`/`verify-cassettes` gated
@@ -82,7 +82,7 @@ sha256-*checked* but not hard-blocking on mismatch — it's advisory for an inte
 GitHub-hosted runners, no token/Docker/agent:
 
 ```yaml
-- run: npm i -g "cowork-harness@^4.0.0"
+- run: npm i -g "cowork-harness@^4.1.1"
 - run: cowork-harness lint scenarios/*.yaml --strict --min-severity WARN
                                                     # no silent false-greens. WITHOUT --strict this
                                                     # step cannot fail on a WARN-class rule (e.g.
@@ -93,7 +93,16 @@ GitHub-hosted runners, no token/Docker/agent:
                                                     # 3.x CLI bare `--strict` also fails on INFO, so keep
                                                     # the pair explicit. `--min-severity INFO` gates on
                                                     # INFO as well. (`lint-skill --strict` never fails
-                                                    # on INFO and has no floor to widen.)
+                                                    # on INFO and has no floor to widen; to accept a
+                                                    # reviewed lint-skill WARN, keep --strict and add
+                                                    # `--ignore-rule <rule>[=<skill-dir>/<path>]` or an
+                                                    # ignore-start/ignore-end marker in the SKILL.md.)
+- run: cowork-harness lint scenarios/*.yaml --strict --min-severity INFO --cassette-dir cassettes/
+                                                    # committed *.cassette.json evidence suppresses only
+                                                    # replay advisories proven by every matching cassette;
+                                                    # skipped or malformed cassettes stay visible.
+                                                    # Staleness does not affect this existence check;
+                                                    # verify-cassettes checks freshness and drift.
 - run: cowork-harness verify-cassettes cassettes/    # privacy + staleness — FAILS on a stale recording
                                                     # ALSO fails on a leaked host inventory: recording at
                                                     # protocol/hostloop freezes YOUR machine's MCP servers,
@@ -232,7 +241,9 @@ cowork-harness replay cassettes/                   # replay every *.cassette.jso
 Re-record whenever the protocol or your scenario's expected content changes. An old cassette without
 `controlOut` excludes the gate keys (with a loud warning) — re-record to enable them. `record` **refuses
 to freeze a failing live run** into a cassette (pass `--allow-failing` to override) — a committed red
-cassette is a latent false-signal.
+cassette is a latent false-signal. An `--allow-failing` recording of a red run exits 0 with `ok: true`:
+`record`'s `ok` means a cassette was written, and the run's own verdict is `results[0].verdict.pass`
+(`items[].verdict` on `record <dir/>`).
 
 ## Privacy: cassettes are committed fixtures → record only against SYNTHETIC inputs
 
@@ -247,7 +258,9 @@ dollar figures). In a skill repo these cassettes get **committed**. So:
   dir** (first file found per dir; env vars merge on top). `cowork-harness init-redact` copies the
   packaged reference template (local-path prefixes, incl. macOS temp roots and slugged home segments
   like `-Users-<user>-…`, + a generic email regex) into the cwd as a starting point — review and tailor
-  it; a copy from an earlier release lacks the temp-root rules, so re-copy with `--force` or add them. Redaction is **verdict-preserving** — `record` refuses to write if
+  it; a copy from an earlier release lacks the temp-root rules, so re-copy with `--force` (without it
+  `init-redact` refuses to overwrite an existing policy; with it your tailoring is replaced — save and
+  re-apply it) or add them by hand. Redaction is **verdict-preserving** — `record` refuses to write if
   redaction would flip an assertion (a manufactured green). `--no-redact` skips it for known-synthetic
   inputs.
 - **Pre-spawn preflight**: `record` warns (`::warning::`, before the paid run starts — once per batch
@@ -332,7 +345,16 @@ A typical skill repo runs four stages, fastest/cheapest first:
 
    This is the shape a CI step wants: **silent on success (no output, exit 0), loud and specific on
    failure** — `--quiet` suppresses the readiness preview but never the `✗ broken:` lines, which name the
-   offending file *and* the rejected key, one line per file, and the step still exits 1. Point `lint`
+   offending file *and* the rejected key, one line per file, and the step still exits 1. It exits 0,
+   though, on an input the real record would refuse (a `session:` file that cannot be read — 4.1.1 and
+   later — a missing path, an unknown baseline name, a tier-vacuous `tool_not_called`): that prints a `⚠ input error:` line and lands in `inputErrors[]`. To
+   gate on those too, use the JSON form (4.1.0 and later):
+
+   ```bash
+   cowork-harness record scenarios/ --dry-run --output-format json | jq -e '.ok and (.inputErrors == [])'
+   ```
+
+   Point `lint`
    at scenarios only: a session or matrix YAML in the linted set is reported as a file that does not
    load.
 
@@ -373,7 +395,7 @@ jobs:
         with: { node-version: '24' }
       - uses: actions/setup-python@v5
         with: { python-version: '3.x' }                                       # python3 only — PyYAML is bundled with the linter
-      - run: npm i -g "cowork-harness@^4.0.0"
+      - run: npm i -g "cowork-harness@^4.1.1"
       - run: cowork-harness lint scenarios/*.yaml                              # no-silent-false-green (needs python3; PyYAML bundled)
       - run: cowork-harness verify-cassettes cassettes/ --output-format json   # privacy + staleness gate
       - run: cowork-harness replay cassettes/ --output-format json             # token-free content/structure
@@ -402,7 +424,7 @@ jobs:
             echo "live=true" >> "$GITHUB_OUTPUT"
           fi
       - if: steps.guard.outputs.live == 'true'
-        run: npm i -g "cowork-harness@^4.0.0"
+        run: npm i -g "cowork-harness@^4.1.1"
       - if: steps.guard.outputs.live == 'true'
         run: cowork-harness run scenarios/ --output-format json
         env:
@@ -425,7 +447,8 @@ sandbox).
 
 `--output-format json` emits a machine envelope on stdout (human output goes to stderr):
 `{tool, version, command, ok, results[], error}` — one `RunResult` per scenario. **Overall pass for a
-scenario is `verdict.pass`** (envelope-wide: `ok`), and it is strictly stronger than
+scenario is `verdict.pass`** (envelope-wide: `ok`; on `record`, `ok` only means the command exited 0 —
+see below), and it is strictly stronger than
 `result === "success" && assertions.every(pass)`: the verdict also carries ~20 signal codes that fail a run
 with no failing assertion at all — `stalled`, `outputs_delete`, `mount_delete`, `host_path_leak`,
 `undelivered_deliverables`, `missing_capability`, `permissive_auto_allow`, `ended_with_question`,
@@ -459,6 +482,11 @@ Keep the `.results[]?` hop and the `?` operators. `.results[0]` silently ignores
 the first when you pass a directory, and a bare `.verdict` does not exist at the envelope root at all —
 both read as "no failures" against a run that failed.
 
+**`record` is shaped differently.** Its `ok` is the exit code's verdict (a cassette was written), not the
+run's: `record --allow-failing` on a red run is `ok: true`. The verdict is in `results[0].verdict` on
+`record <file>` and in `items[].verdict` on `record <dir/>` and `--rerecord-stale`, which carry no
+`results[]` — so `.results[]?` reads nothing there. Use `[.items[]? | .verdict.failures[]?]` on a batch.
+
 > **Do not filter on whether `assertion` is present.** That was the only discriminator before `kind`
 > existed and it never worked in both directions: `coverage` entries carry a key too (an internal
 > `answer_coverage` marker), so they read as authored asserts, while `guard`, `staleness` and
@@ -468,7 +496,9 @@ both read as "no failures" against a run that failed.
 `--output-format json`, `run` / `record` / `replay` / `verify-cassettes` / `status` write their whole
 human rendering — warnings, verdict, `status`'s summary line — to **stderr**, and stdout stays empty.
 A wrapper that captures only stdout gets an empty log and, if it greps that for a state, a silent false
-negative. Capture stderr for the human trail (`2> run.stderr.log`), or ask for JSON and parse stdout.
+negative. Capture stderr for the human trail (`2> run.stderr.log`), or ask for JSON and parse stdout —
+`COWORK_HARNESS_OUTPUT_FORMAT=json` makes JSON the default for every command that takes `--output-format`
+(an explicit flag still wins).
 (Commands whose whole job is to print a value — `--version`, `assertions --list`, `scaffold`, `gates`,
 `skill --dry-run` — write it to stdout by design. Under `--output-format json` the value rides inside the
 envelope: `scaffold`'s YAML is `.scenario`, `skill --dry-run`'s preview is the envelope's own fields;

package/.claude/skills/cowork-harness/references/critique.md

@@ -1,6 +1,6 @@
 # Critique — the facts a plugin install can't otherwise reach
 
-Tracks `cowork-harness 4.0.0` (baseline `desktop-2.9939.4`). This is **not** a trim of the full
+Tracks `cowork-harness 4.1.1` (baseline `desktop-2.9939.4`). This is **not** a trim of the full
 [`docs/critique.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/critique.md) (repo-only —
 flags, cost, reproduction discipline, known limitations all live there). This file covers exactly what a
 plugin install cannot otherwise discover: the run-dir artifact a harvester actually reads, the report's

package/.claude/skills/cowork-harness/references/debugging.md

@@ -1,13 +1,15 @@
 # Debugging a run
 
-Tracks `cowork-harness 4.0.0` (baseline `desktop-2.9939.4`). Read it when a run misbehaved or a green looks wrong: triage, the observability output, and `chat`.
+Tracks `cowork-harness 4.1.1` (baseline `desktop-2.9939.4`). Read it when a run misbehaved or a green looks wrong: triage, the observability output, and `chat`.
 
 ## Part III — Debug
 
 A run misbehaved, or greened when you don't trust it. Debugging is a first-class loop, not an
 afterthought: the run already wrote its evidence, so you **localize the failure post-hoc** rather than
 re-run and hope. Start at the triage below, then use the observability output and, when you need to
-reproduce interactively, `chat`.
+reproduce interactively, `chat`. (The fuller human-facing map is
+[`docs/debugging.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/debugging.md) — repo-only,
+not shipped with the installed skill.)
 
 > **"Evidence" below means the run's own record** — events, trace, transcript; what `trace` / `inspect` /
 > `diff` / `verify-run` / `replay --explain` read. `critique`'s **evaluator** grades against a separate,
@@ -32,6 +34,15 @@ agent stderr) — read those before re-running; a re-record rarely tells you mor
 already does.
 <!-- END triage-canonical -->
 
+**microvm: "control-protocol write failed" with `env: 'claude': No such file or directory` in the agent
+stderr** usually means the VM never finished provisioning (the agent never reached PATH). Check
+`cowork-harness vm status` — a `provisioning` other than `ready` confirms it — and if a run does not
+recover it on its own, `cowork-harness vm delete` and retry. A run on such a VM can also have cached an
+empty toolchain for it in the capability probe's cache: `vm delete` drops that VM's entry (`vm prune`
+forgets only the orphaned VMs it deletes, never the current one); otherwise delete `capability-cache.json`
+from the runs root (`~/.cowork-harness/runs/` unless
+`COWORK_HARNESS_RUNS_DIR` is set) so the next run probes again.
+
 **Is it your skill's bug, or a known harness gap?** Before deep-debugging a wrong behavior, rule out a
 **deliberate fidelity gap** — the harness intentionally does *not* reproduce a few real-Cowork behaviors,
 so a "bug" you see here that real Cowork also has isn't yours to fix. The tier semantics are in
@@ -73,7 +84,9 @@ decide which assertions from *Assertions: two orthogonal axes* in `assertions-gu
   walk observe this run — what distinguishes "nothing was left undelivered" from "cannot tell"), `cost` (`cost.usd` = the SDK's
   `total_cost_usd` for the run — the authoritative single-run spend of the agent session, which leaves out the `semantic_matches` judge and the LLM decider calls; NOT the same source as summing
   `modelUsage[].costUSD`, which is what `trace --view usage` reports, so the two can differ),
-  `usage` (`input_tokens`/`output_tokens`/`turns`), `toolDurations` (with `toolDurationsBasis`), `models`, `toolErrors`,
+  `usage` (`input_tokens`/`output_tokens`/`turns`), `toolDurations` (with `toolDurationsBasis`), `models`,
+  `toolCalls` (every tool call in stream order: `name`, top-level `input` fields each capped at 10 KB, and
+  `origin` `main`/`subagent`/`unknown` — what the object form of `tool_called`/`tool_not_called` reads), `toolErrors`,
   `redundantToolCalls`, `modelUsage`, `thinking`, `skillActivity`, `subagents[]` (prompt/`dispatchModel`/
   `resolvedModel`/output/`attributedSkillId`, `outputTruncated`, `referencesRead`, `reasoning`/`reasoningElided`),
   `context` (tools/mcpServers/availableSkills), `tasks`,

package/.claude/skills/cowork-harness/references/fidelity-and-answers.md

@@ -1,6 +1,6 @@
 # Fidelity tiers & answer paths
 
-Self-contained reference. Tracks `cowork-harness 4.0.0` (baseline `desktop-2.9939.4`).
+Self-contained reference. Tracks `cowork-harness 4.1.1` (baseline `desktop-2.9939.4`).
 
 > **This page vs. the repo docs.** This is the **offline snapshot** that ships inside the installed
 > plugin — it is self-contained on purpose. The repo carries four other fidelity views, each answering a
@@ -73,7 +73,9 @@ The instance is `cowork-vm-<config-hash>` — a config or agent-version change y
 stale VM is never silently reused (the old one is orphaned until `vm prune`). Pin a fixed name with
 `COWORK_LIMA_INSTANCE`. The optional argument to every `vm` subcommand is a **baseline**
 (`desktop-<version>`, default `latest`), never the `cowork-vm-<hash>` VM name — passing a VM name is a
-usage error that names the baseline(s) deriving it.
+usage error that names the baseline(s) deriving it. A Running VM is used only once its provisioning has
+finished (a run waits up to `COWORK_VM_PROVISION_TIMEOUT_S`, default 900 s); `microvm <instance> never
+finished provisioning (…)` means it will not — `cowork-harness vm delete` and retry.
 
 ## Answer paths (resolving gates: AskUserQuestion + tool-permission)
 
@@ -325,7 +327,7 @@ up often enough to spell out:
 - `COWORK_HARNESS_SCRUB_KEYS` / `COWORK_HARNESS_SCRUB_VALUES` — extra env names / literal values to
   redact from logs (beyond the auth tokens + `ANTHROPIC_CUSTOM_HEADERS`).
 - `COWORK_HARNESS_SOFT_MISSING` — downgrade a missing mount source from hard-error to warn-and-skip.
-- `COWORK_VM_GATEWAY` / `COWORK_VM_PROXY_PORT` / `COWORK_LIMA_INSTANCE` — L2 (microVM) knobs.
+- `COWORK_VM_GATEWAY` / `COWORK_VM_PROXY_PORT` / `COWORK_LIMA_INSTANCE` / `COWORK_VM_PROVISION_TIMEOUT_S` — L2 (microVM) knobs.
 - `COWORK_LOCKDOWN` — default `on`: gates sandbox hardening on every isolated tier — **aborts loudly**
   if the L2 guest firewall fails to apply (no silent unprotected run), and also gates the
   `container`/`hostloop` Docker hardening. Set `=off` to opt out and run without isolation deliberately.

package/.claude/skills/cowork-harness/references/gotchas.md

@@ -1,6 +1,6 @@
 # Gotchas
 
-Tracks `cowork-harness 4.0.0` (baseline `desktop-2.9939.4`). The full "✓ passed ≠ correct" landmine catalog.
+Tracks `cowork-harness 4.1.1` (baseline `desktop-2.9939.4`). The full "✓ passed ≠ correct" landmine catalog.
 
 ## Gotchas — the "✓ passed ≠ correct" landmines
 
@@ -175,9 +175,10 @@ authorable). Reach for this list when debugging a run's behavior, that one while
     `--reassert`). That opt-in path is safe by construction for the authored fields — it **hard-fails** if
     `prompt`/`answers`/`baseline`/`fidelity`/`lane`/`skills`/`requires_capabilities` or the skill content (when a
     fingerprint exists) drifted from the recording (re-record then), and `expect_denied`/filesystem/egress keys
-    are sourced but stay **live-only** (it warns; they don't move the replay verdict). **Caveat:** the `session`
-    (model / data mounts / discovery) is NOT drift-checked or fingerprinted, so a **model change** between record
-    and re-assert is undetected — the notice flags this; re-record if the session changed. `verify-run` reads
+    are sourced but stay **live-only** (it warns; they don't move the replay verdict). **Caveat:** the session's
+    `model:` IS in the cassette's `sessionFingerprint` (a `--model`/env model is not; `environment.model`
+    records what ran). `verify-cassettes` reports a changed session as staleness (exit 1); `replay` never
+    checks it — plain, `--strict` or `--assert-from` — so re-record if the session changed. `verify-run` reads
     on-disk `assert:` against a kept *run dir*; `replay --assert-from` is the equivalent for a *cassette*.
 
 18. **`questions_count_max` counts sub-questions, not gates.** One `AskUserQuestion` tool call can
@@ -214,13 +215,17 @@ authorable). Reach for this list when debugging a run's behavior, that one while
 
 22. **`lint` floods CI with INFO advisories that don't apply to you.** *Why:* two rules —
     `manifest-needs-snapshot` and `gate-needs-controlout` — fire on the mere presence of manifest/gate
-    assertion keys. The linter is **static**: it never reads your cassettes, so it cannot know whether
-    yours already carry an `artifacts` manifest and `controlOut` (a current cassette does). On a healthy
-    fleet every one of those lines is a false alarm. One exception: `manifest-needs-snapshot` is
-    suppressed for `user_visible_artifact` on `lane: remote` — the only manifest-backed key that lane also
-    rejects outright (`lane-remote-incompatible-key`, an ERROR), so the INFO would be redundant advice
-    about a key the scenario can never even load with. `gate-needs-controlout` has no such exception. *Fix:*
-    `lint --min-severity WARN` in CI (≥1.11.0) — the INFO advisories stay one flag away for interactive use.
+    assertion keys. The linter is **static** until you opt in to cassette evidence. With committed
+    recordings, pass `lint --cassette-dir <dir>` (or one cassette file): it scans the same `*.cassette.json`
+    shape as replay and verify-cassettes, resolves each exact `scenarioSource` relative to its cassette,
+    and suppresses an advisory only when **all** matching cassettes carry the evidence the replay lane
+    needs. A malformed, wrong-shaped, unsupported-version, or provenance-less cassette is reported as INFO
+    and keeps the advisory visible — even beside a healthy sibling. The two dedicated diff assertions also
+    require their respective `preRunPaths` / `preRunHashes` baselines, and a non-empty `controlOut` /
+    artifact manifest is required where replay needs it. For a strict CI gate that keeps actionable INFO
+    rules visible while suppressing only proven replay noise, use `lint --strict --min-severity INFO
+    --cassette-dir <dir>`. Without the opt-in path, use `lint --min-severity WARN` in CI (≥1.11.0) to hide
+    the INFO class.
     From 4.0.0 WARN is `--strict`'s default floor, so bare `lint --strict` hides and passes INFO; add
     `--min-severity INFO` to fail on it. `--strict --min-severity ERROR` behaves as a plain lint, not a
     contradiction.

package/.claude/skills/cowork-harness/references/measurement.md

@@ -1,6 +1,6 @@
 # Measurement
 
-Tracks `cowork-harness 4.0.0` (baseline `desktop-2.9939.4`). Read it before comparing runs: `--repeat`, `--ablate-skill`, and the hygiene that keeps a batch valid.
+Tracks `cowork-harness 4.1.1` (baseline `desktop-2.9939.4`). Read it before comparing runs: `--repeat`, `--ablate-skill`, and the hygiene that keeps a batch valid.
 
 ### Measure — before/after, with/without (`--repeat`, `--ablate-skill`)
 
@@ -40,7 +40,10 @@ Compare timings between runs of the same tier and model only.
 
 1. **Pin the model in the session.** A run that resolves no model is refused, but one pinned only by
    `COWORK_HARNESS_MODEL` takes its model from the machine, so two shells can run two models. Set
-   `model:` in the session (or pass the same `--model` on every `skill` run). Read `result.json`'s `models` back before believing any cross-run comparison — and when
+   `model:` in the session (or pass the same `--model` on every `skill` run). Adding `model:` to a session
+   that already has cassettes re-stales them (`verify-cassettes` exits 1 — the model is in the session
+   fingerprint); to pin without re-recording now, use `--model` or `COWORK_HARNESS_MODEL` and move the
+   pin into the session at the next re-record. Read `result.json`'s `models` back before believing any cross-run comparison — and when
    you do, **ignore any entry wrapped in angle brackets**: `<synthetic>` is the agent marking a turn it
    fabricated locally (no API call), not a model, so two runs of the same pinned model can differ on this
    array purely by whether such a turn occurred.

package/.claude/skills/cowork-harness/references/run-record-replay.md

@@ -1,6 +1,6 @@
 # Run, record and lock
 
-Tracks `cowork-harness 4.0.0` (baseline `desktop-2.9939.4`). Read it when running a scenario, recording or placing a cassette, reading verdict signals, checking a background run, or choosing CI lanes.
+Tracks `cowork-harness 4.1.1` (baseline `desktop-2.9939.4`). Read it when running a scenario, recording or placing a cassette, reading verdict signals, checking a background run, or choosing CI lanes.
 
 ## Part II — RUN, RECORD & LOCK
 
@@ -25,12 +25,17 @@ the discovery/encode/record dance entirely and answer gates **live during the re
 refusals the real `record` applies (`on_unanswered: prompt`, and an unsatisfiable assert pairing) **plus the
 cassette-portability pre-flight below**, so it cannot green something a paid run would reject. **That binding
 guarantee is the SINGLE-FILE form only** — it takes the real `--out` and the real flags, so its verdict is the
-one a paid run would give. On a **directory** the path-dependent verdicts (host-inventory, cassette
+one a paid run would give. Two inputs it reports rather than refuses, at exit 0 under `inputErrors[]` with a
+`⚠ input error:` line: a `session:` file that cannot be read (missing, a directory, not valid YAML — 4.1.1
+and later) and a `tool_not_called` the tier can never violate — `run` and the real `record` refuse both. On a **directory** the path-dependent verdicts (host-inventory, cassette
 portability) are reported as `⚠ would-refuse (advisory)` / `⚠ would-warn (advisory)` notes — the label follows
 the verdict kind, and portability can only ever warn — that do NOT affect the exit code — a dir target
 takes no `--out`, so the destination is a guess — and only the path-independent ones (prompt policy, assert
-contradiction, duplicate cassette target) gate the batch. So a directory dry-run CAN exit 0 on a scenario the
-real `record` would refuse; re-run that one file with its real flags for a binding answer. A directory also
+contradiction, duplicate cassette target) gate the batch. An input the real record would refuse — a
+`session:` file that cannot be read (4.1.1 and later), a missing path, an unknown baseline name, a `tool_not_called` the tier can never violate — is listed under
+`inputErrors[]` with a `⚠ input error:` line, also at exit 0. So a directory dry-run CAN exit 0 on a scenario the
+real `record` would refuse; re-run that one file with its real flags for a binding answer, or gate on
+`.ok and (.inputErrors == [])` in the JSON payload (4.1.0 and later). A directory also
 reports every offender and the batch cost estimate. `lint` checks the assertion invariants AND that each file loads (the same loader, plus a named `baseline:`), but not the pre-spend refusals.
 
 **Which arm to reach for.** They answer different questions, and picking the wrong one is why a consumer
@@ -65,7 +70,10 @@ finished: a failing verdict without `--allow-failing`, an assert on an artifact
 quarantined inventory finding, or any other error before the cassette is written. Only the after-the-run
 refusals report the run: under `--output-format json` they carry it in `results[0]` (verdict and
 cost) with `error.category: "runtime"`; every pre-spend refusal, and a run that throws before returning a
-result (an unanswered gate), has `results: []`.
+result (an unanswered gate), has `results: []`. The envelope's `ok` is the exit code (`ok` ⇔ exit 0, a
+cassette was written), not the verdict: an `--allow-failing` recording of a red run is `ok: true` with
+`results[0].verdict.pass: false`. `record <dir/>` reports per scenario under `items[]` (each with `status`,
+and `verdict`/`result` once its run finished), not `results[]`.
 
 **Decide WHERE the cassette lives before you record it — a cassette cannot be moved afterwards.**
 Without `--out`, `record` writes `cassettes/<scenario-name-slug>.cassette.json` (gitignored by
@@ -249,7 +257,11 @@ Recognize these before "fixing" a non-bug:
   `container`/`microvm`, but only *fires* on an actual scanned leak with no authored
   `transcript_no_host_path`. At `fidelity: cowork` the skip follows the **resolved** tier, so a `cowork`
   run that lands on `container` is armed. Author `transcript_no_host_path` to enforce cleanliness where
-  it's valid.
+  it's valid. A host path that came verbatim from the scenario's own uploads, connected folders or prompt
+  is not a leak (whole-token match; a token cut short where the path goes on, or one naming a location the
+  harness created for the run, is never exempt); `scan.inputHostPathTokens` counts the host-path tokens the
+  inputs carried, `scan.hostPathsFromInputs` the ones exempted, and a non-zero exemption prints a
+  `::notice::` so a clean scan that relied on it is never silent.
 - **`exec_infra_error`** (`WARN`, host-loop) — one or more container `exec` calls failed for
   infrastructure reasons (daemon/container-level), so those tool calls returned an error to the agent
   rather than the command's own output. Warn-severity because the run's other evidence is intact — unlike