cowork-harness 4.4.0 → 4.4.1

package/.claude/skills/cowork-harness/SKILL.md

@@ -3,8 +3,8 @@ name: cowork-harness
 description: Test or debug a Claude Code skill/plugin under Claude Cowork's runtime — sandboxed agent, default-deny egress, the can_use_tool permission/question protocol — using the cowork-harness CLI. Use when validating or regression-testing a skill, authoring or debugging a scenario YAML (prompt + scripted answers + assert:), choosing a fidelity tier, scripting AskUserQuestion / tool-permission answers, asserting artifacts, egress, or sub-agent dispatch, measuring how long each tool call took (toolDurations / trace), or debugging a failed run or verdict from its result.json or transcript. Especially when a harness run no-ops an assertion, fails on an unanswered gate, false-greens, a steered answer never reaches the model, or a web_fetch is unexpectedly denied or gated. Also when iterating or hardening a skill across fixes, or grounding a skill's self-critique against its own run evidence — including a document-analysis skill (cap table, deck, financial model, transcript) that needs an uploaded file attached to be critiqued at all. Also for comparing two versions of a skill before merging an edit — did it make answers worse? (`eval`: paired A/B, pinned models) — or improving one round by round (`hillclimb`, the `/claude-api hillclimb` runner). NOT for generic unit testing (pytest/vitest of your own scripts) or non-Cowork CI. Covers the skill / run / chat / record / replay / trace / decide / assertions / scaffold / critique / stats / eval / hillclimb commands and the session-vs-scenario split.
 metadata:
   author: cowork-harness
-  version: 4.4.0
-  tracks-harness: cowork-harness 4.4.0 (baseline desktop-2.19675.0)
+  version: 4.4.1
+  tracks-harness: cowork-harness 4.4.1 (baseline desktop-2.19675.0)
 ---
 
 # cowork-harness
@@ -26,7 +26,7 @@ allowlist). This skill exists mostly to keep you out of those traps — the *Inv
 full landmine catalog in [`references/gotchas.md`](references/gotchas.md) are the highest-value part.
 Read them.
 
-> **Version note:** the facts and `file:line` pointers here track `cowork-harness 4.4.0` (baseline
+> **Version note:** the facts and `file:line` pointers here track `cowork-harness 4.4.1` (baseline
 > `desktop-2.19675.0`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
 > `SPEC.md` / `docs/*.md` over this snapshot, and re-run the bundled linter.
 
@@ -43,7 +43,7 @@ Before the first command, confirm the CLI is reachable and **fail loud** (never
 
 - **One-shot check.** Run `cowork-harness doctor [--tier <tier>]` first — a read-only prerequisite check that inspects Docker, the staged agent, the token, and the baseline in one pass. The bullets below explain each thing it checks (and how to fix it).
 - **Replay-only? Skip `doctor`.** Replaying committed cassettes needs no Docker, no staged agent, and no token — and every tier's `doctor` validates the auth token (the live tiers also Docker + the staged agent), so a ✗ there is expected, not a blocker. Go straight to `cowork-harness replay <cassette>`.
-- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 4.4.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@^4.4.0" <cmd>` (Node ≥ 22), or install once with `npm i -g "cowork-harness@^4.4.0"`. **Pin `@^4.4.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
+- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 4.4.1**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@^4.4.1" <cmd>` (Node ≥ 22), or install once with `npm i -g "cowork-harness@^4.4.1"`. **Pin `@^4.4.1`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
 
   This skill documents the CURRENT surface, not release history. If `cowork-harness --version` is
   OLDER than the floor, the per-release record of what you are missing is [CHANGELOG.md](https://github.com/yaniv-golan/cowork-harness/blob/main/CHANGELOG.md)

package/.claude/skills/cowork-harness/references/assertion-catalog.md

@@ -1,6 +1,6 @@
 # Assertion catalog
 
-Tracks `cowork-harness 4.4.0` (baseline `desktop-2.19675.0`). Every `assert:` key with its semantics, and the
+Tracks `cowork-harness 4.4.1` (baseline `desktop-2.19675.0`). Every `assert:` key with its semantics, and the
 verdict-signal table. Which keys survive `replay` is in [`scenario-schema.md`](./scenario-schema.md#replay-class);
 the scenario and session YAML fields are there too.
 
@@ -110,7 +110,7 @@ same set live from the schema.
 | `no_mcp_error: true` | no MCP round-trip failed (`RunResult.mcpErrors` is empty — no unhandled server, no handler throw) — live-only: MCP round-trips are harness-computed, not in the SDK stdout stream, so evidence-unavailable on replay (never a vacuous pass). **Only `true` is valid** |
 | `max_peak_rss_bytes: <N>` | peak sampled RSS of the agent sandbox ≤ N bytes (`RunResult.resources.peakRssBytes`) — live-only: replay never spawns a sandbox to sample, so evidence-unavailable on replay/protocol (never a vacuous pass); also evidence-unavailable when sampling captured no RSS value |
 | `semantic_matches: {rubric: [...], min_pass?, judge_model?, include_subagent_text?, include_fork_results?, evidence_files?: [..]}` | a pinned LLM judge grades each fixed `rubric` claim against the run's answer: the final result text, the transcript and the files the agent authored. The transcript is top-level `assistant_text` only — it excludes every `tool_use`/`tool_result` and sub-agent text unless opted in. Full semantics (evidence scope, fork results, refusals, judge provenance, cost): [semantic-judging.md](semantic-judging.md). |
-| `semantic_pairwise: {refs?: [..], rubric?: [..], pass_if?, order?, judge_model?, include_subagent_text?, include_fork_results?, evidence_files?: [..]}` | a pinned LLM judge compares this run's judged document with a **frozen reference** — the same document an earlier run (usually the baseline) produced, written once by `ref freeze` and never regenerated — and answers win, tie, loss or `both_bad`. **The judged document is the one `semantic_matches` builds** (final message + transcript + authored files, same `evidence_files` / `include_subagent_text` / `include_fork_results` options), so the transcript **excludes every `tool_use`/`tool_result`** and a criterion about whether a tool was called cannot be judged from it. `refs` are reference stores relative to the scenario file; the run is judged against every one (under `hillclimb run`, against the flow's own references instead — only the baseline's gates `pass_if`, a later variant's is a metric recorded with `gate: false`), and `pass_if` (default `not_worse`) must hold against each gating one: `win`, `not_worse` (win or tie), or `any` (graded at all — a metric only). `both_bad` fails `win` and `not_worse`. Which output the judge sees first is a seeded coin per run, assert and reference (`order: both` judges both orders: a win in one and a loss in the other is position bias and scores as a tie; any other disagreement keeps the worse outcome; each order's own outcome is recorded as `pairwise[].orders.candidate_first` / `.ref_first`, absent for a single-order grade, and a judge that favours whichever output it sees first shows across runs as `candidate_first` winning more often than `ref_first`). The judge never sees the words "reference" or "baseline". A reference must have been frozen with the same evidence options and for the same prompt; a missing, damaged, differently-scoped or other-prompt one **refuses the run before it spends anything**, as does a reference store inside any mounted source (the agent could read its own answer key). Unavailable evidence refuses with `semantic_matches`' typed reasons. Per-reference outcomes land in `assertions[].pairwise`. **LIVE-ONLY** — skipped on replay. |
+| `semantic_pairwise: {refs?: [..], rubric?: [..], pass_if?, order?, judge_model?, include_subagent_text?, include_fork_results?, evidence_files?: [..]}` | a pinned LLM judge compares this run's judged document with a **frozen reference** — the same document an earlier run (usually the baseline) produced, written once by `ref freeze` and never regenerated — and answers win, tie, loss or `both_bad`. **The judged document is the one `semantic_matches` builds** (final message + transcript + authored files, same `evidence_files` / `include_subagent_text` / `include_fork_results` options), so the transcript **excludes every `tool_use`/`tool_result`** and a criterion about whether a tool was called cannot be judged from it. `refs` are reference stores relative to the scenario file; the run is judged against every one (under `hillclimb run`, against the flow's own references instead — only the baseline's gates `pass_if`, a later variant's is a metric recorded with `gate: false`), and `pass_if` (default `not_worse`) must hold against each gating one: `win`, `not_worse` (win or tie), or `any` (graded at all — a metric only). `both_bad` fails `win` and `not_worse`. Which output the judge sees first is a seeded coin per run, assert and reference (`order: both` judges both orders: a win in one and a loss in the other is position bias and scores as a tie; any other disagreement keeps the worse outcome; each order's own outcome is recorded as `pairwise[].orders.candidate_first` / `.ref_first`, absent for a single-order grade, and a judge that favours whichever output it sees first shows across runs as `candidate_first` winning more often than `ref_first`). The judge never sees the words "reference" or "baseline", and the stored reference is scrubbed with the grading process's secret set before it reads it (`pairwise[].refRedactions`). A reference must have been frozen with the same evidence options and for the same prompt; a missing, damaged, differently-scoped or other-prompt one **refuses the run before it spends anything**, as does a reference store inside any mounted source (the agent could read its own answer key). Unavailable evidence refuses with `semantic_matches`' typed reasons. Per-reference outcomes land in `assertions[].pairwise`. **LIVE-ONLY** — skipped on replay. |
 | `artifact_json: {artifact, path, …}` | assert a JSON artifact's contents — `equals`/`gt`/`in`/`exists`/`absent`/`is_null` over a dotted `path` (`in` = membership in a list, for a stochastic/LLM value; `absent` ≠ `is_null`; an unresolved intermediate fails loud) |
 | `computer_links_resolve: true` | every `computer://` link in the model-visible transcript resolves to an artifact that exists in the run's collected outputs/mounts — a dangling link fails, naming which target was checked (a live host path, the collected work tree, or the replay manifest). **Requires ≥1 link** (zero links fails — use `computer_links_resolve_if_present` for the presence-free variant). **Only `true` is valid** (`false` is rejected by the schema) **Sees top-level `assistant_text` only — it excludes every `tool_use`/`tool_result`**, so a `computer://` link that appeared only inside a tool call or its result is invisible to it. |
 | `computer_links_resolve_if_present: true` | like `computer_links_resolve` but passes vacuously when the transcript has zero `computer://` links — the presence-free variant. **Only `true` is valid** **Sees top-level `assistant_text` only — it excludes every `tool_use`/`tool_result`**, so a `computer://` link that appeared only inside a tool call or its result is invisible to it. |

package/.claude/skills/cowork-harness/references/assertions-guide.md

@@ -1,6 +1,6 @@
 # Assertions guide
 
-Tracks `cowork-harness 4.4.0` (baseline `desktop-2.19675.0`). Read it when choosing assertion keys: the two orthogonal axes and the goal → key map. The full catalog is `assertion-catalog.md`.
+Tracks `cowork-harness 4.4.1` (baseline `desktop-2.19675.0`). Read it when choosing assertion keys: the two orthogonal axes and the goal → key map. The full catalog is `assertion-catalog.md`.
 
 ### Assertions: two orthogonal axes
 

package/.claude/skills/cowork-harness/references/authoring.md

@@ -1,6 +1,6 @@
 # Authoring a scenario
 
-Tracks `cowork-harness 4.4.0` (baseline `desktop-2.19675.0`). Read it when composing a `scenarios/*.yaml`: session vs scenario, discovery, the fidelity tier, the answer path, `web_fetch`, and scaffold + lint.
+Tracks `cowork-harness 4.4.1` (baseline `desktop-2.19675.0`). Read it when composing a `scenarios/*.yaml`: session vs scenario, discovery, the fidelity tier, the answer path, `web_fetch`, and scaffold + lint.
 
 ## Part I — AUTHOR a scenario
 
@@ -213,6 +213,10 @@ cowork-harness scaffold --name report-check --skill ./skills/report-gen \
   --egress-allowed api.weather.example.com --out scenarios/report-check.yaml
 ```
 
+Each repeatable flag adds one item: `--content` a `transcript_matches`, `--tool` a `tool_called`, `--subagent` a
+`subagent_dispatched`, `--file` a `file_exists`, `--artifact` a `user_visible_artifact`, `--egress-allowed` /
+`--egress-denied` an `egress_allowed` / `egress_denied`, `--gate REGEX=CHOICE` a scripted answer and `--web-fetch`
+an approval rule; `--no-delete` adds `no_delete_in_outputs: true`, and `--no-validate` skips the self-lint.
 The flag-built form runs the bundled `scripts/scenario.py scaffold`, which also runs directly with the
 same flags (installed as a plugin, `${CLAUDE_PLUGIN_ROOT}/scripts/scenario.py`).
 

package/.claude/skills/cowork-harness/references/ci-recipe.md

@@ -1,6 +1,6 @@
 # CI recipe — replay vs live lanes
 
-Self-contained reference. Tracks `cowork-harness 4.4.0` (baseline `desktop-2.19675.0`).
+Self-contained reference. Tracks `cowork-harness 4.4.1` (baseline `desktop-2.19675.0`).
 
 **Fastest path: the packaged Action.** One step gets you `replay`/`lint`/`verify-cassettes` plus a PR
 job-summary reporter (verdict table, staleness findings, cost/turns when available):
@@ -17,7 +17,7 @@ job-summary reporter (verdict table, staleness findings, cost/turns when availab
 CLI major reaches your workflow the moment it is promoted even though your `uses:` ref never changed — so a
 copy-pasted recipe that omits the input takes a major bump with no say in it. `^4` holds the major, needs no
 patch number to remember, and only wants a human decision at the next major. Pin an exact version
-(e.g. `version: "4.4.0"`) instead when you want byte-reproducible CI.
+(e.g. `version: "4.4.1"`) instead when you want byte-reproducible CI.
 
 Reach for the manual multi-step form below only when you need per-step control the Action's inputs don't
 cover (a custom flag combination, a different runner matrix per step, or `lint`/`verify-cassettes` gated
@@ -82,7 +82,7 @@ sha256-*checked* but not hard-blocking on mismatch — it's advisory for an inte
 GitHub-hosted runners, no token/Docker/agent:
 
 ```yaml
-- run: npm i -g "cowork-harness@^4.4.0"
+- run: npm i -g "cowork-harness@^4.4.1"
 - run: cowork-harness lint scenarios/*.yaml --strict --min-severity WARN
                                                     # no silent false-greens. WITHOUT --strict this
                                                     # step cannot fail on a WARN-class rule (e.g.
@@ -131,6 +131,16 @@ exits 0, so dropping the
 `verify-cassettes` step means a skill edit silently stops being tested. (One command instead of two:
 `replay --fail-on-skill-drift`.)
 
+`lint --json` and `lint-skill --json` print their findings as JSON for a script to read. `analyze-skill --strict
+<plugin-dir>/` is the static pre-flight for host-loop path fidelity and lost artifact write-backs (exit 3 when it
+could not parse a candidate); `--runtime` adds a headless-DOM confirmation (needs `jsdom`) that never changes
+the exit code.
+
+Other `verify-cassettes` flags: `--skip-privacy` or `--skip-staleness` runs only one half of the gate;
+`--skip-scenario-drift` drops the scenario-prompt drift check; `--allow-empty` lets an existing directory with no
+cassettes exit 0 (a missing path still fails); `--margins` prints each count-bound assert's recorded value against
+its budget (diagnostic, never the verdict).
+
 The rest of this doc explains the lane split, recording, privacy, and the full pipeline + live job.
 
 ## The core split: token-free PR gate + live nightly (self-hosted)
@@ -398,7 +408,7 @@ jobs:
         with: { node-version: '24' }
       - uses: actions/setup-python@v5
         with: { python-version: '3.x' }                                       # python3 only — PyYAML is bundled with the linter
-      - run: npm i -g "cowork-harness@^4.4.0"
+      - run: npm i -g "cowork-harness@^4.4.1"
       - run: cowork-harness lint scenarios/*.yaml                              # no-silent-false-green (needs python3; PyYAML bundled)
       - run: cowork-harness verify-cassettes cassettes/ --output-format json   # privacy + staleness gate
       - run: cowork-harness replay cassettes/ --output-format json             # token-free content/structure
@@ -427,7 +437,7 @@ jobs:
             echo "live=true" >> "$GITHUB_OUTPUT"
           fi
       - if: steps.guard.outputs.live == 'true'
-        run: npm i -g "cowork-harness@^4.4.0"
+        run: npm i -g "cowork-harness@^4.4.1"
       - if: steps.guard.outputs.live == 'true'
         run: cowork-harness run scenarios/ --output-format json
         env:
@@ -520,7 +530,11 @@ set `COWORK_HARNESS_RUNS_DIR` (or pass `--run-dir`) to a workspace-relative path
 artifact-upload step can collect them. Each run dir holds `events.jsonl`, `control-out.jsonl` and
 `egress.log` at the root, plus each turn's `run.jsonl` / `trace.json` / `result.json` under `turns/<N>/`
 (a single-turn run has just `turns/1/`; there is no root compat copy of any of these). Digest one with `cowork-harness trace <run-id | dir>`.
-Secrets are scrubbed from every persisted log by value.
+Secrets are scrubbed from every persisted log by value. The first live run under a runs root also creates its
+scrub-set key, `scrubset.key`, beside the runs root (in the working directory for `--run-dir runs`): add it to
+`.gitignore`, and never upload or commit it (an upload of `runs/` does not include it). A fresh runner creates a new
+key, so `regrade` of a CI run on another machine cannot prove its scrub set covered: new or edited rubric text is
+refused there; re-run the case instead.
 
 ## Don't assume a fixed assertion count across lanes
 

package/.claude/skills/cowork-harness/references/critique.md

@@ -1,6 +1,6 @@
 # Critique — the facts a plugin install can't otherwise reach
 
-Tracks `cowork-harness 4.4.0` (baseline `desktop-2.19675.0`). This is **not** a trim of the full
+Tracks `cowork-harness 4.4.1` (baseline `desktop-2.19675.0`). This is **not** a trim of the full
 [`docs/critique.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/critique.md) (repo-only —
 flags, cost, reproduction discipline, known limitations all live there). This file covers exactly what a
 plugin install cannot otherwise discover: the run-dir artifact a harvester actually reads, the report's
@@ -35,7 +35,9 @@ Two things a harvester needs: roll-ups are excluded from `stats` aggregation (th
 counting them adds a phantom run and drags `passRate` toward 1), so **filter them out of any pass-rate
 computed over raw rows** — that exclusion also governs `stats --group-by skill-hash`, so a per-generation
 **total spend** still needs the raw rows (only the roll-up carries the evaluator passes); and a roll-up with `result:"error"` had an unpriced workload, so its totals
-UNDERCOUNT. The index is the only cost record that survives run-dir pruning.
+UNDERCOUNT. The index is the only cost record that survives run-dir pruning. `--evaluator-model <id>` changes
+only the evaluator passes' model (and the armor's injection-resistance check covers the default evaluator only);
+when the task turn dominates cost, the levers are `--model`, `--timeout` and the probe's scope.
 
 ## An exit-2 report — which turn failed, and whether it was really infrastructure
 

package/.claude/skills/cowork-harness/references/debugging.md

@@ -1,6 +1,6 @@
 # Debugging a run
 
-Tracks `cowork-harness 4.4.0` (baseline `desktop-2.19675.0`). Read it when a run misbehaved or a green looks wrong: triage, the observability output, and `chat`.
+Tracks `cowork-harness 4.4.1` (baseline `desktop-2.19675.0`). Read it when a run misbehaved or a green looks wrong: triage, the observability output, and `chat`.
 
 ## Part III — Debug
 
@@ -40,10 +40,30 @@ rubric changed (or you want another judge model) on a run you already paid for,
 kept run without re-running the agent — unlike the tools above it is not token-free (the judge call is its
 spend) — writes the grade beside the run, and says whether the judge read the same document the live judge did.
 Content the live judge never read (a widened `evidence_files` / `include_subagent_text` / `include_fork_results` scope, or a larger
-`--authored-total-bytes`) is refused unless you pass `--allow-unchecked`. A `task_unverifiable` /
+`--authored-total-bytes`) is refused unless you pass `--allow-unchecked` (`error.code` `unchecked_content`); a
+judged document that differs from the one the live judge read is refused as `doc_drift` unless you pass
+`--allow-doc-drift`, and a scenario with no judged assert is `no_semantic_asserts`. A `task_unverifiable` /
 `rubric_unverifiable` / `evidence_unverifiable` / `reference_unverifiable` refusal means a part of the judge's input
-cannot be proven scrubbed with the run's scrub set (typically a pre-4.4 run with an edited rubric): re-run the
-case, or pass `--allow-scrub-change` after checking `COWORK_HARNESS_SCRUB_VALUES` / `_KEYS`.
+cannot be proven scrubbed with the run's scrub set (typically an edited rubric on a run recorded before the scrub-set
+fingerprint); `refusals[].scrubSet` says why (`legacy`, `unrecorded`, `mangled`, `key`, `smaller`). Re-run the
+case, regrade with the run's `COWORK_HARNESS_SCRUB_VALUES` / `_KEYS`, or pass `--allow-scrub-change` after checking
+them. Content accepted with `--allow-unchecked`, and the document of an `unknown` or `live_refused` assert, are
+outside that proof (scrubbed with this process's set only); `regrade` names both in a `::warning::` before judging.
+
+**`::warning:: [scrub-set] no scrub-set fingerprint is recorded: the installation key …`** means the run could not
+use its installation key, `scrubset.key` beside the runs root (`~/.cowork-harness/scrubset.key` for the default
+root; the current directory for `--run-dir runs`). The warning names the path and the defect: not a regular file
+(a symlink or a directory), readable or writable by others (it must be mode 600), owned by another user, empty (an
+interrupted create), unreadable, not a 64-hex-digit key, or could not be created. Such a run records
+`scrubSetUnavailable` instead of a `scrubSet`, so a later `regrade` of new or edited judge input refuses with
+`scrubSet: "unrecorded"` ("this run recorded no scrub set (its key …)"). The harness never removes or replaces an
+existing key file: fix it as the warning says (`chmod 600` a key you own, or delete a bad file so the next run
+creates a key), then re-run the case to record a fingerprint. Keep `scrubset.key` out of version control.
+
+Two more read-only views: `trace <run> --translate-paths` rewrites VM paths to host paths in the text
+`tools`/default views (an effective `hostloop` run with its `mounts.json`), and `diff <a> <b>` masks per-run noise
+(ids, timestamps, host paths) unless you pass `--no-normalize`; on two baselines, `--changelog` renders the
+known fields as prose.
 
 **microvm: "control-protocol write failed" with `env: 'claude': No such file or directory` in the agent
 stderr** usually means the VM never finished provisioning (the agent never reached PATH). Check

package/.claude/skills/cowork-harness/references/eval.md

@@ -1,6 +1,6 @@
 # `eval` — paired before/after comparison of a skill edit (EXPERIMENTAL)
 
-Tracks `cowork-harness 4.4.0` (baseline `desktop-2.19675.0`). The full guide is
+Tracks `cowork-harness 4.4.1` (baseline `desktop-2.19675.0`). The full guide is
 [docs/eval.md](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/eval.md); this is the part you
 need while running it.
 
@@ -31,6 +31,9 @@ cowork-harness eval report <eval-dir>     # rebuild the report from the eval dir
   worst observed runs × 2 × `--reps` exceed x — pre-flight only, agent cost only, never a mid-run stop.
 - In a scenario directory, YAML with no `prompt:` (a session file) is skipped.
 - Run an A/A first (`--allow-identical-arms`, the same source twice) to see your scenarios' noise.
+- A directory arm's snapshot leaves out untracked files unless you pass `--include-untracked` (not with a
+  `git:` arm). `--correction bh|holm` picks the multiple-comparison correction behind `confirmed` (default
+  `bh` at q = 0.10; `holm` is stricter).
 
 ## Reading the labels
 

package/.claude/skills/cowork-harness/references/fidelity-and-answers.md

@@ -1,6 +1,6 @@
 # Fidelity tiers & answer paths
 
-Self-contained reference. Tracks `cowork-harness 4.4.0` (baseline `desktop-2.19675.0`).
+Self-contained reference. Tracks `cowork-harness 4.4.1` (baseline `desktop-2.19675.0`).
 
 > **This page vs. the repo docs.** This is the **offline snapshot** that ships inside the installed
 > plugin — it is self-contained on purpose. The repo carries four other fidelity views, each answering a

package/.claude/skills/cowork-harness/references/gotchas.md

@@ -1,6 +1,6 @@
 # Gotchas
 
-Tracks `cowork-harness 4.4.0` (baseline `desktop-2.19675.0`). The full "✓ passed ≠ correct" landmine catalog.
+Tracks `cowork-harness 4.4.1` (baseline `desktop-2.19675.0`). The full "✓ passed ≠ correct" landmine catalog.
 
 ## Gotchas — the "✓ passed ≠ correct" landmines
 

package/.claude/skills/cowork-harness/references/hillclimb-recipe.md

@@ -1,6 +1,6 @@
 # Recipe 7 — Climb a skill with `/claude-api hillclimb` and the harness as its runner
 
-Tracks `cowork-harness 4.4.0` (baseline `desktop-2.19675.0`). It needs a `cowork-harness` whose
+Tracks `cowork-harness 4.4.1` (baseline `desktop-2.19675.0`). It needs a `cowork-harness` whose
 `hillclimb --help` lists `--skill` (help goes to stderr). This page is the loop's procedure, step by step, in the order of the
 `/claude-api hillclimb` guide. Every mechanic (flags, refusals, the gate, `regrade`, `freeze-ref`, exit codes,
 row keys) is in [`hillclimb.md`](hillclimb.md); the setup and the full list of differences from the guide's own
@@ -59,6 +59,9 @@ Each line matches one entry of the list in [the hillclimb guide](https://github.
 - **Never pass `--approve-harness`.** It records the harness sha and is the user's to run. A refusal before
   spending prints `refusing to run: …` and exits 2: stop and show the user what it names. `freeze-ref` needs
   no approval.
+- **Never pass `--allow-scrub-change` unattended,** and never put it in an allowed prefix. It sends the judge a
+  part of its input that cannot be proven scrubbed with the run's scrub set, so it can disclose a secret the run
+  scrubbed. Pass it only after the user has checked the scrub settings and said yes for that listing.
 - **`--skill` takes the bare skill name** (a `skills/<dir>` name or the registered name), never `plugin:name`
   or a path.
 
@@ -76,10 +79,27 @@ Each line matches one entry of the list in [the hillclimb guide](https://github.
 - **Recompute the headline** from `F/<variant>/results.jsonl`, never from `summary.json`.
 - **Spot-check grading.** Read the lowest-scoring baseline rows' `explanation` and traces. If a rubric is wrong,
   tell the user; after they edit it and approve the new sha, `cowork-harness hillclimb regrade T --flow F`
-  re-evaluates every row in place from its kept run without running the agent: changed deterministic
+  re-evaluates the rows in place from their kept runs without running the agent: changed deterministic
   assertions and every metric without a judge call, a judged assertion re-judged because its rubric changed. An
   unchanged assertion whose evaluation a harness upgrade changed keeps its recorded outcome (noted); editing the
   assertion, or re-running the case, re-grades it.
+- **Rows listed instead of re-graded (exit 1).** A new or edited rubric line (or another part of the judge's input)
+  is sent only when it can be proven scrubbed with the run's scrub set. When it cannot, the row is listed, untouched
+  and still carrying its old grade, with no judge call; stderr names the parts and why the run's set is not proven,
+  and `F/<variant>/regrade.md` lists the row. The usual causes: a run recorded before the scrub-set fingerprint (no
+  `scrubSet` in its `result.json`; one stderr summary line counts them), a run whose key was unusable ("this run
+  recorded no scrub set"), a run from another machine or under a replaced `scrubset.key`, or a token the run
+  scrubbed that has rotated since. What to do, in order: if the run recorded no scrub set, first have the user fix
+  `scrubset.key` as its `::warning:: [scrub-set]` line names (see the debugging reference); the harness never
+  replaces an existing bad key, so a new run before that fix records no scrub set again and is listed again. If this
+  process lacks a scrub value the run had (`COWORK_HARNESS_SCRUB_VALUES` / `COWORK_HARNESS_SCRUB_KEYS`, a rotated
+  token), ask the user to set the run's settings and regrade again; otherwise the listed cases need new runs,
+  which record a fresh fingerprint once the key is usable. A pass
+  runs nothing for a slot that already has a row, so tell the user and propose running the change as a new variant,
+  or a fresh flow dir from the baseline when the baseline's rows are listed. Only if the user has checked the scrub
+  settings and asks for it, re-run the same `regrade` with `--allow-scrub-change` (the regrade file then records
+  `scrubAcceptedBy`). Never pass it unattended; `--allow-doc-drift`, `--allow-unchecked` and `--rejudge` never
+  imply it. Don't compare variants while rows are listed: their grades are from the old rubric.
 - **Triage every zero.** An agent's own failure is a scored row (`meta.failure_class: "errored_agent"`, with
   `meta.termination_rule`). Infrastructure, timeouts, a wrong served model and invalid judge grades are
   `errors.jsonl` rows, never in the scored denominator. A variant that rewords or batches its questions can miss
@@ -182,7 +202,11 @@ Each line matches one entry of the list in [the hillclimb guide](https://github.
 - **Grader drift.** If a rubric is wrong, the user edits it and approves the sha; then
   `cowork-harness hillclimb regrade T --flow F` re-grades every variant's rows (default `--variant all`) and writes
   `F/<variant>/regrade.md` when a row moved or was listed. A row whose judge evidence itself changed since it was graded is
-  listed instead: ask the user before re-running with `--rejudge`.
+  listed instead: ask the user before re-running with `--rejudge`. A row whose new rubric text cannot be proven
+  scrubbed with its run's scrub set is listed too, and so is one whose evidence would be less redacted than the
+  graded document: handle both as in Step 0.5 (*Rows listed instead of re-graded*), never with `--allow-doc-drift`.
+  For the less-redacted row the override, if the user asks for it, is `--rejudge --allow-scrub-change` together:
+  `--allow-scrub-change` alone does not re-judge changed evidence.
 - **A new metric.** Add `metrics:` to the scenario, have the user approve the sha, re-run
   `cowork-harness hillclimb state-template T --flow F` and merge only the new `metrics` entries into
   `_state.json`. Rows written before it lack the key (`check` notes them); `hillclimb regrade T --flow F` fills it
@@ -192,9 +216,16 @@ Each line matches one entry of the list in [the hillclimb guide](https://github.
   `cowork-harness hillclimb regrade T --flow F --fill-refs` (no `--case`: rows of cases with no pairwise
   assertion need the column too, at no judge cost), then `state-template T --flow F` and merge the new
   `win_vN` entries (it declares them only once no scored row lacks them). Only the baseline's reference
-  decides `pass`.
-- **After a rubric re-grade, compare the ranking.** If the order of the variants flipped, tell the user and
-  propose restarting the climb from the baseline.
+  decides `pass`. When an entry already frozen lacks a compose key (an assertion added or re-scoped since),
+  `freeze-ref` and a baseline pass add it only when this process's scrub set provably covers the run it was frozen
+  from; otherwise the case is refused (exit 1). The refusal says to re-run the variant, but a pass never re-runs a
+  filled slot and a baseline pass refuses again each time: restore the run's scrub settings and re-run `freeze-ref`,
+  or start a fresh flow dir. A `--fill-refs` comparison against a
+  reference the row's run never judged is proven only when the run's scrub set is covered; otherwise the row is
+  listed (exit 1) and keeps no `win_vN` column. Handle it as in Step 0.5: same scrub settings, or new runs; ask
+  the user before any `--allow-scrub-change`.
+- **After a rubric re-grade, compare the ranking** once no row is listed. If the order of the variants flipped,
+  tell the user and propose restarting the climb from the baseline.
 
 ## Step 5 — report and hand back
 

package/.claude/skills/cowork-harness/references/hillclimb.md

@@ -1,6 +1,6 @@
 # `hillclimb` — the runner for a `/claude-api hillclimb` loop
 
-Tracks `cowork-harness 4.4.0` (baseline `desktop-2.19675.0`). It needs a `cowork-harness` whose
+Tracks `cowork-harness 4.4.1` (baseline `desktop-2.19675.0`). It needs a `cowork-harness` whose
 `hillclimb --help` lists `--skill` (help goes to stderr). The command reference is
 [docs/cli.md](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/cli.md); this is the part a loop needs
 while it runs. It covers `run`, `check`, `state-template`, `freeze-ref` and `regrade`.
@@ -224,7 +224,9 @@ measured) whose run delivered an output, under the variant's lock: it refuses wh
 its `meta.run_dir`, else by its run id under the current runs root (`--run-dir` / `COWORK_HARNESS_RUNS_DIR`). An
 entry that is already complete is reported (`exists`), never rewritten. One that lacks a compose key (an assert
 added or re-scoped) gains it from the run it was frozen from, marked `unchecked`, and is refused when that run is
-gone: start a fresh flow dir then.
+gone: start a fresh flow dir then. The new document is composed with this process's scrub set, so it is added
+(by `freeze-ref` or a baseline pass) only when that set provably covers the one the run recorded (`scrubSet`);
+otherwise the case is refused with the remedy: re-run the variant, or add it under the run's scrub settings.
 
 Flags: `--variant ID` (required), `--flow DIR`, `--case ID` (repeatable), `--output-format text|json` (json
 carries `{frozen, added, exists, refused}`), `--dotenv FILE`, `--run-dir DIR`.
@@ -280,10 +282,12 @@ every climb there is finished.
   the judge's input is covered. Otherwise each part must equal the run's own scrubbed record: the pairwise `## Task`
   line (the prompt), each rubric line, each evidence note, and each reference, by its bytes whatever it is called
   (its send must hash to what a live comparison of the run under the same compose key was sent, `refSentSha256`; a
-  pre-4.4 grade's stored text must be one that comparison recorded). A reference re-frozen
-  since, or a `--fill-refs` reference the run never judged, proves nothing. A row with a part proven neither way is listed, with no judge call. A run from before 4.4 has no fingerprint, so
-  its new or edited rubric text is listed (one stderr line says so); so is a run from another machine, or one whose
-  token has rotated since. Re-run the case, or pass `--allow-scrub-change` after checking the scrub settings: the
+  grade recorded before the reference-send hash, the stored text must be one that comparison recorded). A reference
+  re-frozen since, or a `--fill-refs` reference the run never judged, proves nothing. A row with a part proven
+  neither way is listed, with no judge call. A run recorded before the scrub-set fingerprint (no `scrubSet`) proves
+  no coverage, so its new or edited rubric text is listed (one stderr line counts such rows); so is a run whose key
+  was unusable (`scrubSetUnavailable`), a run from another machine or under a replaced key, or one whose token has
+  rotated since. Re-run the case, or pass `--allow-scrub-change` after checking the scrub settings: the
   regrade file then records `scrubAcceptedBy`. Neither `--rejudge` nor `--allow-doc-drift` implies it.
 - **`--rejudge`:** every judged assert of every selected row is re-judged, with the flow's references as they are
   now. Use it after a judge change the triggers above do not see. Not with `--fill-refs`.
@@ -370,7 +374,11 @@ Flags: `--flow DIR`, `--variant all|baseline|v<N>` (default `all`: every variant
   assert does not line up with the scenario or whose deterministic outcome changed (run a default `regrade` first;
   an agent-failed row aside); one whose
   re-grade is judge-invalid; in a fill one whose kept outcome was judged against a reference that has changed
-  since; and an open `judge_invalid` slot.
+  since; one with a part of the judge's input not proven scrubbed with its run's scrub set, one whose evidence
+  would be less redacted than the graded document, or one whose re-judge needs an assert whose scrubbed literal
+  this process cannot reproduce (each released only by `--allow-scrub-change`, with `--rejudge` for a less-redacted
+  row, never by `--allow-doc-drift`); one whose assert has an edit inside a scrubbed literal (only a re-run applies
+  it); and an open `judge_invalid` slot.
 
 ## Exit codes
 
@@ -384,7 +392,8 @@ Flags: `--flow DIR`, `--variant all|baseline|v<N>` (default `all`: every variant
 - `state-template`: `0`, or `2` on usage or a refusal.
 - `freeze-ref`: `0` no case refused (an entry already complete is reported, not refused); `1` a case refused (no
   good row whose run is under the runs root and delivered its output, a damaged entry, a reference frozen for a
-  different prompt, a missing compose key whose run is gone, a store write that failed, or a run whose judged
+  different prompt, a missing compose key whose run is gone or whose scrub set this process cannot prove it
+  covers, a store write that failed, or a run whose judged
   document cannot be composed, differs from the one its live judge read, or has no live fingerprint); `2` usage
   (a bad `--variant`, no flow dir, a variant with no `results.jsonl`, no selected case with `semantic_pairwise`, the variant's
   lock held by a live run).

package/.claude/skills/cowork-harness/references/measurement.md

@@ -1,6 +1,6 @@
 # Measurement
 
-Tracks `cowork-harness 4.4.0` (baseline `desktop-2.19675.0`). Read it before comparing runs: `--repeat`, `--ablate-skill`, and the hygiene that keeps a batch valid.
+Tracks `cowork-harness 4.4.1` (baseline `desktop-2.19675.0`). Read it before comparing runs: `--repeat`, `--ablate-skill`, and the hygiene that keeps a batch valid.
 
 ### Measure — before/after, with/without (`--repeat`, `--ablate-skill`)
 
@@ -56,7 +56,7 @@ Compare timings between runs of the same tier and model only.
    `fingerprint.skillHash` is content-exact but one-way, so an edit mid-batch silently splits your
    dataset into two generations — and a hash whose source was never frozen identifies a generation that
    is unrecoverable. `stats --group-by skill-hash` separates them after the fact; nothing recovers the
-   source.
+   source. (`stats --reindex` rebuilds the runs index from the run dirs when it is lost or predates it.)
 3. **Check which arm you actually ran** before analysing anything: `ablated` and
    `context.availableSkills` in each `result.json`.
 4. **Classify each rep three ways**: invocation (`skillsInvoked`), observed source access (did it read

package/.claude/skills/cowork-harness/references/run-record-replay.md

@@ -1,6 +1,6 @@
 # Run, record and lock
 
-Tracks `cowork-harness 4.4.0` (baseline `desktop-2.19675.0`). Read it when running a scenario, recording or placing a cassette, reading verdict signals, checking a background run, or choosing CI lanes.
+Tracks `cowork-harness 4.4.1` (baseline `desktop-2.19675.0`). Read it when running a scenario, recording or placing a cassette, reading verdict signals, checking a background run, or choosing CI lanes.
 
 ## Part II — RUN, RECORD & LOCK
 
@@ -21,9 +21,20 @@ never calls the semantic judge, so a `semantic_matches` or `semantic_pairwise` a
 `cowork-harness regrade <run-dir> --scenario <scenario.yaml>` re-grades those against the kept run (the judge call
 is the only spend) and reports whether the judge read the same document the live judge did (widening the evidence
 scope needs `--allow-unchecked`: content the live judge never read is refused otherwise). A part of the judge's
-input that cannot be proven scrubbed with the run's scrub set is refused too: on a run from before 4.4 (no
-`scrubSet` in `result.json`), from another machine, or after a token rotated, unchanged rubric lines re-grade but a
-new or edited one is refused until the case is re-run or `--allow-scrub-change` is passed. A run dir moved or
+input that cannot be proven scrubbed with the run's scrub set is refused too (exit 2, `refusals[]`, naming the parts,
+never their text). A run records a keyed fingerprint of its scrub set (`result.json` `scrubSet`); when this
+process's set provably covers it, everything is sent. Otherwise only parts equal to the run's own scrubbed record
+are: the pairwise task line, each rubric line, each evidence-health and scratch note, and each reference still
+byte-identical to the one a live comparison of the run was sent. So a new or edited rubric line
+(`rubric_unverifiable`), a changed prompt (`task_unverifiable`), a changed evidence note (`evidence_unverifiable`),
+or a reference re-frozen since the run (`reference_unverifiable`) is refused on a run recorded before the
+scrub-set fingerprint (no `scrubSet`), on one whose key was unusable (`scrubSetUnavailable`, see
+`debugging.md`), from another machine, or after a token it scrubbed rotated. Re-run the case (a new run records a
+fresh fingerprint), regrade with the run's scrub settings, or pass `--allow-scrub-change` after checking them (the
+grade records `scrubAcceptedBy`); `--allow-doc-drift` and `--allow-unchecked` never imply it.
+`ref freeze` applies the same proof: a document with no live fingerprint (`--allow-unchecked`) is composed with this
+process's scrub set, so it is frozen only when that set provably covers the run's, or with `--allow-scrub-change`;
+`ref verify` refuses both flags. A run dir moved or
 downloaded from where it ran is read from where it is; a COPY beside its still-present original is refused (its
 `result.json` names the original's files), so grade the original, or re-run the scenario. Or skip
 the discovery/encode/record dance entirely and answer gates **live during the recording** with
@@ -352,7 +363,8 @@ modes exist to withhold; `status.json` is still written either way, so `status`
 passed to `--run-dir` (a directory without its own `status.json`): it scans up to two levels down for the
 newest session's `status.json` and reads that. `--follow` fails loud on a timeout/staleness
 rather than hanging forever. (Fuller recipe in [`docs/run-status.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/run-status.md) — repo-only, not in the installed
-payload; `cowork-harness status --help` has the flags.)
+payload; `cowork-harness status --help` has the flags.) To find a scenario's newest run dir, use
+`cowork-harness status --latest-for <scenario>`, which orders by run time rather than directory mtime.
 
 **Poll with `--follow`, not with a shell loop over `status`'s stdout.** The one-shot text form prints to
 **stderr** and writes nothing to stdout; `--output-format json` (one envelope) and `--follow` (one JSON
@@ -373,6 +385,25 @@ in-flight run mid-artifact-write. Run it foreground, or detached from any proces
 (The `status.json` liveness above is exactly what surfaces such a teardown as `"error"`/`stale` rather
 than a stuck `"running"`.)
 
+### Other flags worth knowing
+
+- `skill` / `critique`: `--prompt-file <path>` reads the prompt verbatim (no shell parsing); `--marketplace <dir>
+  --enable name@mkt` loads skills through a marketplace; `--timeout <ms>` is the wall-clock budget;
+  `--allow-host-writes` consents to a writable `hostloop` connected folder; `--verbose` adds thinking, tool inputs
+  and the sub-agent tree to the output.
+- `run --matrix`: `--max-cells <n>` caps the cross-product (default 16), and a truncated matrix fails unless
+  `--allow-truncated-matrix` judges only the cells that ran.
+- `record`: `--max-artifact-bytes <n>` caps an inlined artifact body (default 65536); `--rerecord-stale
+  --from-embedded` re-records from the cassette's embedded scenario when no source file resolves.
+- `replay --mutate`: `--mutate-include` / `--mutate-exclude <glob>` scope which artifact paths are perturbed, and
+  `--mutate-max-per-file` / `--mutate-max-total` raise the sample caps (default 10 / 50).
+- `probe-dispatch --expect-write <suffix>` counts only a sub-agent write whose path ends with the suffix as delivered.
+- `ref freeze --case-id <id>` overrides the store entry's name (default: the scenario's name).
+- `fixture export <run-dir> --out <dir>` refuses a file holding a secret, and a text file or file name holding a host
+  path unless `--allow-host-paths` (a path into a run dir or a guest session is refused regardless).
+- `prune [--keep-last <n>] [--pinned-older-than <N>d]` removes old run dirs (default `--keep-last 5`);
+  `--dry-run` previews it.
+
 ### Place assertions in the right CI lane
 
 CI placement: a **token-free `replay` PR gate** (content/structure only) + a **nightly live `run`**

package/.claude/skills/cowork-harness/references/scenario-schema.md

@@ -1,6 +1,6 @@
 # Scenario & session schema, replay class, web_fetch, authoring gotchas
 
-Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 4.4.0`
+Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 4.4.1`
 (baseline `desktop-2.19675.0`). If your checkout is newer, prefer the live [`docs/scenario.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/scenario.md),
 [`docs/session.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/session.md), and `SPEC.md`.
 

package/.claude/skills/cowork-harness/references/semantic-judging.md

@@ -1,6 +1,6 @@
 # `semantic_matches` — the full semantics
 
-Tracks `cowork-harness 4.4.0` (baseline `desktop-2.19675.0`). The one-line summary is in
+Tracks `cowork-harness 4.4.1` (baseline `desktop-2.19675.0`). The one-line summary is in
 [assertion-catalog.md](assertion-catalog.md); this is the whole contract, split out so the catalog stays within the
 agent's single-read size.
 

package/.claude/skills/cowork-harness/references/task-recipes.md

@@ -2,7 +2,7 @@
 
 Each recipe composes facts that live scattered across SKILL.md and the other references into one
 decision path. Every one answers a question a real fleet owner had to work out the hard way.
-Tracks `cowork-harness 4.4.0` (baseline `desktop-2.19675.0`), same as SKILL.md's front-matter. Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
+Tracks `cowork-harness 4.4.1` (baseline `desktop-2.19675.0`), same as SKILL.md's front-matter. Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
 Recipe 3's `init-redact` shipped in 0.24.0 and are part of the current feature set — no version gate
 needed if your CLI meets SKILL.md's version floor.
 

package/CHANGELOG.md

@@ -6,6 +6,42 @@ All notable changes to this project are documented here. The format is based on
 
 ## [Unreleased]
 
+## [4.4.1] — 2026-10-05
+
+A companion-skill release: the skill now teaches 4.4.0's re-grade scrub-set proof, and a test keeps every CLI flag
+and `error.code` named in it. No CLI behaviour changes.
+
+### Upgrade notes
+
+- **Cassettes: no re-record needed.** Nothing under `src/`, `baselines/` or `docker/` changed, `latest` still
+  resolves to `desktop-2.19675.0`, and `CASSETTE_VERSION` is still 14.
+
+### Documentation
+
+- **The companion skill covers the re-grade scrub-set proof.**
+  - The hillclimb recipe says what to do with rows `hillclimb regrade` lists (exit 1) because a part of the
+    judge's input cannot be proven scrubbed with the run's scrub set (a run recorded before the scrub-set
+    fingerprint, an unusable key, another machine, a rotated token): regrade with the run's scrub settings, or
+    re-run the cases, which records a fresh fingerprint. It never passes `--allow-scrub-change` unattended; that
+    flag is the user's call after checking the scrub settings. Its `freeze-ref` and `--fill-refs` steps say when
+    they refuse or list for the same reason.
+  - The `regrade` reference names every part refused when unproven: the pairwise task line, rubric lines,
+    evidence-health and scratch notes, and a reference re-frozen since the run. It covers `ref freeze`'s proof for
+    an unchecked document (`--allow-scrub-change`), which `ref verify` refuses, and what the proof does not cover.
+  - The debugging reference explains the unusable-key warning (`scrubset.key` a symlink, readable by others,
+    owned by another user, empty, unreadable or not a key): such a run records `scrubSetUnavailable`, so its
+    later re-grades refuse with `scrubSet: "unrecorded"`; fix or delete the key file, then re-run the case. The
+    CI recipe says to keep `scrubset.key` out of version control and artifact uploads.
+- **The companion skill names every CLI long flag and every `error.code`.** A new test reads the flags from each
+  command's `--help` and the codes from `schema/*.json`, and fails on one the skill never mentions, unless it is
+  allowlisted with a reason. Its first run found 41 flags and 3 `regrade` codes (`doc_drift`,
+  `unchecked_content`, `no_semantic_asserts`) the skill never named. The skill now describes 39 of the flags and
+  all 3 codes; the other 2 are allowlisted (`--diff`, used only by `sync --diff` for baseline maintenance, and
+  `--strict-independent`, which is help prose, not a flag).
+- [RELEASING.md](./RELEASING.md) gains a step that reconciles the companion skill against the new version's
+  CHANGELOG, recipes first, before the live gate: a passage that is stale or missing blocks the release. The pull
+  request template asks every PR to state whether the companion skill is affected.
+
 ## [4.4.0] — 2026-10-05
 
 A security fix: `regrade` and `hillclimb regrade` no longer send a judge a value the run scrubbed. A run now records

package/DESIGN.md

@@ -208,7 +208,7 @@ The policy that produces those `allow`/`deny` responses is the **Decider** seam
 > Cowork system-prompt fingerprint all unchanged from `1.20186.0`, with the staged VM ELF re-synced
 > 2.1.202 → 2.1.205 — and the live pass of that era was deliberately **not** restamped onto it.)
 
-> **Scope of that claim.** `2026-10-03 / desktop-2.19675.0` is the baseline carrying the latest live pass, run against agent **2.1.286** (the staged Linux ELF for `container` and `microvm`, and the staged native macOS build `f2326db61802` for `hostloop`); the `protocol` tier runs the HOST `claude`, **2.1.289** for the final pass. No baselines have shipped since. **The 4.4.0 pass, 2026-10-05, on the release-prep commit `e9c516df`** (same baseline and staged agent; host `claude` 2.1.289 for `protocol`): (i) `vitest list --staticParse=false` listed all 23 live tests with no `SKIPPED` warning when the token was exported, and 6 with four warnings when none was resolvable; (ii) the live suite on `protocol`, `container` and `hostloop`: 23 passed, one pre-registered skip; (iii) the auto-memory check on all three tiers, `Tests  2 passed (2)` each; (iv) the companion skill's router check, three prompts on `container`: the authoring prompt read `authoring.md` and wrote a scenario that passes `lint`, the tool-timing prompt read `measurement.md` and answered with `trace … --view tool-durations`, and the debugging prompt read no reference and answered with correct clarifying questions, so `debugging.md` routing was not exercised in this pass; (v) the re-grade scrub-set check: a live run on the default runs root created `scrubset.key` beside the runs directory (mode 0600) and recorded `scrubSet` (`v: 1`) with the configured scrub literal absent from `result.json`; a re-grade of that run with an edited rubric line and a smaller scrub set was refused as `rubric_unverifiable` (exit 2) naming only the edited line, with no judge call and the run directory byte-identical; and a re-grade of a run recorded before 4.4 with an edited rubric line was refused with the `legacy` reason and the one-line remedy, again with no judge call and the run directory byte-identical. Live spend about **$2.83** recorded. **The 4.3.0 pass, on the release commit `8a5e479f`:** (1) the live suite on `protocol`, `container` and `hostloop`: 23 passed, one pre-registered skip (the auto-memory prerequisites check, which runs only under `COWORK_LIVE_REQUIRE=1`); before it ran, `vitest list --staticParse=false` listed all 23 with no `SKIPPED` warning, and 6 with four warnings when no token was resolvable, so a silent skip would have shown; (2) the auto-memory check on all three tiers, `Tests  2 passed (2)` each, every init frame without `memory_paths`; (3) the graders' pinned effort: every judged assert that called the judge in the live hillclimb acceptance runs (45, Opus 4.8: 25 `semantic_matches`, 20 `semantic_pairwise`; host `claude` 2.1.288 and 2.1.289) records `judgeTransport.effort: "high"`; the five pairwise asserts without a `judgeTransport` are the reference variant's own rows, which call no judge. **Earlier in the same release, on the release candidate's tree:** (4) a `microvm` smoke on a freshly booted VM (agent 2.1.286); (5) `boundary-check`, 6/6 constraints enforced; (6) an `eval` A/A at `--reps 4` on `container`, every row `no detectable change`, its report rebuilt byte-identical; (7) the companion skill's router check, three prompts on `container`: routing was correct on all three; one answer was wrong because a reference showed `artifact_text`'s `contains` without its list shape (fixed in the references, with a test that keeps every list-typed field shown as a list), and the same prompt's verdict went red on a false `host_path_leak`, because a reference spelled out the host roots that check looks for and the agent echoed it (fixed in the skill's files and in the check, which no longer counts a literal that comes from the plugin's or a local skill's own staged files); re-run after the fixes, the prompt routed correctly, wrote a scenario that passes `lint` and loads, and carried no `host_path_leak`; (8) the `hostloop` detached-agent kill check: the first pass found the workspace sidecar container, its `docker run` client and its network surviving SIGINT, which was fixed, and the re-run passed on a normal run, SIGINT to the harness process and SIGINT to the whole process group (exit 130, nothing left behind); (9) `vm delete`'s usage refusal; (10) `chat` under a real terminal, on `protocol`: Ctrl-C mid-turn exits 130 in about 2 s with nothing left running and no `result.json`; `/exit` followed by Ctrl-C exits 130 after writing the turn's `result.json`; Ctrl-C at the idle prompt ends the session normally (exit 0, `result.json` written); SIGHUP mid-turn exits 129 with nothing left running; and closing the terminal window mid-turn (run by hand) leaves no harness or agent process and no `result.json`. Total live spend about **$11.20**, including the re-runs. **Scope-out, so this is not read as more than it is.** (a) A live pass verifies observed behaviour, not the whole spawn contract by construction, and these checks are model-dependent, so a single red is evidence of model variance until a re-run says otherwise. (b) **CI does not live-validate anything.** Its "scenario suite (… live inference)" job is skipped as a whole without an `ANTHROPIC_API_KEY` repository secret, and none is set, so it shows as *skipped*. Before 2026-09 it instead ran with every real step skipped and reported *success*, so an older green check there means nothing ran. This note, not CI, is the live evidence. Separately and not a live matter: all four committed cassettes were **re-recorded** on 2026-10-03 against `2.19675.0` with auto-memory off, each on its original model: `example-pdf-skill` and `test/fixtures/tool-call-dispatch/dispatch-shell.cassette.json` (`container`, agent 2.1.286), `hostloop-computer-links` (`hostloop`, agent 2.1.286) and `example-multiselect-gate` (`protocol`, which runs the host CLI, here 2.1.287), about $0.75 in all. Their init frames carry no `memory_paths`. The recorder's own scrub (now applied to every recording) removed, across the four, the account's model menu, a subscription account's `rate_limit_info` (from `example-pdf-skill`, `dispatch-shell` and `hostloop-computer-links`) and the agent's sub-agent hand-back frame (from `dispatch-shell`). `verify-cassettes` exits 0 on all four, with one accepted `unscanned` entry (`example-pdf-skill`'s uploaded artifact body, too large to commit). Re-stamp this paragraph, naming the baseline, whenever a live pass is actually re-run.
+> **Scope of that claim.** `2026-10-03 / desktop-2.19675.0` is the baseline carrying the latest live pass, run against agent **2.1.286** (the staged Linux ELF for `container` and `microvm`, and the staged native macOS build `f2326db61802` for `hostloop`); the `protocol` tier runs the HOST `claude`, **2.1.289** for the final pass. No baselines have shipped since. **The 4.4.1 pass, 2026-10-05, on the release-prep commit `3e6fe443`** (a companion-skill-only release; same baseline and staged agent; host `claude` 2.1.289 for `protocol`): (i) `vitest list --staticParse=false` listed all 23 live tests with no `SKIPPED` warning when the token was exported, and 6 with four warnings when none was resolvable; (ii) the auto-memory check on all three tiers, `Tests  2 passed (2)` each, every init frame without `memory_paths`; (iii) the companion skill's router check, three prompts on `container`: the authoring prompt read `authoring.md` (and `scenario-schema.md`, searching `assertion-catalog.md`) and wrote a scenario that passes `lint` with no error or warning, the debugging prompt read `debugging.md` and answered with correct clarifying questions, and the tool-timing prompt read `measurement.md` (and `debugging.md`, which documents `trace`'s views) and answered with `trace … --view tool-durations`. The live suite itself was not re-run: this release changes no code that runs. Live spend about **$1.08**. **The 4.4.0 pass, 2026-10-05, on the release-prep commit `e9c516df`** (same baseline and staged agent; host `claude` 2.1.289 for `protocol`): (i) `vitest list --staticParse=false` listed all 23 live tests with no `SKIPPED` warning when the token was exported, and 6 with four warnings when none was resolvable; (ii) the live suite on `protocol`, `container` and `hostloop`: 23 passed, one pre-registered skip; (iii) the auto-memory check on all three tiers, `Tests  2 passed (2)` each; (iv) the companion skill's router check, three prompts on `container`: the authoring prompt read `authoring.md` and wrote a scenario that passes `lint`, the tool-timing prompt read `measurement.md` and answered with `trace … --view tool-durations`, and the debugging prompt read no reference and answered with correct clarifying questions, so `debugging.md` routing was not exercised in this pass; (v) the re-grade scrub-set check: a live run on the default runs root created `scrubset.key` beside the runs directory (mode 0600) and recorded `scrubSet` (`v: 1`) with the configured scrub literal absent from `result.json`; a re-grade of that run with an edited rubric line and a smaller scrub set was refused as `rubric_unverifiable` (exit 2) naming only the edited line, with no judge call and the run directory byte-identical; and a re-grade of a run recorded before 4.4 with an edited rubric line was refused with the `legacy` reason and the one-line remedy, again with no judge call and the run directory byte-identical. Live spend about **$2.83** recorded. **The 4.3.0 pass, on the release commit `8a5e479f`:** (1) the live suite on `protocol`, `container` and `hostloop`: 23 passed, one pre-registered skip (the auto-memory prerequisites check, which runs only under `COWORK_LIVE_REQUIRE=1`); before it ran, `vitest list --staticParse=false` listed all 23 with no `SKIPPED` warning, and 6 with four warnings when no token was resolvable, so a silent skip would have shown; (2) the auto-memory check on all three tiers, `Tests  2 passed (2)` each, every init frame without `memory_paths`; (3) the graders' pinned effort: every judged assert that called the judge in the live hillclimb acceptance runs (45, Opus 4.8: 25 `semantic_matches`, 20 `semantic_pairwise`; host `claude` 2.1.288 and 2.1.289) records `judgeTransport.effort: "high"`; the five pairwise asserts without a `judgeTransport` are the reference variant's own rows, which call no judge. **Earlier in the same release, on the release candidate's tree:** (4) a `microvm` smoke on a freshly booted VM (agent 2.1.286); (5) `boundary-check`, 6/6 constraints enforced; (6) an `eval` A/A at `--reps 4` on `container`, every row `no detectable change`, its report rebuilt byte-identical; (7) the companion skill's router check, three prompts on `container`: routing was correct on all three; one answer was wrong because a reference showed `artifact_text`'s `contains` without its list shape (fixed in the references, with a test that keeps every list-typed field shown as a list), and the same prompt's verdict went red on a false `host_path_leak`, because a reference spelled out the host roots that check looks for and the agent echoed it (fixed in the skill's files and in the check, which no longer counts a literal that comes from the plugin's or a local skill's own staged files); re-run after the fixes, the prompt routed correctly, wrote a scenario that passes `lint` and loads, and carried no `host_path_leak`; (8) the `hostloop` detached-agent kill check: the first pass found the workspace sidecar container, its `docker run` client and its network surviving SIGINT, which was fixed, and the re-run passed on a normal run, SIGINT to the harness process and SIGINT to the whole process group (exit 130, nothing left behind); (9) `vm delete`'s usage refusal; (10) `chat` under a real terminal, on `protocol`: Ctrl-C mid-turn exits 130 in about 2 s with nothing left running and no `result.json`; `/exit` followed by Ctrl-C exits 130 after writing the turn's `result.json`; Ctrl-C at the idle prompt ends the session normally (exit 0, `result.json` written); SIGHUP mid-turn exits 129 with nothing left running; and closing the terminal window mid-turn (run by hand) leaves no harness or agent process and no `result.json`. Total live spend about **$11.20**, including the re-runs. **Scope-out, so this is not read as more than it is.** (a) A live pass verifies observed behaviour, not the whole spawn contract by construction, and these checks are model-dependent, so a single red is evidence of model variance until a re-run says otherwise. (b) **CI does not live-validate anything.** Its "scenario suite (… live inference)" job is skipped as a whole without an `ANTHROPIC_API_KEY` repository secret, and none is set, so it shows as *skipped*. Before 2026-09 it instead ran with every real step skipped and reported *success*, so an older green check there means nothing ran. This note, not CI, is the live evidence. Separately and not a live matter: all four committed cassettes were **re-recorded** on 2026-10-03 against `2.19675.0` with auto-memory off, each on its original model: `example-pdf-skill` and `test/fixtures/tool-call-dispatch/dispatch-shell.cassette.json` (`container`, agent 2.1.286), `hostloop-computer-links` (`hostloop`, agent 2.1.286) and `example-multiselect-gate` (`protocol`, which runs the host CLI, here 2.1.287), about $0.75 in all. Their init frames carry no `memory_paths`. The recorder's own scrub (now applied to every recording) removed, across the four, the account's model menu, a subscription account's `rate_limit_info` (from `example-pdf-skill`, `dispatch-shell` and `hostloop-computer-links`) and the agent's sub-agent hand-back frame (from `dispatch-shell`). `verify-cassettes` exits 0 on all four, with one accepted `unscanned` entry (`example-pdf-skill`'s uploaded artifact body, too large to commit). Re-stamp this paragraph, naming the baseline, whenever a live pass is actually re-run.
 
 > The staged agent ELF is unchanged (2.1.181) across the 1.14271.0→1.15200.0 asar bump, and 2.1.187 across the 1.15200.0→1.15962.0 bump. The live scenario suite (`protocol` + `container` tiers) was re-run against the 1.15200.0 baseline; the 1.15962.0 bump was verified via asar analysis (content byte-identical: host-loop generator, system prompt, identity string, gates, and egress domains all unchanged) plus a full local test suite pass. The 1.15962.1→1.17377.1 bump moved the staged agent to **2.1.197** and added `api.claude.ai` to the egress allowlist; re-verified via `sync` (no unknown deltas) plus a manual asar spot-check of the reconstructed prompt content (substantively unchanged — see the Parity entry in CHANGELOG.md) and a full live scenario-suite pass (`protocol` + `container` tiers).
 

package/README.md

@@ -36,7 +36,7 @@ npm ci && npm run build
 node dist/cli.js replay examples/replays/example-pdf-skill.cassette.json
 ```
 
-(Installing globally — `npm install -g "cowork-harness@^4.4.0"` — gives you the `cowork-harness` CLI for your own
+(Installing globally — `npm install -g "cowork-harness@^4.4.1"` — gives you the `cowork-harness` CLI for your own
 scenarios and cassettes; the bundled example above also replays from a global install — see the `$(npm root -g)` path below.)
 
 Full setup → [Quick start](./docs/cli.md#quick-start).
@@ -49,8 +49,8 @@ Three ways to use this project. Each row is the whole hook — follow the link f
 
 | I want to… | Start here | Needs |
 |---|---|---|
-| **Run scenarios myself** from a terminal | **[docs/cli.md](./docs/cli.md)**<br><br>`npm i -g "cowork-harness@^4.4.0"`<br>`cowork-harness replay examples/replays/example-pdf-skill.cassette.json` | Node ≥ 22. The replay demo above is token-free and needs nothing else; live tiers above `protocol` need Docker + a staged agent binary |
-| **Have Claude Code drive it** for me | **[docs/companion-skill.md](./docs/companion-skill.md)**<br><br>`/plugin marketplace add yaniv-golan/cowork-harness`<br>`/plugin install cowork-harness@cowork-harness` | Claude Code. The skill self-bootstraps the CLI via `npx "cowork-harness@^4.4.0"` |
+| **Run scenarios myself** from a terminal | **[docs/cli.md](./docs/cli.md)**<br><br>`npm i -g "cowork-harness@^4.4.1"`<br>`cowork-harness replay examples/replays/example-pdf-skill.cassette.json` | Node ≥ 22. The replay demo above is token-free and needs nothing else; live tiers above `protocol` need Docker + a staged agent binary |
+| **Have Claude Code drive it** for me | **[docs/companion-skill.md](./docs/companion-skill.md)**<br><br>`/plugin marketplace add yaniv-golan/cowork-harness`<br>`/plugin install cowork-harness@cowork-harness` | Claude Code. The skill self-bootstraps the CLI via `npx "cowork-harness@^4.4.1"` |
 | **Gate my skill in CI** | **[docs/ci.md](./docs/ci.md)**<br><br>`- uses: yaniv-golan/cowork-harness@v4`<br>`  with: { command: replay, path: cassettes/ }` | Nothing for the token-free gate; the live lane needs a self-hosted runner with Docker + an agent binary |
 
 Improving a skill round by round with Claude Code's `/claude-api hillclimb` loop? The harness is its runner, with

package/RELEASING.md

@@ -177,8 +177,11 @@ tagging `1.0.0`, deliberately review and freeze the surfaces with no machine-rea
 - [ ] **Does this release add or change a user-facing CLI flag, assertion key, cassette field, message,
       top-level scenario key, or version coupling?** If so update **CHANGELOG.md + README.md +
       `.claude/skills/cowork-harness/SKILL.md` + `references/`** — a version bump is NOT documentation.
-      Only *some* of this is guarded (the assertion-key catalog and cassette schema fields, by
-      `test/skill-docs-sync.test.ts`); a new **flag** or **message** is guarded by nothing and is on you.
+      `test/skill-docs-sync.test.ts` and `test/skill-flag-coverage.test.ts` guard names only: every assertion
+      key, cassette schema field, CLI long flag and `error.code` value must appear somewhere in the skill. A
+      message is guarded by nothing. A name can appear in a passage that no longer describes what it does, so
+      those tests pass while the instructions go stale; a changed refusal, exit code, default or flag meaning is
+      caught only by the companion-skill reconcile step below.
       Two consecutive consumer adoption reports spent ~40% of their findings on exactly this.
 - [ ] **New top-level scenario key?** Then the docs above MUST also state **the version floor and what an
       older CLI does with the key** — the loader is `z.strictObject`, so an unknown key is a hard error
@@ -211,6 +214,18 @@ tagging `1.0.0`, deliberately review and freeze the surfaces with no machine-rea
       a release that reports nothing reads as "unchanged" whether or not anyone checked — the same
       silence-is-not-a-verdict failure the 3.8.0 corpus preview exists to close. A consumer diffed two
       tags' `src/` by hand and still had to ask (2026-09-21) because the 3.7.0 notes said nothing either way.
+- [ ] **Reconcile the companion skill against the CHANGELOG.** Do it once the new version's CHANGELOG section is
+      final, and before any live gate. For every bullet in that section (every heading: Security, Upgrade notes,
+      Added, Changed, Fixed, Documentation), find each passage of `.claude/skills/cowork-harness/SKILL.md` and
+      `references/*.md` that describes the behaviour, and mark it **ok**, **stale** or **missing**. Search widely:
+      the command, its flags, its refusal and `error.code` names, and the nouns the bullet uses. Do the
+      step-by-step recipes first (`references/hillclimb-recipe.md`, `references/task-recipes.md`,
+      `references/authoring.md`): an agent follows a recipe literally, so a stale step there does the most harm. A
+      behaviour change is more than a new name: a changed refusal, exit code or default, or a change to what a flag
+      unlocks, makes every passage describing the old behaviour stale. Keep the table (bullet | skill file:line |
+      status | fix) with the release work; it is the evidence for this step. **Any stale or missing passage
+      blocks the release** until it is fixed, in present tense, with no per-release history in the skill. The
+      name guard above passes while a passage is stale, which is why this step is manual.
 - [ ] Bump every version location (items 1–10) with **`npm run bump -- X.Y.Z --write`** — it rewrites all
       of them via targeted patterns and updates the lockfile + self-checks `check:versions` (run without
       `--write` first to preview the diff; dry-run is the default). It deliberately does **not** touch the

package/docs/ci.md

@@ -144,7 +144,7 @@ jobs:
           model: claude-sonnet-5 # used only where a scenario's session sets no `model:`
 ```
 
-Every run writes a Markdown verdict table (scenario, pass/fail, signals, cost/turns when available, staleness findings, and the replay-skipped-assertions honesty line) to the job summary. Inputs: `command`, `path` (required), `version` (npm dist-tag/version, default `latest` — the recipes above pin `^4` instead, because leaving it at `latest` takes a CLI major the moment it is promoted even though your `uses:` ref never changed; pin an exact version for byte-reproducible CI. The companion skill's `cowork-harness@^4.4.0` floor guidance applies to ad-hoc CLI installs, not this input), `strict` (applies to `replay` (staleness findings), `lint`/`lint-skill` (WARN; INFO never gates unless `lint` gets `--min-severity INFO` via `extra-args`; a reviewed `lint-skill` finding you accept is suppressed with `extra-args: --suppressions <file> --strict-ignores` (one entry per accepted site, in a JSON file kept outside the plugin; a stale entry fails too) or `--ignore-rule <rule>[=<glob>]`, either of which keeps every other WARN gating — see [cli.md](./cli.md#flags-worth-knowing)), and `analyze-skill` (any **`error`**-severity finding — advisory findings are precisely the class that does NOT gate); IGNORED — not forwarded — for `verify-cassettes`/`run`, which don't accept the flag), `fail-on-skill-drift` (**`replay`-only** — never forwarded to the analyzers), `extra-args`, `summary` (default `true`), `anthropic-api-key` (live lane only), `model` (live lane only: exported as `COWORK_HARNESS_MODEL`, which fills in where a session sets no `model:` and no `--model` is passed; a `run` that resolves no model is refused with exit 2). Outputs: `ok` (`"true"`/`"false"`, mirrors the exit code), `envelope-path` (path to the raw JSON envelope, for post-processing), `summary-md` (the rendered verdict table, exposed as an output — not just written to `$GITHUB_STEP_SUMMARY` — because that file is scoped to this action's own invocation and a caller's later step gets a fresh, empty one). See [`action.yml`](https://github.com/yaniv-golan/cowork-harness/blob/main/action.yml) for the full input/output reference.
+Every run writes a Markdown verdict table (scenario, pass/fail, signals, cost/turns when available, staleness findings, and the replay-skipped-assertions honesty line) to the job summary. Inputs: `command`, `path` (required), `version` (npm dist-tag/version, default `latest` — the recipes above pin `^4` instead, because leaving it at `latest` takes a CLI major the moment it is promoted even though your `uses:` ref never changed; pin an exact version for byte-reproducible CI. The companion skill's `cowork-harness@^4.4.1` floor guidance applies to ad-hoc CLI installs, not this input), `strict` (applies to `replay` (staleness findings), `lint`/`lint-skill` (WARN; INFO never gates unless `lint` gets `--min-severity INFO` via `extra-args`; a reviewed `lint-skill` finding you accept is suppressed with `extra-args: --suppressions <file> --strict-ignores` (one entry per accepted site, in a JSON file kept outside the plugin; a stale entry fails too) or `--ignore-rule <rule>[=<glob>]`, either of which keeps every other WARN gating — see [cli.md](./cli.md#flags-worth-knowing)), and `analyze-skill` (any **`error`**-severity finding — advisory findings are precisely the class that does NOT gate); IGNORED — not forwarded — for `verify-cassettes`/`run`, which don't accept the flag), `fail-on-skill-drift` (**`replay`-only** — never forwarded to the analyzers), `extra-args`, `summary` (default `true`), `anthropic-api-key` (live lane only), `model` (live lane only: exported as `COWORK_HARNESS_MODEL`, which fills in where a session sets no `model:` and no `--model` is passed; a `run` that resolves no model is refused with exit 2). Outputs: `ok` (`"true"`/`"false"`, mirrors the exit code), `envelope-path` (path to the raw JSON envelope, for post-processing), `summary-md` (the rendered verdict table, exposed as an output — not just written to `$GITHUB_STEP_SUMMARY` — because that file is scoped to this action's own invocation and a caller's later step gets a fresh, empty one). See [`action.yml`](https://github.com/yaniv-golan/cowork-harness/blob/main/action.yml) for the full input/output reference.
 
 CI uses `ANTHROPIC_API_KEY` specifically because there's no interactive browser available to run
 `claude setup-token`'s OAuth flow in a GitHub Actions runner; locally, the OAuth token is preferred because

package/docs/cli.md

@@ -18,7 +18,7 @@ companion skill, CI). This page is the CLI one.
 **Install from npm:**
 
 ```bash
-npm install -g "cowork-harness@^4.4.0"    # puts the `cowork-harness` command on your PATH
+npm install -g "cowork-harness@^4.4.1"    # puts the `cowork-harness` command on your PATH
 ```
 
 **Or build from source:**
@@ -38,7 +38,7 @@ node dist/cli.js replay examples/replays/example-pdf-skill.cassette.json
 
 > **Installed globally instead?** Once linked/installed, the same command is `cowork-harness replay
 > <cassette>` — but the relative path above only resolves from a source checkout's `examples/replays/`.
-> From a global install (`npm i -g "cowork-harness@^4.4.0"`), point at the package root instead:
+> From a global install (`npm i -g "cowork-harness@^4.4.1"`), point at the package root instead:
 > `cowork-harness replay "$(npm root -g)/cowork-harness/examples/replays/example-pdf-skill.cassette.json"`
 > (or copy the cassette into your own project and pass that path).
 
@@ -48,7 +48,7 @@ Live `run`/`skill` need the prerequisites in the next section — note the `prot
 > - **Replay only (zero setup):** `cowork-harness replay <cassette>` — no token, no Docker, no agent. The command above.
 > - **`protocol` (real model, no Docker):** needs only the auth token (item 3 below).
 > - **Live `container` / `microvm` / `hostloop` / `cowork`:** needs Docker (or Lima for `microvm`), a staged agent, and the token — run `cowork-harness doctor` first.
-> - **Invocation:** from a source checkout, `node dist/cli.js <cmd>` (or `npm link` to get the `cowork-harness` command); from a global install, `cowork-harness <cmd>`; the companion skill falls back to `npx "cowork-harness@^4.4.0"`.
+> - **Invocation:** from a source checkout, `node dist/cli.js <cmd>` (or `npm link` to get the `cowork-harness` command); from a global install, `cowork-harness <cmd>`; the companion skill falls back to `npx "cowork-harness@^4.4.1"`.
 
 Two more worked examples worth knowing about: `examples/scenarios/protocol-smoke.yaml` (zero-Docker smoke
 test) and `examples/scenarios/skill-loads.yaml` (container-tier acceptance check) — see
@@ -126,7 +126,7 @@ The parts people ask about. **`package.json`'s `files[]` is the exhaustive, mach
 this table is the readable summary of it, and deliberately omits the infrastructure that always ships
 (`baselines/`, `schema/`, `fixtures/`, `scripts/`, `docker/`).
 
-| What ships | npm global (`npm install -g "cowork-harness@^4.4.0"`) | Source checkout (`git clone` + `npm ci`) |
+| What ships | npm global (`npm install -g "cowork-harness@^4.4.1"`) | Source checkout (`git clone` + `npm ci`) |
 |---|---|---|
 | CLI, `scenario.py` + assertion keys (enough for `lint` in CI) | ✓ | ✓ |
 | `SKILL.md`, all of `docs/`, `SPEC.md`/`DESIGN.md`/`AGENTS.md` | ✓ | ✓ |
@@ -141,7 +141,7 @@ since a global install puts nothing in your working directory. The matrix, answe
 examples are the only ones that still need a source checkout. The **marketplace skill install** is
 narrower again — it pulls only `.claude/skills/cowork-harness/` (SKILL.md + `references/` +
 `scenario.py`/assertion keys, per `.claude-plugin/marketplace.json`'s `source`); everything in the npm column
-arrives when the skill's first command self-bootstraps `npx "cowork-harness@^4.4.0"` — the last row stays
+arrives when the skill's first command self-bootstraps `npx "cowork-harness@^4.4.1"` — the last row stays
 ✗ either way, since `matrices/`, `answer-policies/` and `probes/` are not published at all. See
 [docs/companion-skill.md](./companion-skill.md) for that install path.
 

package/docs/companion-skill.md

@@ -28,7 +28,7 @@ claude plugin marketplace add yaniv-golan/cowork-harness
 claude plugin install cowork-harness@cowork-harness
 ```
 
-The skill **self-bootstraps the CLI**: if `cowork-harness` isn't on your PATH it falls back to `npx "cowork-harness@^4.4.0"` (a version floor that fails loud rather than silently fetching a too-old CLI; Node ≥ 22). Tiers above `protocol` still need Docker/Lima and a Claude Desktop agent binary — see the prerequisites below.
+The skill **self-bootstraps the CLI**: if `cowork-harness` isn't on your PATH it falls back to `npx "cowork-harness@^4.4.1"` (a version floor that fails loud rather than silently fetching a too-old CLI; Node ≥ 22). Tiers above `protocol` still need Docker/Lima and a Claude Desktop agent binary — see the prerequisites below.
 
 It also follows the open [Agent Skills](https://agentskills.io) spec, so it installs cross-editor (Cursor, Codex, OpenCode, …) via [`npx skills`](https://github.com/vercel-labs/skills) (Vercel Labs' CLI implementation of that spec):
 
@@ -43,7 +43,7 @@ npx skills add yaniv-golan/cowork-harness --skill cowork-harness
 short entrypoint (routing, the false-green invariants, short workflows); the detail it routes to lives in
 `references/`, which the agent reads on demand. Everything
 else (the CLI, `docs/`, the worked examples, the pytest lane) arrives when the skill's first command
-self-bootstraps `npx "cowork-harness@^4.4.0"`, which pulls the same npm package as a global install.
+self-bootstraps `npx "cowork-harness@^4.4.1"`, which pulls the same npm package as a global install.
 
 For the full package-contents table — what a global install gives you versus a source checkout — see
 [docs/cli.md → What ships](./cli.md#what-ships). It is maintained there, once.

package/examples/replays/README.md

@@ -16,7 +16,7 @@ DOES exercise a real gate exchange, see `example-multiselect-gate.cassette.json`
 
 Run it with:
 
-> Assumes the `cowork-harness` CLI is available — from a source checkout run `npm ci && npm run build && npm link` first, or `npm i -g "cowork-harness@^4.4.0"`. (`replay` itself needs nothing else — no token, no Docker.)
+> Assumes the `cowork-harness` CLI is available — from a source checkout run `npm ci && npm run build && npm link` first, or `npm i -g "cowork-harness@^4.4.1"`. (`replay` itself needs nothing else — no token, no Docker.)
 
 ```sh
 cowork-harness replay examples/replays/example-pdf-skill.cassette.json

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cowork-harness",
-  "version": "4.4.0",
+  "version": "4.4.1",
   "description": "Scriptable, CI-friendly harness for Claude Cowork's runtime contract for testing skills across scenarios \u2014 same agent, mounts, egress allowlist, permission protocol, and sandbox limitations.",
   "license": "MIT",
   "type": "module",