cowork-harness 4.4.0 → 4.5.0

package/.claude/skills/cowork-harness/SKILL.md

@@ -3,8 +3,8 @@ name: cowork-harness
 description: Test or debug a Claude Code skill/plugin under Claude Cowork's runtime — sandboxed agent, default-deny egress, the can_use_tool permission/question protocol — using the cowork-harness CLI. Use when validating or regression-testing a skill, authoring or debugging a scenario YAML (prompt + scripted answers + assert:), choosing a fidelity tier, scripting AskUserQuestion / tool-permission answers, asserting artifacts, egress, or sub-agent dispatch, measuring how long each tool call took (toolDurations / trace), or debugging a failed run or verdict from its result.json or transcript. Especially when a harness run no-ops an assertion, fails on an unanswered gate, false-greens, a steered answer never reaches the model, or a web_fetch is unexpectedly denied or gated. Also when iterating or hardening a skill across fixes, or grounding a skill's self-critique against its own run evidence — including a document-analysis skill (cap table, deck, financial model, transcript) that needs an uploaded file attached to be critiqued at all. Also for comparing two versions of a skill before merging an edit — did it make answers worse? (`eval`: paired A/B, pinned models) — or improving one round by round (`hillclimb`, the `/claude-api hillclimb` runner). NOT for generic unit testing (pytest/vitest of your own scripts) or non-Cowork CI. Covers the skill / run / chat / record / replay / trace / decide / assertions / scaffold / critique / stats / eval / hillclimb commands and the session-vs-scenario split.
 metadata:
   author: cowork-harness
-  version: 4.4.0
-  tracks-harness: cowork-harness 4.4.0 (baseline desktop-2.19675.0)
+  version: 4.5.0
+  tracks-harness: cowork-harness 4.5.0 (baseline desktop-2.26454.0)
 ---
 
 # cowork-harness
@@ -26,8 +26,8 @@ allowlist). This skill exists mostly to keep you out of those traps — the *Inv
 full landmine catalog in [`references/gotchas.md`](references/gotchas.md) are the highest-value part.
 Read them.
 
-> **Version note:** the facts and `file:line` pointers here track `cowork-harness 4.4.0` (baseline
-> `desktop-2.19675.0`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
+> **Version note:** the facts and `file:line` pointers here track `cowork-harness 4.5.0` (baseline
+> `desktop-2.26454.0`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
 > `SPEC.md` / `docs/*.md` over this snapshot, and re-run the bundled linter.
 
 ## Preflight — make sure the harness can actually run
@@ -43,7 +43,7 @@ Before the first command, confirm the CLI is reachable and **fail loud** (never
 
 - **One-shot check.** Run `cowork-harness doctor [--tier <tier>]` first — a read-only prerequisite check that inspects Docker, the staged agent, the token, and the baseline in one pass. The bullets below explain each thing it checks (and how to fix it).
 - **Replay-only? Skip `doctor`.** Replaying committed cassettes needs no Docker, no staged agent, and no token — and every tier's `doctor` validates the auth token (the live tiers also Docker + the staged agent), so a ✗ there is expected, not a blocker. Go straight to `cowork-harness replay <cassette>`.
-- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 4.4.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@^4.4.0" <cmd>` (Node ≥ 22), or install once with `npm i -g "cowork-harness@^4.4.0"`. **Pin `@^4.4.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
+- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 4.5.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@^4.5.0" <cmd>` (Node ≥ 22), or install once with `npm i -g "cowork-harness@^4.5.0"`. **Pin `@^4.5.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
 
   This skill documents the CURRENT surface, not release history. If `cowork-harness --version` is
   OLDER than the floor, the per-release record of what you are missing is [CHANGELOG.md](https://github.com/yaniv-golan/cowork-harness/blob/main/CHANGELOG.md)
@@ -130,7 +130,8 @@ behind each, is [`references/gotchas.md`](references/gotchas.md).
    recording the cassette that locks it.
 7. **The tier decides what exists.** `protocol` has no sandbox and no egress, tool names differ per tier
    (`container` serves `mcp__workspace__web_fetch`, not `WebFetch`), and every tier models Cowork's
-   desktop-local lane only.
+   local lane only; new Pro and Max tasks do not use it from 2026-10-06. Behaviour-shaped results transfer;
+   path, mount, delivery and egress results do not.
 8. **A WARN signal never blocks a green.** Read the verdict signals after every run
    (`prompt_asset_missing`, `undelivered_deliverables`, `model_fallback`, …).
 
@@ -156,7 +157,7 @@ behind each, is [`references/gotchas.md`](references/gotchas.md).
 | [`references/measurement.md`](references/measurement.md) | `--repeat`, `--ablate-skill`, measurement hygiene |
 | [`references/debugging.md`](references/debugging.md) | triage, `result.json` fields and `trace` views, `chat` |
 | [`references/gotchas.md`](references/gotchas.md) | the full "✓ passed ≠ correct" landmine catalog |
-| [`references/task-recipes.md`](references/task-recipes.md) | start here for "how do I X": evolve `assert:`, audit tier drift, redaction, budgets, answer quality |
+| [`references/task-recipes.md`](references/task-recipes.md) | start here for "how do I X": evolve `assert:`, audit tier drift, redaction, budgets, answer quality, and goals with no flag (force a compaction, ablate a section, a form reply, resume in a new conversation, hook JSON decisions, schema checks, unattended runs) |
 | [`references/assertion-catalog.md`](references/assertion-catalog.md) | every `assert:` key's semantics, the verdict-signal table |
 | [`references/semantic-judging.md`](references/semantic-judging.md) | `semantic_matches` in full: what the judge reads, fork results, refusal reasons, provenance |
 | [`references/scenario-schema.md`](references/scenario-schema.md) | every YAML field, which keys survive `replay`, the `web_fetch` model |

package/.claude/skills/cowork-harness/references/assertion-catalog.md

@@ -1,6 +1,6 @@
 # Assertion catalog
 
-Tracks `cowork-harness 4.4.0` (baseline `desktop-2.19675.0`). Every `assert:` key with its semantics, and the
+Tracks `cowork-harness 4.5.0` (baseline `desktop-2.26454.0`). Every `assert:` key with its semantics, and the
 verdict-signal table. Which keys survive `replay` is in [`scenario-schema.md`](./scenario-schema.md#replay-class);
 the scenario and session YAML fields are there too.
 
@@ -79,7 +79,7 @@ same set live from the schema.
 | `all_tasks_completed: true` | every task in `RunResult.tasks[]` reached status `"completed"` — **requires ≥1 task** (a zero-task run fails; assert `task_count_min` for presence); evidence-unavailable if tasks telemetry is absent |
 | `task_count_min: <N>` | at least N tasks were created (`RunResult.tasks.length >= N`) — the presence companion for task assertions |
 | `task_status: {match, status}` | a task whose `subject` OR `id` matches the regex `match` reached `status` — evidence-unavailable if tasks telemetry is absent; also fails **malformed** when a TaskCreate result was unparseable (corrupt task telemetry), mirroring the guard `all_tasks_completed`/`task_count_min` already had |
-| `no_scratchpad_leak: true` | every file presented via `present_files` that was in the scratchpad was successfully promoted to `mnt/outputs` (none left behind) — vacuously passes if nothing was presented (pair with a presence check to require a delivery); content-class: both the `present_files` tool_use and its own tool_result live in the ordinary events stream, so `RunResult.presentedFiles` re-derives on replay at container, where the agent's cwd IS the session root the live lane measures from; at hostloop the live lane measures from the session root while a re-drive has only the recorded cwd (`mnt/outputs` before Desktop 2.7032.0, an empty macOS system dir from it), so the promoted/leaked booleans there are not equivalent — immaterial to this key, which evaluates at container only (meaningfully replay-checkable, same as `skill_triggered`); evidence-unavailable if `presentedFiles` telemetry is absent (an older run predating the feature). **Container-only on the merits**: hostloop serves `present_files` but never promotes (its handler passes a validated path through), so there is no scratch→outputs copy that could leak. On microvm/protocol a scratchpad-delivered file is neither promoted to `mnt/outputs` nor detected there (a skill that delivers via write-to-cwd→`present_files` will false-red `user_visible_artifact` on those tiers; use `container`, or write directly to `outputs/`). Hostloop is not one of them: at hostloop a delivered file under the outputs dir is visible there immediately, so `user_visible_artifact` passes (before Desktop 2.7032.0 a write-to-cwd landed there; from it the agent runs at `/var/empty` and a relative write is refused). **The tool name is lane-specific:** `present_files` is the desktop-local lane's tool (the one this harness emulates); remote Cowork delivers via the agent-native `SendUserFile` instead, so a skill should describe the delivery outcome rather than naming either tool — this key asserts the harness-side delivery record either way. **Only `true` is valid** |
+| `no_scratchpad_leak: true` | every file presented via `present_files` that was in the scratchpad was successfully promoted to `mnt/outputs` (none left behind) — vacuously passes if nothing was presented (pair with a presence check to require a delivery); content-class: both the `present_files` tool_use and its own tool_result live in the ordinary events stream, so `RunResult.presentedFiles` re-derives on replay at container, where the agent's cwd IS the session root the live lane measures from; at hostloop the live lane measures from the session root while a re-drive has only the recorded cwd (`mnt/outputs` before Desktop 2.7032.0, an empty macOS system dir from it), so the promoted/leaked booleans there are not equivalent — immaterial to this key, which evaluates at container only (meaningfully replay-checkable, same as `skill_triggered`); evidence-unavailable if `presentedFiles` telemetry is absent (an older run predating the feature). **Container-only on the merits**: hostloop serves `present_files` but never promotes (its handler passes a validated path through), so there is no scratch→outputs copy that could leak. On microvm/protocol a scratchpad-delivered file is neither promoted to `mnt/outputs` nor detected there (a skill that delivers via write-to-cwd→`present_files` will false-red `user_visible_artifact` on those tiers; use `container`, or write directly to `outputs/`). Hostloop is not one of them: at hostloop a delivered file under the outputs dir is visible there immediately, so `user_visible_artifact` passes (before Desktop 2.7032.0 a write-to-cwd landed there; from it the agent runs at `/var/empty` and a relative write is refused). **The tool name is lane-specific:** `present_files` is the local lane's tool (the one this harness emulates); remote Cowork delivers via the agent-native `SendUserFile` instead, so a skill should describe the delivery outcome rather than naming either tool — this key asserts the harness-side delivery record either way. **Only `true` is valid** |
 | `present_files_called: true` | at least one file was actually delivered via the `present_files` tool (`RunResult.presentFilesCalls > 0` — the count of invocations that carried a well-formed `file_path`). Presence is read at the **invocation**, deliberately not off the classified `presentedFiles` list: that list drops any path it cannot resolve, and a host-path redaction policy makes that certain at `hostloop`, where a real host path redacts to `[REDACTED:…]/mnt/outputs/f`. So this key is safe to assert in a scenario you intend to `record` with redaction active — `record` refuses a cassette whose verdict redaction changed, and an invocation count cannot be changed by it. A run that called the tool but whose every call carried an unusable path reports **cannot verify**, never a claim of non-delivery. The presence companion to `no_scratchpad_leak` (which passes vacuously when nothing was presented). Pair them to require a delivery **and** require it not to leak. Content-class (re-derives identically on replay). **`fidelity: container` or `hostloop`** — the harness serves `present_files` at both (hostloop via a handler mirroring production's own host-loop branch: validate the path, pass it through, no promotion). `protocol` and `microvm` report cannot-verify. See the `no_scratchpad_leak` row, which stays container-only for a different reason; and see the lane note there — the tool name differs on remote Cowork. **Only `true` is valid** |
 | `question_asked: <regex>` | the agent asked an AskUserQuestion whose **question text** matches (`question`, falling back to `header`). Text only — for the options it offered, use `question_options` ⚠️ **Model-composed text, reworded run to run** — pin a producer-authored constant, not model prose. |
 | `question_options: {when_question?, equals?: [..], contains?: [..], order?}` | the option SET and ORDER a gate offered, **by label** — descriptions are not compared (see `question_context`). `when_question` selects the sub-question by the same label `question_asked` matches (omit only if exactly one fired; ambiguity FAILS). Exactly one of `equals` (complete set) / `contains` (subset); `order: exact` is the default because a re-ordered list is the defect this exists for. Captured at ask time, so a gate that was shown then denied/stalled still counts; unreadable evidence fails evidence-unavailable ⚠️ **Model-composed text, reworded run to run** — pin a producer-authored constant, not model prose. |
@@ -110,7 +110,7 @@ same set live from the schema.
 | `no_mcp_error: true` | no MCP round-trip failed (`RunResult.mcpErrors` is empty — no unhandled server, no handler throw) — live-only: MCP round-trips are harness-computed, not in the SDK stdout stream, so evidence-unavailable on replay (never a vacuous pass). **Only `true` is valid** |
 | `max_peak_rss_bytes: <N>` | peak sampled RSS of the agent sandbox ≤ N bytes (`RunResult.resources.peakRssBytes`) — live-only: replay never spawns a sandbox to sample, so evidence-unavailable on replay/protocol (never a vacuous pass); also evidence-unavailable when sampling captured no RSS value |
 | `semantic_matches: {rubric: [...], min_pass?, judge_model?, include_subagent_text?, include_fork_results?, evidence_files?: [..]}` | a pinned LLM judge grades each fixed `rubric` claim against the run's answer: the final result text, the transcript and the files the agent authored. The transcript is top-level `assistant_text` only — it excludes every `tool_use`/`tool_result` and sub-agent text unless opted in. Full semantics (evidence scope, fork results, refusals, judge provenance, cost): [semantic-judging.md](semantic-judging.md). |
-| `semantic_pairwise: {refs?: [..], rubric?: [..], pass_if?, order?, judge_model?, include_subagent_text?, include_fork_results?, evidence_files?: [..]}` | a pinned LLM judge compares this run's judged document with a **frozen reference** — the same document an earlier run (usually the baseline) produced, written once by `ref freeze` and never regenerated — and answers win, tie, loss or `both_bad`. **The judged document is the one `semantic_matches` builds** (final message + transcript + authored files, same `evidence_files` / `include_subagent_text` / `include_fork_results` options), so the transcript **excludes every `tool_use`/`tool_result`** and a criterion about whether a tool was called cannot be judged from it. `refs` are reference stores relative to the scenario file; the run is judged against every one (under `hillclimb run`, against the flow's own references instead — only the baseline's gates `pass_if`, a later variant's is a metric recorded with `gate: false`), and `pass_if` (default `not_worse`) must hold against each gating one: `win`, `not_worse` (win or tie), or `any` (graded at all — a metric only). `both_bad` fails `win` and `not_worse`. Which output the judge sees first is a seeded coin per run, assert and reference (`order: both` judges both orders: a win in one and a loss in the other is position bias and scores as a tie; any other disagreement keeps the worse outcome; each order's own outcome is recorded as `pairwise[].orders.candidate_first` / `.ref_first`, absent for a single-order grade, and a judge that favours whichever output it sees first shows across runs as `candidate_first` winning more often than `ref_first`). The judge never sees the words "reference" or "baseline". A reference must have been frozen with the same evidence options and for the same prompt; a missing, damaged, differently-scoped or other-prompt one **refuses the run before it spends anything**, as does a reference store inside any mounted source (the agent could read its own answer key). Unavailable evidence refuses with `semantic_matches`' typed reasons. Per-reference outcomes land in `assertions[].pairwise`. **LIVE-ONLY** — skipped on replay. |
+| `semantic_pairwise: {refs?: [..], rubric?: [..], pass_if?, order?, judge_model?, include_subagent_text?, include_fork_results?, evidence_files?: [..]}` | a pinned LLM judge compares this run's judged document with a **frozen reference** — the same document an earlier run (usually the baseline) produced, written once by `ref freeze` and never regenerated — and answers win, tie, loss or `both_bad`. **The judged document is the one `semantic_matches` builds** (final message + transcript + authored files, same `evidence_files` / `include_subagent_text` / `include_fork_results` options), so the transcript **excludes every `tool_use`/`tool_result`** and a criterion about whether a tool was called cannot be judged from it. `refs` are reference stores relative to the scenario file; the run is judged against every one (under `hillclimb run`, against the flow's own references instead — only the baseline's gates `pass_if`, a later variant's is a metric recorded with `gate: false`), and `pass_if` (default `not_worse`) must hold against each gating one: `win`, `not_worse` (win or tie), or `any` (graded at all — a metric only). `both_bad` fails `win` and `not_worse`. Which output the judge sees first is a seeded coin per run, assert and reference (`order: both` judges both orders: a win in one and a loss in the other is position bias and scores as a tie; any other disagreement keeps the worse outcome; each order's own outcome is recorded as `pairwise[].orders.candidate_first` / `.ref_first`, absent for a single-order grade, and a judge that favours whichever output it sees first shows across runs as `candidate_first` winning more often than `ref_first`). The judge never sees the words "reference" or "baseline", and the stored reference is scrubbed with the grading process's secret set before it reads it (`pairwise[].refRedactions`). A reference must have been frozen with the same evidence options and for the same prompt; a missing, damaged, differently-scoped or other-prompt one **refuses the run before it spends anything**, as does a reference store inside any mounted source (the agent could read its own answer key). Unavailable evidence refuses with `semantic_matches`' typed reasons. Per-reference outcomes land in `assertions[].pairwise`. **LIVE-ONLY** — skipped on replay. |
 | `artifact_json: {artifact, path, …}` | assert a JSON artifact's contents — `equals`/`gt`/`in`/`exists`/`absent`/`is_null` over a dotted `path` (`in` = membership in a list, for a stochastic/LLM value; `absent` ≠ `is_null`; an unresolved intermediate fails loud) |
 | `computer_links_resolve: true` | every `computer://` link in the model-visible transcript resolves to an artifact that exists in the run's collected outputs/mounts — a dangling link fails, naming which target was checked (a live host path, the collected work tree, or the replay manifest). **Requires ≥1 link** (zero links fails — use `computer_links_resolve_if_present` for the presence-free variant). **Only `true` is valid** (`false` is rejected by the schema) **Sees top-level `assistant_text` only — it excludes every `tool_use`/`tool_result`**, so a `computer://` link that appeared only inside a tool call or its result is invisible to it. |
 | `computer_links_resolve_if_present: true` | like `computer_links_resolve` but passes vacuously when the transcript has zero `computer://` links — the presence-free variant. **Only `true` is valid** **Sees top-level `assistant_text` only — it excludes every `tool_use`/`tool_result`**, so a `computer://` link that appeared only inside a tool call or its result is invisible to it. |

package/.claude/skills/cowork-harness/references/assertions-guide.md

@@ -1,6 +1,6 @@
 # Assertions guide
 
-Tracks `cowork-harness 4.4.0` (baseline `desktop-2.19675.0`). Read it when choosing assertion keys: the two orthogonal axes and the goal → key map. The full catalog is `assertion-catalog.md`.
+Tracks `cowork-harness 4.5.0` (baseline `desktop-2.26454.0`). Read it when choosing assertion keys: the two orthogonal axes and the goal → key map. The full catalog is `assertion-catalog.md`.
 
 ### Assertions: two orthogonal axes
 

package/.claude/skills/cowork-harness/references/authoring.md

@@ -1,6 +1,6 @@
 # Authoring a scenario
 
-Tracks `cowork-harness 4.4.0` (baseline `desktop-2.19675.0`). Read it when composing a `scenarios/*.yaml`: session vs scenario, discovery, the fidelity tier, the answer path, `web_fetch`, and scaffold + lint.
+Tracks `cowork-harness 4.5.0` (baseline `desktop-2.26454.0`). Read it when composing a `scenarios/*.yaml`: session vs scenario, discovery, the fidelity tier, the answer path, `web_fetch`, and scaffold + lint.
 
 ## Part I — AUTHOR a scenario
 
@@ -11,8 +11,10 @@ provenance, and the scaffold/lint tools that keep the YAML honest.
 ### Two files: session vs scenario
 
 - **`sessions/*.yaml`** — pre-prompt setup: `model`, mounts (`folders`), and discovery
-  (marketplaces / plugins / skills / mcp). One session is reused by many scenarios. A scenario that
-  omits `session:` gets an all-defaults **inline** session (not a file on disk).
+  (marketplaces / plugins / skills / mcp). One session is reused by many scenarios. A scenario's
+  `session:` is a **path** to such a file, never a nested block: `session: { plugins: … }` fails to load. A
+  scenario that omits `session:` gets an all-defaults session with no plugin declared, so a scenario that tests a
+  plugin needs a session file.
 - **`scenarios/*.yaml`** — the test: `prompt`, scripted `answers:`, and `assert:`.
 
 This split matters: release ground truth (`baseline:` / `baselines/`, produced by `sync`) is
@@ -52,18 +54,16 @@ Set the tier in the **scenario's `fidelity:` field**, not a flag — `run` rejec
 (it's a `skill`/`chat` flag; `run` takes fidelity only from the scenario). See
 `references/fidelity-and-answers.md`.
 
-**Every tier models Cowork's DESKTOP-LOCAL lane** — agent on the user's machine, shell rooted at
+**Every tier models Cowork's LOCAL lane** — agent on the user's machine, shell rooted at
 `/sessions/<id>`, folders at `/sessions/<id>/mnt/<name>`, delivery via `present_files`. Cowork's
 **remote** lane runs server-side in a cloud container with a different filesystem (`$HOME/mnt/`),
 different delivery (`/mnt/user-data/outputs/` + `SendUserFile`) and a server-authored prompt; no tier
-reproduces it and none can — that container is not something a local tool can stand up. No setting
-reliably decides which lane a real session gets: sessions ran in the cloud with "Only on this computer"
-**on** (observed 2026-10-02), and for Pro and Max plans Anthropic
-[announces](https://support.claude.com/en/articles/15520349-use-claude-cowork-on-web-desktop-and-mobile) that new
-tasks run in the cloud from 2026-10-06. Check the session's own lane
+reproduces it and none can — that container is not something a local tool can stand up.
+[From 2026-10-06 new Pro and Max tasks run in the cloud](https://support.claude.com/en/articles/15520349-use-claude-cowork-on-web-desktop-and-mobile);
+before then no setting reliably decided the lane. Check the session's own lane
 ([how](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/fidelity-gaps.md#which-lane-a-session-actually-ran-on)).
 So: behaviour conclusions (triggering, tool sequencing, gate handling) travel between lanes; anything
-asserting a **path, mount or delivery mechanism** is a claim about the local lane only. Declare
+asserting a **path, mount, delivery mechanism or egress rule** is a claim about the local lane only. Declare
 `lane: remote` when the scenario is about that lane — the affected assertions then refuse to grade
 rather than passing (see the `delivery_unobservable` WARN and the `lane: remote` load-time rejections
 in `run-record-replay.md`).
@@ -213,6 +213,10 @@ cowork-harness scaffold --name report-check --skill ./skills/report-gen \
   --egress-allowed api.weather.example.com --out scenarios/report-check.yaml
 ```
 
+Each repeatable flag adds one item: `--content` a `transcript_matches`, `--tool` a `tool_called`, `--subagent` a
+`subagent_dispatched`, `--file` a `file_exists`, `--artifact` a `user_visible_artifact`, `--egress-allowed` /
+`--egress-denied` an `egress_allowed` / `egress_denied`, `--gate REGEX=CHOICE` a scripted answer and `--web-fetch`
+an approval rule; `--no-delete` adds `no_delete_in_outputs: true`, and `--no-validate` skips the self-lint.
 The flag-built form runs the bundled `scripts/scenario.py scaffold`, which also runs directly with the
 same flags (installed as a plugin, `${CLAUDE_PLUGIN_ROOT}/scripts/scenario.py`).
 

package/.claude/skills/cowork-harness/references/ci-recipe.md

@@ -1,6 +1,6 @@
 # CI recipe — replay vs live lanes
 
-Self-contained reference. Tracks `cowork-harness 4.4.0` (baseline `desktop-2.19675.0`).
+Self-contained reference. Tracks `cowork-harness 4.5.0` (baseline `desktop-2.26454.0`).
 
 **Fastest path: the packaged Action.** One step gets you `replay`/`lint`/`verify-cassettes` plus a PR
 job-summary reporter (verdict table, staleness findings, cost/turns when available):
@@ -17,7 +17,7 @@ job-summary reporter (verdict table, staleness findings, cost/turns when availab
 CLI major reaches your workflow the moment it is promoted even though your `uses:` ref never changed — so a
 copy-pasted recipe that omits the input takes a major bump with no say in it. `^4` holds the major, needs no
 patch number to remember, and only wants a human decision at the next major. Pin an exact version
-(e.g. `version: "4.4.0"`) instead when you want byte-reproducible CI.
+(e.g. `version: "4.5.0"`) instead when you want byte-reproducible CI.
 
 Reach for the manual multi-step form below only when you need per-step control the Action's inputs don't
 cover (a custom flag combination, a different runner matrix per step, or `lint`/`verify-cassettes` gated
@@ -36,7 +36,7 @@ jobs:
       - uses: actions/checkout@v4
       - name: Stage the agent binary (official channel, sha256-verified against the pinned baseline)
         run: |
-          V=2.1.286   # match your scenario's pinned baseline's agentVersion
+          V=2.1.289   # match your scenario's pinned baseline's agentVersion
           # The release channel is NOT always the stable one. Desktop also stages release CANDIDATES,
           # served from .../claude-code-releases/rc/<commit>/. For some versions the stable path 404s
           # (2.1.255); for others it returns 200 and serves a DIFFERENT BUILD UNDER THE SAME VERSION
@@ -82,7 +82,7 @@ sha256-*checked* but not hard-blocking on mismatch — it's advisory for an inte
 GitHub-hosted runners, no token/Docker/agent:
 
 ```yaml
-- run: npm i -g "cowork-harness@^4.4.0"
+- run: npm i -g "cowork-harness@^4.5.0"
 - run: cowork-harness lint scenarios/*.yaml --strict --min-severity WARN
                                                     # no silent false-greens. WITHOUT --strict this
                                                     # step cannot fail on a WARN-class rule (e.g.
@@ -131,6 +131,16 @@ exits 0, so dropping the
 `verify-cassettes` step means a skill edit silently stops being tested. (One command instead of two:
 `replay --fail-on-skill-drift`.)
 
+`lint --json` and `lint-skill --json` print their findings as JSON for a script to read. `analyze-skill --strict
+<plugin-dir>/` is the static pre-flight for host-loop path fidelity and lost artifact write-backs (exit 3 when it
+could not parse a candidate); `--runtime` adds a headless-DOM confirmation (needs `jsdom`) that never changes
+the exit code.
+
+Other `verify-cassettes` flags: `--skip-privacy` or `--skip-staleness` runs only one half of the gate;
+`--skip-scenario-drift` drops the scenario-prompt drift check; `--allow-empty` lets an existing directory with no
+cassettes exit 0 (a missing path still fails); `--margins` prints each count-bound assert's recorded value against
+its budget (diagnostic, never the verdict).
+
 The rest of this doc explains the lane split, recording, privacy, and the full pipeline + live job.
 
 ## The core split: token-free PR gate + live nightly (self-hosted)
@@ -398,7 +408,7 @@ jobs:
         with: { node-version: '24' }
       - uses: actions/setup-python@v5
         with: { python-version: '3.x' }                                       # python3 only — PyYAML is bundled with the linter
-      - run: npm i -g "cowork-harness@^4.4.0"
+      - run: npm i -g "cowork-harness@^4.5.0"
       - run: cowork-harness lint scenarios/*.yaml                              # no-silent-false-green (needs python3; PyYAML bundled)
       - run: cowork-harness verify-cassettes cassettes/ --output-format json   # privacy + staleness gate
       - run: cowork-harness replay cassettes/ --output-format json             # token-free content/structure
@@ -427,7 +437,7 @@ jobs:
             echo "live=true" >> "$GITHUB_OUTPUT"
           fi
       - if: steps.guard.outputs.live == 'true'
-        run: npm i -g "cowork-harness@^4.4.0"
+        run: npm i -g "cowork-harness@^4.5.0"
       - if: steps.guard.outputs.live == 'true'
         run: cowork-harness run scenarios/ --output-format json
         env:
@@ -520,7 +530,11 @@ set `COWORK_HARNESS_RUNS_DIR` (or pass `--run-dir`) to a workspace-relative path
 artifact-upload step can collect them. Each run dir holds `events.jsonl`, `control-out.jsonl` and
 `egress.log` at the root, plus each turn's `run.jsonl` / `trace.json` / `result.json` under `turns/<N>/`
 (a single-turn run has just `turns/1/`; there is no root compat copy of any of these). Digest one with `cowork-harness trace <run-id | dir>`.
-Secrets are scrubbed from every persisted log by value.
+Secrets are scrubbed from every persisted log by value. The first live run under a runs root also creates its
+scrub-set key, `scrubset.key`, beside the runs root (in the working directory for `--run-dir runs`): add it to
+`.gitignore`, and never upload or commit it (an upload of `runs/` does not include it). A fresh runner creates a new
+key, so `regrade` of a CI run on another machine cannot prove its scrub set covered: new or edited rubric text is
+refused there; re-run the case instead.
 
 ## Don't assume a fixed assertion count across lanes
 

package/.claude/skills/cowork-harness/references/critique.md

@@ -1,6 +1,6 @@
 # Critique — the facts a plugin install can't otherwise reach
 
-Tracks `cowork-harness 4.4.0` (baseline `desktop-2.19675.0`). This is **not** a trim of the full
+Tracks `cowork-harness 4.5.0` (baseline `desktop-2.26454.0`). This is **not** a trim of the full
 [`docs/critique.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/critique.md) (repo-only —
 flags, cost, reproduction discipline, known limitations all live there). This file covers exactly what a
 plugin install cannot otherwise discover: the run-dir artifact a harvester actually reads, the report's
@@ -35,7 +35,9 @@ Two things a harvester needs: roll-ups are excluded from `stats` aggregation (th
 counting them adds a phantom run and drags `passRate` toward 1), so **filter them out of any pass-rate
 computed over raw rows** — that exclusion also governs `stats --group-by skill-hash`, so a per-generation
 **total spend** still needs the raw rows (only the roll-up carries the evaluator passes); and a roll-up with `result:"error"` had an unpriced workload, so its totals
-UNDERCOUNT. The index is the only cost record that survives run-dir pruning.
+UNDERCOUNT. The index is the only cost record that survives run-dir pruning. `--evaluator-model <id>` changes
+only the evaluator passes' model (and the armor's injection-resistance check covers the default evaluator only);
+when the task turn dominates cost, the levers are `--model`, `--timeout` and the probe's scope.
 
 ## An exit-2 report — which turn failed, and whether it was really infrastructure
 

package/.claude/skills/cowork-harness/references/debugging.md

@@ -1,6 +1,6 @@
 # Debugging a run
 
-Tracks `cowork-harness 4.4.0` (baseline `desktop-2.19675.0`). Read it when a run misbehaved or a green looks wrong: triage, the observability output, and `chat`.
+Tracks `cowork-harness 4.5.0` (baseline `desktop-2.26454.0`). Read it when a run misbehaved or a green looks wrong: triage, the observability output, and `chat`.
 
 ## Part III — Debug
 
@@ -40,10 +40,30 @@ rubric changed (or you want another judge model) on a run you already paid for,
 kept run without re-running the agent — unlike the tools above it is not token-free (the judge call is its
 spend) — writes the grade beside the run, and says whether the judge read the same document the live judge did.
 Content the live judge never read (a widened `evidence_files` / `include_subagent_text` / `include_fork_results` scope, or a larger
-`--authored-total-bytes`) is refused unless you pass `--allow-unchecked`. A `task_unverifiable` /
+`--authored-total-bytes`) is refused unless you pass `--allow-unchecked` (`error.code` `unchecked_content`); a
+judged document that differs from the one the live judge read is refused as `doc_drift` unless you pass
+`--allow-doc-drift`, and a scenario with no judged assert is `no_semantic_asserts`. A `task_unverifiable` /
 `rubric_unverifiable` / `evidence_unverifiable` / `reference_unverifiable` refusal means a part of the judge's input
-cannot be proven scrubbed with the run's scrub set (typically a pre-4.4 run with an edited rubric): re-run the
-case, or pass `--allow-scrub-change` after checking `COWORK_HARNESS_SCRUB_VALUES` / `_KEYS`.
+cannot be proven scrubbed with the run's scrub set (typically an edited rubric on a run recorded before the scrub-set
+fingerprint); `refusals[].scrubSet` says why (`legacy`, `unrecorded`, `mangled`, `key`, `smaller`). Re-run the
+case, regrade with the run's `COWORK_HARNESS_SCRUB_VALUES` / `_KEYS`, or pass `--allow-scrub-change` after checking
+them. Content accepted with `--allow-unchecked`, and the document of an `unknown` or `live_refused` assert, are
+outside that proof (scrubbed with this process's set only); `regrade` names both in a `::warning::` before judging.
+
+**`::warning:: [scrub-set] no scrub-set fingerprint is recorded: the installation key …`** means the run could not
+use its installation key, `scrubset.key` beside the runs root (`~/.cowork-harness/scrubset.key` for the default
+root; the current directory for `--run-dir runs`). The warning names the path and the defect: not a regular file
+(a symlink or a directory), readable or writable by others (it must be mode 600), owned by another user, empty (an
+interrupted create), unreadable, not a 64-hex-digit key, or could not be created. Such a run records
+`scrubSetUnavailable` instead of a `scrubSet`, so a later `regrade` of new or edited judge input refuses with
+`scrubSet: "unrecorded"` ("this run recorded no scrub set (its key …)"). The harness never removes or replaces an
+existing key file: fix it as the warning says (`chmod 600` a key you own, or delete a bad file so the next run
+creates a key), then re-run the case to record a fingerprint. Keep `scrubset.key` out of version control.
+
+Two more read-only views: `trace <run> --translate-paths` rewrites VM paths to host paths in the text
+`tools`/default views (an effective `hostloop` run with its `mounts.json`), and `diff <a> <b>` masks per-run noise
+(ids, timestamps, host paths) unless you pass `--no-normalize`; on two baselines, `--changelog` renders the
+known fields as prose.
 
 **microvm: "control-protocol write failed" with `env: 'claude': No such file or directory` in the agent
 stderr** usually means the VM never finished provisioning (the agent never reached PATH). Check
@@ -74,16 +94,14 @@ decide which assertions from *Assertions: two orthogonal axes* in `assertions-gu
   bare `trace` digests the whole run. The view set is actively being extended — run `trace --help` for
   the current list rather than relying on a fixed enumeration here.
 - **`lane: local|remote`** (scenario key, default `local`) — which Cowork lane's DELIVERY CONTRACT the run
-  is held to. As of Desktop 2.19675.0 the composer offers no per-session lane
-  picker and no setting reliably decides the lane (for Pro and Max plans, Anthropic
-  [announces](https://support.claude.com/en/articles/15520349-use-claude-cowork-on-web-desktop-and-mobile) that
-  new tasks run in the cloud from 2026-10-06); the lanes disagree about what *delivered* means. On `remote`,
+  is held to. `local` is the default and models the local lane, which new Pro and Max tasks do not use from
+  2026-10-06 (they run in the cloud); the lanes disagree about what *delivered* means. A live `local` run with an
+  environment-shaped assertion (a path, mount, delivery or egress key) prints one `[lane]` line on stderr saying
+  so, once per process; `--compact`/`--demo`, `CI` and `COWORK_HARNESS_NO_LANE_NOTICE=1` silence it. On `remote`,
   location delivers nothing (a remote container has no auto-delivering outputs dir and is reclaimed at
   session end), `present_files` is NOT served, and `user_visible_artifact` /
   `present_files_called` / `no_scratchpad_leak` are rejected at LOAD time as unable to pass. Reach for it
-  to check a skill's delivery survives the cloud lane (Anthropic
-  [announces](https://support.claude.com/en/articles/15520349-use-claude-cowork-on-web-desktop-and-mobile) that
-  from 2026-10-06 new Pro and Max tasks run in the cloud). Orthogonal to `fidelity` — a `lane: remote`
+  to check a skill's delivery survives the cloud lane, where new Pro and Max tasks run from 2026-10-06. Orthogonal to `fidelity` — a `lane: remote`
   scenario still runs locally.
 - **`cowork-harness stats [--metric <m>]`** — aggregate across the run index: `cost`, `duration`,
   `tokens`, `cache-tokens`, `model-cost`, `turns`, `pass-rate`. Filters: `--since`/`--baseline`/`--branch`,

package/.claude/skills/cowork-harness/references/eval.md

@@ -1,6 +1,6 @@
 # `eval` — paired before/after comparison of a skill edit (EXPERIMENTAL)
 
-Tracks `cowork-harness 4.4.0` (baseline `desktop-2.19675.0`). The full guide is
+Tracks `cowork-harness 4.5.0` (baseline `desktop-2.26454.0`). The full guide is
 [docs/eval.md](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/eval.md); this is the part you
 need while running it.
 
@@ -31,6 +31,9 @@ cowork-harness eval report <eval-dir>     # rebuild the report from the eval dir
   worst observed runs × 2 × `--reps` exceed x — pre-flight only, agent cost only, never a mid-run stop.
 - In a scenario directory, YAML with no `prompt:` (a session file) is skipped.
 - Run an A/A first (`--allow-identical-arms`, the same source twice) to see your scenarios' noise.
+- A directory arm's snapshot leaves out untracked files unless you pass `--include-untracked` (not with a
+  `git:` arm). `--correction bh|holm` picks the multiple-comparison correction behind `confirmed` (default
+  `bh` at q = 0.10; `holm` is stricter).
 
 ## Reading the labels
 

package/.claude/skills/cowork-harness/references/fidelity-and-answers.md

@@ -1,6 +1,6 @@
 # Fidelity tiers & answer paths
 
-Self-contained reference. Tracks `cowork-harness 4.4.0` (baseline `desktop-2.19675.0`).
+Self-contained reference. Tracks `cowork-harness 4.5.0` (baseline `desktop-2.26454.0`).
 
 > **This page vs. the repo docs.** This is the **offline snapshot** that ships inside the installed
 > plugin — it is self-contained on purpose. The repo carries four other fidelity views, each answering a
@@ -207,7 +207,11 @@ permissive behaviour is deliberately what the scenario is about.
 
 A Desktop update deletes the prior version's staged agent while often leaving an empty version dir, so
 a scenario pinning that agent version resolves to nothing. `doctor` validates the agent for its own
-current baseline, not what each scenario pins, so it can report ready seconds before the run fails.
+current baseline, not what each scenario pins, so it can report ready seconds before the run fails. Its
+staged-agent row ends with what Desktop has staged against that pin: staged and pinned; a newer agent staged
+(upgrade cowork-harness, or run `cowork-harness sync` if you maintain the baseline); this Desktop older than the
+pin; the pinned agent not staged (staging may be withheld, or no task has booted the VM
+since the update); or none found.
 
 To keep the exact pin, **recover the pinned ELF**: re-download that version from the release channel,
 check its sha256 against the baseline's, and set `COWORK_AGENT_BINARY` to it
@@ -298,7 +302,7 @@ up often enough to spell out:
   behavior). See [`docs/cassette.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/cassette.md) § "Still skipped on replay" and [`docs/scenario.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/scenario.md) § "Which
   assertions survive replay."
 - **`present_files` assertions can't verify off the tiers that serve the tool.** `no_scratchpad_leak` and
-  `present_files_called` check the `present_files` delivery path — the desktop-local lane's tool; remote
+  `present_files_called` check the `present_files` delivery path — the local lane's tool (not used by new Pro and Max tasks from 2026-10-06); remote
   Cowork delivers via the agent-native `SendUserFile` instead, so never hardcode a delivery tool name in
   a SKILL.md (Gotcha 24 in `gotchas.md`). **The harness** serves `present_files` on `container` **and `hostloop`**
   — not `microvm`/`protocol`. `present_files_called` works at both; `no_scratchpad_leak` stays

package/.claude/skills/cowork-harness/references/gotchas.md

@@ -1,6 +1,6 @@
 # Gotchas
 
-Tracks `cowork-harness 4.4.0` (baseline `desktop-2.19675.0`). The full "✓ passed ≠ correct" landmine catalog.
+Tracks `cowork-harness 4.5.0` (baseline `desktop-2.26454.0`). The full "✓ passed ≠ correct" landmine catalog.
 
 ## Gotchas — the "✓ passed ≠ correct" landmines
 
@@ -270,8 +270,8 @@ authorable). Reach for this list when debugging a run's behavior, that one while
     `--output-format json`). *Fix:* re-record against the pinned agent.
 
 24. **Never name the file-delivery tool in a `SKILL.md`.** *Why:* Cowork has **two**, one per product
-    lane, and an agent only sees the one for the surface it is on. The desktop-local sandbox this harness
-    emulates is served `mcp__cowork__present_files` (`{files:[{file_path}]}`); **remote** cloud-container
+    lane, and an agent only sees the one for the surface it is on. The local-lane sandbox this harness
+    emulates (not used by new Pro and Max tasks from 2026-10-06) is served `mcp__cowork__present_files` (`{files:[{file_path}]}`); **remote** cloud-container
     Cowork instead gives the agent the native `SendUserFile` (`files: string[]`, required `status`,
     optional `caption`/`display`). A skill that hardcodes either name works on one lane and fails on the
     other — and probing a remote session makes this harness look like it emulates the wrong tool under the

package/.claude/skills/cowork-harness/references/hillclimb-recipe.md

@@ -1,6 +1,6 @@
 # Recipe 7 — Climb a skill with `/claude-api hillclimb` and the harness as its runner
 
-Tracks `cowork-harness 4.4.0` (baseline `desktop-2.19675.0`). It needs a `cowork-harness` whose
+Tracks `cowork-harness 4.5.0` (baseline `desktop-2.26454.0`). It needs a `cowork-harness` whose
 `hillclimb --help` lists `--skill` (help goes to stderr). This page is the loop's procedure, step by step, in the order of the
 `/claude-api hillclimb` guide. Every mechanic (flags, refusals, the gate, `regrade`, `freeze-ref`, exit codes,
 row keys) is in [`hillclimb.md`](hillclimb.md); the setup and the full list of differences from the guide's own
@@ -59,6 +59,9 @@ Each line matches one entry of the list in [the hillclimb guide](https://github.
 - **Never pass `--approve-harness`.** It records the harness sha and is the user's to run. A refusal before
   spending prints `refusing to run: …` and exits 2: stop and show the user what it names. `freeze-ref` needs
   no approval.
+- **Never pass `--allow-scrub-change` unattended,** and never put it in an allowed prefix. It sends the judge a
+  part of its input that cannot be proven scrubbed with the run's scrub set, so it can disclose a secret the run
+  scrubbed. Pass it only after the user has checked the scrub settings and said yes for that listing.
 - **`--skill` takes the bare skill name** (a `skills/<dir>` name or the registered name), never `plugin:name`
   or a path.
 
@@ -76,10 +79,27 @@ Each line matches one entry of the list in [the hillclimb guide](https://github.
 - **Recompute the headline** from `F/<variant>/results.jsonl`, never from `summary.json`.
 - **Spot-check grading.** Read the lowest-scoring baseline rows' `explanation` and traces. If a rubric is wrong,
   tell the user; after they edit it and approve the new sha, `cowork-harness hillclimb regrade T --flow F`
-  re-evaluates every row in place from its kept run without running the agent: changed deterministic
+  re-evaluates the rows in place from their kept runs without running the agent: changed deterministic
   assertions and every metric without a judge call, a judged assertion re-judged because its rubric changed. An
   unchanged assertion whose evaluation a harness upgrade changed keeps its recorded outcome (noted); editing the
   assertion, or re-running the case, re-grades it.
+- **Rows listed instead of re-graded (exit 1).** A new or edited rubric line (or another part of the judge's input)
+  is sent only when it can be proven scrubbed with the run's scrub set. When it cannot, the row is listed, untouched
+  and still carrying its old grade, with no judge call; stderr names the parts and why the run's set is not proven,
+  and `F/<variant>/regrade.md` lists the row. The usual causes: a run recorded before the scrub-set fingerprint (no
+  `scrubSet` in its `result.json`; one stderr summary line counts them), a run whose key was unusable ("this run
+  recorded no scrub set"), a run from another machine or under a replaced `scrubset.key`, or a token the run
+  scrubbed that has rotated since. What to do, in order: if the run recorded no scrub set, first have the user fix
+  `scrubset.key` as its `::warning:: [scrub-set]` line names (see the debugging reference); the harness never
+  replaces an existing bad key, so a new run before that fix records no scrub set again and is listed again. If this
+  process lacks a scrub value the run had (`COWORK_HARNESS_SCRUB_VALUES` / `COWORK_HARNESS_SCRUB_KEYS`, a rotated
+  token), ask the user to set the run's settings and regrade again; otherwise the listed cases need new runs,
+  which record a fresh fingerprint once the key is usable. A pass
+  runs nothing for a slot that already has a row, so tell the user and propose running the change as a new variant,
+  or a fresh flow dir from the baseline when the baseline's rows are listed. Only if the user has checked the scrub
+  settings and asks for it, re-run the same `regrade` with `--allow-scrub-change` (the regrade file then records
+  `scrubAcceptedBy`). Never pass it unattended; `--allow-doc-drift`, `--allow-unchecked` and `--rejudge` never
+  imply it. Don't compare variants while rows are listed: their grades are from the old rubric.
 - **Triage every zero.** An agent's own failure is a scored row (`meta.failure_class: "errored_agent"`, with
   `meta.termination_rule`). Infrastructure, timeouts, a wrong served model and invalid judge grades are
   `errors.jsonl` rows, never in the scored denominator. A variant that rewords or batches its questions can miss
@@ -182,7 +202,11 @@ Each line matches one entry of the list in [the hillclimb guide](https://github.
 - **Grader drift.** If a rubric is wrong, the user edits it and approves the sha; then
   `cowork-harness hillclimb regrade T --flow F` re-grades every variant's rows (default `--variant all`) and writes
   `F/<variant>/regrade.md` when a row moved or was listed. A row whose judge evidence itself changed since it was graded is
-  listed instead: ask the user before re-running with `--rejudge`.
+  listed instead: ask the user before re-running with `--rejudge`. A row whose new rubric text cannot be proven
+  scrubbed with its run's scrub set is listed too, and so is one whose evidence would be less redacted than the
+  graded document: handle both as in Step 0.5 (*Rows listed instead of re-graded*), never with `--allow-doc-drift`.
+  For the less-redacted row the override, if the user asks for it, is `--rejudge --allow-scrub-change` together:
+  `--allow-scrub-change` alone does not re-judge changed evidence.
 - **A new metric.** Add `metrics:` to the scenario, have the user approve the sha, re-run
   `cowork-harness hillclimb state-template T --flow F` and merge only the new `metrics` entries into
   `_state.json`. Rows written before it lack the key (`check` notes them); `hillclimb regrade T --flow F` fills it
@@ -192,9 +216,16 @@ Each line matches one entry of the list in [the hillclimb guide](https://github.
   `cowork-harness hillclimb regrade T --flow F --fill-refs` (no `--case`: rows of cases with no pairwise
   assertion need the column too, at no judge cost), then `state-template T --flow F` and merge the new
   `win_vN` entries (it declares them only once no scored row lacks them). Only the baseline's reference
-  decides `pass`.
-- **After a rubric re-grade, compare the ranking.** If the order of the variants flipped, tell the user and
-  propose restarting the climb from the baseline.
+  decides `pass`. When an entry already frozen lacks a compose key (an assertion added or re-scoped since),
+  `freeze-ref` and a baseline pass add it only when this process's scrub set provably covers the run it was frozen
+  from; otherwise the case is refused (exit 1). The refusal says to re-run the variant, but a pass never re-runs a
+  filled slot and a baseline pass refuses again each time: restore the run's scrub settings and re-run `freeze-ref`,
+  or start a fresh flow dir. A `--fill-refs` comparison against a
+  reference the row's run never judged is proven only when the run's scrub set is covered; otherwise the row is
+  listed (exit 1) and keeps no `win_vN` column. Handle it as in Step 0.5: same scrub settings, or new runs; ask
+  the user before any `--allow-scrub-change`.
+- **After a rubric re-grade, compare the ranking** once no row is listed. If the order of the variants flipped,
+  tell the user and propose restarting the climb from the baseline.
 
 ## Step 5 — report and hand back
 

package/.claude/skills/cowork-harness/references/hillclimb.md

@@ -1,6 +1,6 @@
 # `hillclimb` — the runner for a `/claude-api hillclimb` loop
 
-Tracks `cowork-harness 4.4.0` (baseline `desktop-2.19675.0`). It needs a `cowork-harness` whose
+Tracks `cowork-harness 4.5.0` (baseline `desktop-2.26454.0`). It needs a `cowork-harness` whose
 `hillclimb --help` lists `--skill` (help goes to stderr). The command reference is
 [docs/cli.md](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/cli.md); this is the part a loop needs
 while it runs. It covers `run`, `check`, `state-template`, `freeze-ref` and `regrade`.
@@ -224,7 +224,9 @@ measured) whose run delivered an output, under the variant's lock: it refuses wh
 its `meta.run_dir`, else by its run id under the current runs root (`--run-dir` / `COWORK_HARNESS_RUNS_DIR`). An
 entry that is already complete is reported (`exists`), never rewritten. One that lacks a compose key (an assert
 added or re-scoped) gains it from the run it was frozen from, marked `unchecked`, and is refused when that run is
-gone: start a fresh flow dir then.
+gone: start a fresh flow dir then. The new document is composed with this process's scrub set, so it is added
+(by `freeze-ref` or a baseline pass) only when that set provably covers the one the run recorded (`scrubSet`);
+otherwise the case is refused with the remedy: re-run the variant, or add it under the run's scrub settings.
 
 Flags: `--variant ID` (required), `--flow DIR`, `--case ID` (repeatable), `--output-format text|json` (json
 carries `{frozen, added, exists, refused}`), `--dotenv FILE`, `--run-dir DIR`.
@@ -280,10 +282,12 @@ every climb there is finished.
   the judge's input is covered. Otherwise each part must equal the run's own scrubbed record: the pairwise `## Task`
   line (the prompt), each rubric line, each evidence note, and each reference, by its bytes whatever it is called
   (its send must hash to what a live comparison of the run under the same compose key was sent, `refSentSha256`; a
-  pre-4.4 grade's stored text must be one that comparison recorded). A reference re-frozen
-  since, or a `--fill-refs` reference the run never judged, proves nothing. A row with a part proven neither way is listed, with no judge call. A run from before 4.4 has no fingerprint, so
-  its new or edited rubric text is listed (one stderr line says so); so is a run from another machine, or one whose
-  token has rotated since. Re-run the case, or pass `--allow-scrub-change` after checking the scrub settings: the
+  grade recorded before the reference-send hash, the stored text must be one that comparison recorded). A reference
+  re-frozen since, or a `--fill-refs` reference the run never judged, proves nothing. A row with a part proven
+  neither way is listed, with no judge call. A run recorded before the scrub-set fingerprint (no `scrubSet`) proves
+  no coverage, so its new or edited rubric text is listed (one stderr line counts such rows); so is a run whose key
+  was unusable (`scrubSetUnavailable`), a run from another machine or under a replaced key, or one whose token has
+  rotated since. Re-run the case, or pass `--allow-scrub-change` after checking the scrub settings: the
   regrade file then records `scrubAcceptedBy`. Neither `--rejudge` nor `--allow-doc-drift` implies it.
 - **`--rejudge`:** every judged assert of every selected row is re-judged, with the flow's references as they are
   now. Use it after a judge change the triggers above do not see. Not with `--fill-refs`.
@@ -370,7 +374,11 @@ Flags: `--flow DIR`, `--variant all|baseline|v<N>` (default `all`: every variant
   assert does not line up with the scenario or whose deterministic outcome changed (run a default `regrade` first;
   an agent-failed row aside); one whose
   re-grade is judge-invalid; in a fill one whose kept outcome was judged against a reference that has changed
-  since; and an open `judge_invalid` slot.
+  since; one with a part of the judge's input not proven scrubbed with its run's scrub set, one whose evidence
+  would be less redacted than the graded document, or one whose re-judge needs an assert whose scrubbed literal
+  this process cannot reproduce (each released only by `--allow-scrub-change`, with `--rejudge` for a less-redacted
+  row, never by `--allow-doc-drift`); one whose assert has an edit inside a scrubbed literal (only a re-run applies
+  it); and an open `judge_invalid` slot.
 
 ## Exit codes
 
@@ -384,7 +392,8 @@ Flags: `--flow DIR`, `--variant all|baseline|v<N>` (default `all`: every variant
 - `state-template`: `0`, or `2` on usage or a refusal.
 - `freeze-ref`: `0` no case refused (an entry already complete is reported, not refused); `1` a case refused (no
   good row whose run is under the runs root and delivered its output, a damaged entry, a reference frozen for a
-  different prompt, a missing compose key whose run is gone, a store write that failed, or a run whose judged
+  different prompt, a missing compose key whose run is gone or whose scrub set this process cannot prove it
+  covers, a store write that failed, or a run whose judged
   document cannot be composed, differs from the one its live judge read, or has no live fingerprint); `2` usage
   (a bad `--variant`, no flow dir, a variant with no `results.jsonl`, no selected case with `semantic_pairwise`, the variant's
   lock held by a live run).

package/.claude/skills/cowork-harness/references/measurement.md

@@ -1,6 +1,6 @@
 # Measurement
 
-Tracks `cowork-harness 4.4.0` (baseline `desktop-2.19675.0`). Read it before comparing runs: `--repeat`, `--ablate-skill`, and the hygiene that keeps a batch valid.
+Tracks `cowork-harness 4.5.0` (baseline `desktop-2.26454.0`). Read it before comparing runs: `--repeat`, `--ablate-skill`, and the hygiene that keeps a batch valid.
 
 ### Measure — before/after, with/without (`--repeat`, `--ablate-skill`)
 
@@ -56,7 +56,7 @@ Compare timings between runs of the same tier and model only.
    `fingerprint.skillHash` is content-exact but one-way, so an edit mid-batch silently splits your
    dataset into two generations — and a hash whose source was never frozen identifies a generation that
    is unrecoverable. `stats --group-by skill-hash` separates them after the fact; nothing recovers the
-   source.
+   source. (`stats --reindex` rebuilds the runs index from the run dirs when it is lost or predates it.)
 3. **Check which arm you actually ran** before analysing anything: `ablated` and
    `context.availableSkills` in each `result.json`.
 4. **Classify each rep three ways**: invocation (`skillsInvoked`), observed source access (did it read