cowork-harness 4.4.1 → 4.5.0

package/.claude/skills/cowork-harness/SKILL.md

@@ -3,8 +3,8 @@ name: cowork-harness
 description: Test or debug a Claude Code skill/plugin under Claude Cowork's runtime — sandboxed agent, default-deny egress, the can_use_tool permission/question protocol — using the cowork-harness CLI. Use when validating or regression-testing a skill, authoring or debugging a scenario YAML (prompt + scripted answers + assert:), choosing a fidelity tier, scripting AskUserQuestion / tool-permission answers, asserting artifacts, egress, or sub-agent dispatch, measuring how long each tool call took (toolDurations / trace), or debugging a failed run or verdict from its result.json or transcript. Especially when a harness run no-ops an assertion, fails on an unanswered gate, false-greens, a steered answer never reaches the model, or a web_fetch is unexpectedly denied or gated. Also when iterating or hardening a skill across fixes, or grounding a skill's self-critique against its own run evidence — including a document-analysis skill (cap table, deck, financial model, transcript) that needs an uploaded file attached to be critiqued at all. Also for comparing two versions of a skill before merging an edit — did it make answers worse? (`eval`: paired A/B, pinned models) — or improving one round by round (`hillclimb`, the `/claude-api hillclimb` runner). NOT for generic unit testing (pytest/vitest of your own scripts) or non-Cowork CI. Covers the skill / run / chat / record / replay / trace / decide / assertions / scaffold / critique / stats / eval / hillclimb commands and the session-vs-scenario split.
 metadata:
   author: cowork-harness
-  version: 4.4.1
-  tracks-harness: cowork-harness 4.4.1 (baseline desktop-2.19675.0)
+  version: 4.5.0
+  tracks-harness: cowork-harness 4.5.0 (baseline desktop-2.26454.0)
 ---
 
 # cowork-harness
@@ -26,8 +26,8 @@ allowlist). This skill exists mostly to keep you out of those traps — the *Inv
 full landmine catalog in [`references/gotchas.md`](references/gotchas.md) are the highest-value part.
 Read them.
 
-> **Version note:** the facts and `file:line` pointers here track `cowork-harness 4.4.1` (baseline
-> `desktop-2.19675.0`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
+> **Version note:** the facts and `file:line` pointers here track `cowork-harness 4.5.0` (baseline
+> `desktop-2.26454.0`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
 > `SPEC.md` / `docs/*.md` over this snapshot, and re-run the bundled linter.
 
 ## Preflight — make sure the harness can actually run
@@ -43,7 +43,7 @@ Before the first command, confirm the CLI is reachable and **fail loud** (never
 
 - **One-shot check.** Run `cowork-harness doctor [--tier <tier>]` first — a read-only prerequisite check that inspects Docker, the staged agent, the token, and the baseline in one pass. The bullets below explain each thing it checks (and how to fix it).
 - **Replay-only? Skip `doctor`.** Replaying committed cassettes needs no Docker, no staged agent, and no token — and every tier's `doctor` validates the auth token (the live tiers also Docker + the staged agent), so a ✗ there is expected, not a blocker. Go straight to `cowork-harness replay <cassette>`.
-- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 4.4.1**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@^4.4.1" <cmd>` (Node ≥ 22), or install once with `npm i -g "cowork-harness@^4.4.1"`. **Pin `@^4.4.1`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
+- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 4.5.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@^4.5.0" <cmd>` (Node ≥ 22), or install once with `npm i -g "cowork-harness@^4.5.0"`. **Pin `@^4.5.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
 
   This skill documents the CURRENT surface, not release history. If `cowork-harness --version` is
   OLDER than the floor, the per-release record of what you are missing is [CHANGELOG.md](https://github.com/yaniv-golan/cowork-harness/blob/main/CHANGELOG.md)
@@ -130,7 +130,8 @@ behind each, is [`references/gotchas.md`](references/gotchas.md).
    recording the cassette that locks it.
 7. **The tier decides what exists.** `protocol` has no sandbox and no egress, tool names differ per tier
    (`container` serves `mcp__workspace__web_fetch`, not `WebFetch`), and every tier models Cowork's
-   desktop-local lane only.
+   local lane only; new Pro and Max tasks do not use it from 2026-10-06. Behaviour-shaped results transfer;
+   path, mount, delivery and egress results do not.
 8. **A WARN signal never blocks a green.** Read the verdict signals after every run
    (`prompt_asset_missing`, `undelivered_deliverables`, `model_fallback`, …).
 
@@ -156,7 +157,7 @@ behind each, is [`references/gotchas.md`](references/gotchas.md).
 | [`references/measurement.md`](references/measurement.md) | `--repeat`, `--ablate-skill`, measurement hygiene |
 | [`references/debugging.md`](references/debugging.md) | triage, `result.json` fields and `trace` views, `chat` |
 | [`references/gotchas.md`](references/gotchas.md) | the full "✓ passed ≠ correct" landmine catalog |
-| [`references/task-recipes.md`](references/task-recipes.md) | start here for "how do I X": evolve `assert:`, audit tier drift, redaction, budgets, answer quality |
+| [`references/task-recipes.md`](references/task-recipes.md) | start here for "how do I X": evolve `assert:`, audit tier drift, redaction, budgets, answer quality, and goals with no flag (force a compaction, ablate a section, a form reply, resume in a new conversation, hook JSON decisions, schema checks, unattended runs) |
 | [`references/assertion-catalog.md`](references/assertion-catalog.md) | every `assert:` key's semantics, the verdict-signal table |
 | [`references/semantic-judging.md`](references/semantic-judging.md) | `semantic_matches` in full: what the judge reads, fork results, refusal reasons, provenance |
 | [`references/scenario-schema.md`](references/scenario-schema.md) | every YAML field, which keys survive `replay`, the `web_fetch` model |

package/.claude/skills/cowork-harness/references/assertion-catalog.md

@@ -1,6 +1,6 @@
 # Assertion catalog
 
-Tracks `cowork-harness 4.4.1` (baseline `desktop-2.19675.0`). Every `assert:` key with its semantics, and the
+Tracks `cowork-harness 4.5.0` (baseline `desktop-2.26454.0`). Every `assert:` key with its semantics, and the
 verdict-signal table. Which keys survive `replay` is in [`scenario-schema.md`](./scenario-schema.md#replay-class);
 the scenario and session YAML fields are there too.
 
@@ -79,7 +79,7 @@ same set live from the schema.
 | `all_tasks_completed: true` | every task in `RunResult.tasks[]` reached status `"completed"` — **requires ≥1 task** (a zero-task run fails; assert `task_count_min` for presence); evidence-unavailable if tasks telemetry is absent |
 | `task_count_min: <N>` | at least N tasks were created (`RunResult.tasks.length >= N`) — the presence companion for task assertions |
 | `task_status: {match, status}` | a task whose `subject` OR `id` matches the regex `match` reached `status` — evidence-unavailable if tasks telemetry is absent; also fails **malformed** when a TaskCreate result was unparseable (corrupt task telemetry), mirroring the guard `all_tasks_completed`/`task_count_min` already had |
-| `no_scratchpad_leak: true` | every file presented via `present_files` that was in the scratchpad was successfully promoted to `mnt/outputs` (none left behind) — vacuously passes if nothing was presented (pair with a presence check to require a delivery); content-class: both the `present_files` tool_use and its own tool_result live in the ordinary events stream, so `RunResult.presentedFiles` re-derives on replay at container, where the agent's cwd IS the session root the live lane measures from; at hostloop the live lane measures from the session root while a re-drive has only the recorded cwd (`mnt/outputs` before Desktop 2.7032.0, an empty macOS system dir from it), so the promoted/leaked booleans there are not equivalent — immaterial to this key, which evaluates at container only (meaningfully replay-checkable, same as `skill_triggered`); evidence-unavailable if `presentedFiles` telemetry is absent (an older run predating the feature). **Container-only on the merits**: hostloop serves `present_files` but never promotes (its handler passes a validated path through), so there is no scratch→outputs copy that could leak. On microvm/protocol a scratchpad-delivered file is neither promoted to `mnt/outputs` nor detected there (a skill that delivers via write-to-cwd→`present_files` will false-red `user_visible_artifact` on those tiers; use `container`, or write directly to `outputs/`). Hostloop is not one of them: at hostloop a delivered file under the outputs dir is visible there immediately, so `user_visible_artifact` passes (before Desktop 2.7032.0 a write-to-cwd landed there; from it the agent runs at `/var/empty` and a relative write is refused). **The tool name is lane-specific:** `present_files` is the desktop-local lane's tool (the one this harness emulates); remote Cowork delivers via the agent-native `SendUserFile` instead, so a skill should describe the delivery outcome rather than naming either tool — this key asserts the harness-side delivery record either way. **Only `true` is valid** |
+| `no_scratchpad_leak: true` | every file presented via `present_files` that was in the scratchpad was successfully promoted to `mnt/outputs` (none left behind) — vacuously passes if nothing was presented (pair with a presence check to require a delivery); content-class: both the `present_files` tool_use and its own tool_result live in the ordinary events stream, so `RunResult.presentedFiles` re-derives on replay at container, where the agent's cwd IS the session root the live lane measures from; at hostloop the live lane measures from the session root while a re-drive has only the recorded cwd (`mnt/outputs` before Desktop 2.7032.0, an empty macOS system dir from it), so the promoted/leaked booleans there are not equivalent — immaterial to this key, which evaluates at container only (meaningfully replay-checkable, same as `skill_triggered`); evidence-unavailable if `presentedFiles` telemetry is absent (an older run predating the feature). **Container-only on the merits**: hostloop serves `present_files` but never promotes (its handler passes a validated path through), so there is no scratch→outputs copy that could leak. On microvm/protocol a scratchpad-delivered file is neither promoted to `mnt/outputs` nor detected there (a skill that delivers via write-to-cwd→`present_files` will false-red `user_visible_artifact` on those tiers; use `container`, or write directly to `outputs/`). Hostloop is not one of them: at hostloop a delivered file under the outputs dir is visible there immediately, so `user_visible_artifact` passes (before Desktop 2.7032.0 a write-to-cwd landed there; from it the agent runs at `/var/empty` and a relative write is refused). **The tool name is lane-specific:** `present_files` is the local lane's tool (the one this harness emulates); remote Cowork delivers via the agent-native `SendUserFile` instead, so a skill should describe the delivery outcome rather than naming either tool — this key asserts the harness-side delivery record either way. **Only `true` is valid** |
 | `present_files_called: true` | at least one file was actually delivered via the `present_files` tool (`RunResult.presentFilesCalls > 0` — the count of invocations that carried a well-formed `file_path`). Presence is read at the **invocation**, deliberately not off the classified `presentedFiles` list: that list drops any path it cannot resolve, and a host-path redaction policy makes that certain at `hostloop`, where a real host path redacts to `[REDACTED:…]/mnt/outputs/f`. So this key is safe to assert in a scenario you intend to `record` with redaction active — `record` refuses a cassette whose verdict redaction changed, and an invocation count cannot be changed by it. A run that called the tool but whose every call carried an unusable path reports **cannot verify**, never a claim of non-delivery. The presence companion to `no_scratchpad_leak` (which passes vacuously when nothing was presented). Pair them to require a delivery **and** require it not to leak. Content-class (re-derives identically on replay). **`fidelity: container` or `hostloop`** — the harness serves `present_files` at both (hostloop via a handler mirroring production's own host-loop branch: validate the path, pass it through, no promotion). `protocol` and `microvm` report cannot-verify. See the `no_scratchpad_leak` row, which stays container-only for a different reason; and see the lane note there — the tool name differs on remote Cowork. **Only `true` is valid** |
 | `question_asked: <regex>` | the agent asked an AskUserQuestion whose **question text** matches (`question`, falling back to `header`). Text only — for the options it offered, use `question_options` ⚠️ **Model-composed text, reworded run to run** — pin a producer-authored constant, not model prose. |
 | `question_options: {when_question?, equals?: [..], contains?: [..], order?}` | the option SET and ORDER a gate offered, **by label** — descriptions are not compared (see `question_context`). `when_question` selects the sub-question by the same label `question_asked` matches (omit only if exactly one fired; ambiguity FAILS). Exactly one of `equals` (complete set) / `contains` (subset); `order: exact` is the default because a re-ordered list is the defect this exists for. Captured at ask time, so a gate that was shown then denied/stalled still counts; unreadable evidence fails evidence-unavailable ⚠️ **Model-composed text, reworded run to run** — pin a producer-authored constant, not model prose. |

package/.claude/skills/cowork-harness/references/assertions-guide.md

@@ -1,6 +1,6 @@
 # Assertions guide
 
-Tracks `cowork-harness 4.4.1` (baseline `desktop-2.19675.0`). Read it when choosing assertion keys: the two orthogonal axes and the goal → key map. The full catalog is `assertion-catalog.md`.
+Tracks `cowork-harness 4.5.0` (baseline `desktop-2.26454.0`). Read it when choosing assertion keys: the two orthogonal axes and the goal → key map. The full catalog is `assertion-catalog.md`.
 
 ### Assertions: two orthogonal axes
 

package/.claude/skills/cowork-harness/references/authoring.md

@@ -1,6 +1,6 @@
 # Authoring a scenario
 
-Tracks `cowork-harness 4.4.1` (baseline `desktop-2.19675.0`). Read it when composing a `scenarios/*.yaml`: session vs scenario, discovery, the fidelity tier, the answer path, `web_fetch`, and scaffold + lint.
+Tracks `cowork-harness 4.5.0` (baseline `desktop-2.26454.0`). Read it when composing a `scenarios/*.yaml`: session vs scenario, discovery, the fidelity tier, the answer path, `web_fetch`, and scaffold + lint.
 
 ## Part I — AUTHOR a scenario
 
@@ -11,8 +11,10 @@ provenance, and the scaffold/lint tools that keep the YAML honest.
 ### Two files: session vs scenario
 
 - **`sessions/*.yaml`** — pre-prompt setup: `model`, mounts (`folders`), and discovery
-  (marketplaces / plugins / skills / mcp). One session is reused by many scenarios. A scenario that
-  omits `session:` gets an all-defaults **inline** session (not a file on disk).
+  (marketplaces / plugins / skills / mcp). One session is reused by many scenarios. A scenario's
+  `session:` is a **path** to such a file, never a nested block: `session: { plugins: … }` fails to load. A
+  scenario that omits `session:` gets an all-defaults session with no plugin declared, so a scenario that tests a
+  plugin needs a session file.
 - **`scenarios/*.yaml`** — the test: `prompt`, scripted `answers:`, and `assert:`.
 
 This split matters: release ground truth (`baseline:` / `baselines/`, produced by `sync`) is
@@ -52,18 +54,16 @@ Set the tier in the **scenario's `fidelity:` field**, not a flag — `run` rejec
 (it's a `skill`/`chat` flag; `run` takes fidelity only from the scenario). See
 `references/fidelity-and-answers.md`.
 
-**Every tier models Cowork's DESKTOP-LOCAL lane** — agent on the user's machine, shell rooted at
+**Every tier models Cowork's LOCAL lane** — agent on the user's machine, shell rooted at
 `/sessions/<id>`, folders at `/sessions/<id>/mnt/<name>`, delivery via `present_files`. Cowork's
 **remote** lane runs server-side in a cloud container with a different filesystem (`$HOME/mnt/`),
 different delivery (`/mnt/user-data/outputs/` + `SendUserFile`) and a server-authored prompt; no tier
-reproduces it and none can — that container is not something a local tool can stand up. No setting
-reliably decides which lane a real session gets: sessions ran in the cloud with "Only on this computer"
-**on** (observed 2026-10-02), and for Pro and Max plans Anthropic
-[announces](https://support.claude.com/en/articles/15520349-use-claude-cowork-on-web-desktop-and-mobile) that new
-tasks run in the cloud from 2026-10-06. Check the session's own lane
+reproduces it and none can — that container is not something a local tool can stand up.
+[From 2026-10-06 new Pro and Max tasks run in the cloud](https://support.claude.com/en/articles/15520349-use-claude-cowork-on-web-desktop-and-mobile);
+before then no setting reliably decided the lane. Check the session's own lane
 ([how](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/fidelity-gaps.md#which-lane-a-session-actually-ran-on)).
 So: behaviour conclusions (triggering, tool sequencing, gate handling) travel between lanes; anything
-asserting a **path, mount or delivery mechanism** is a claim about the local lane only. Declare
+asserting a **path, mount, delivery mechanism or egress rule** is a claim about the local lane only. Declare
 `lane: remote` when the scenario is about that lane — the affected assertions then refuse to grade
 rather than passing (see the `delivery_unobservable` WARN and the `lane: remote` load-time rejections
 in `run-record-replay.md`).

package/.claude/skills/cowork-harness/references/ci-recipe.md

@@ -1,6 +1,6 @@
 # CI recipe — replay vs live lanes
 
-Self-contained reference. Tracks `cowork-harness 4.4.1` (baseline `desktop-2.19675.0`).
+Self-contained reference. Tracks `cowork-harness 4.5.0` (baseline `desktop-2.26454.0`).
 
 **Fastest path: the packaged Action.** One step gets you `replay`/`lint`/`verify-cassettes` plus a PR
 job-summary reporter (verdict table, staleness findings, cost/turns when available):
@@ -17,7 +17,7 @@ job-summary reporter (verdict table, staleness findings, cost/turns when availab
 CLI major reaches your workflow the moment it is promoted even though your `uses:` ref never changed — so a
 copy-pasted recipe that omits the input takes a major bump with no say in it. `^4` holds the major, needs no
 patch number to remember, and only wants a human decision at the next major. Pin an exact version
-(e.g. `version: "4.4.1"`) instead when you want byte-reproducible CI.
+(e.g. `version: "4.5.0"`) instead when you want byte-reproducible CI.
 
 Reach for the manual multi-step form below only when you need per-step control the Action's inputs don't
 cover (a custom flag combination, a different runner matrix per step, or `lint`/`verify-cassettes` gated
@@ -36,7 +36,7 @@ jobs:
       - uses: actions/checkout@v4
       - name: Stage the agent binary (official channel, sha256-verified against the pinned baseline)
         run: |
-          V=2.1.286   # match your scenario's pinned baseline's agentVersion
+          V=2.1.289   # match your scenario's pinned baseline's agentVersion
           # The release channel is NOT always the stable one. Desktop also stages release CANDIDATES,
           # served from .../claude-code-releases/rc/<commit>/. For some versions the stable path 404s
           # (2.1.255); for others it returns 200 and serves a DIFFERENT BUILD UNDER THE SAME VERSION
@@ -82,7 +82,7 @@ sha256-*checked* but not hard-blocking on mismatch — it's advisory for an inte
 GitHub-hosted runners, no token/Docker/agent:
 
 ```yaml
-- run: npm i -g "cowork-harness@^4.4.1"
+- run: npm i -g "cowork-harness@^4.5.0"
 - run: cowork-harness lint scenarios/*.yaml --strict --min-severity WARN
                                                     # no silent false-greens. WITHOUT --strict this
                                                     # step cannot fail on a WARN-class rule (e.g.
@@ -408,7 +408,7 @@ jobs:
         with: { node-version: '24' }
       - uses: actions/setup-python@v5
         with: { python-version: '3.x' }                                       # python3 only — PyYAML is bundled with the linter
-      - run: npm i -g "cowork-harness@^4.4.1"
+      - run: npm i -g "cowork-harness@^4.5.0"
       - run: cowork-harness lint scenarios/*.yaml                              # no-silent-false-green (needs python3; PyYAML bundled)
       - run: cowork-harness verify-cassettes cassettes/ --output-format json   # privacy + staleness gate
       - run: cowork-harness replay cassettes/ --output-format json             # token-free content/structure
@@ -437,7 +437,7 @@ jobs:
             echo "live=true" >> "$GITHUB_OUTPUT"
           fi
       - if: steps.guard.outputs.live == 'true'
-        run: npm i -g "cowork-harness@^4.4.1"
+        run: npm i -g "cowork-harness@^4.5.0"
       - if: steps.guard.outputs.live == 'true'
         run: cowork-harness run scenarios/ --output-format json
         env:

package/.claude/skills/cowork-harness/references/critique.md

@@ -1,6 +1,6 @@
 # Critique — the facts a plugin install can't otherwise reach
 
-Tracks `cowork-harness 4.4.1` (baseline `desktop-2.19675.0`). This is **not** a trim of the full
+Tracks `cowork-harness 4.5.0` (baseline `desktop-2.26454.0`). This is **not** a trim of the full
 [`docs/critique.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/critique.md) (repo-only —
 flags, cost, reproduction discipline, known limitations all live there). This file covers exactly what a
 plugin install cannot otherwise discover: the run-dir artifact a harvester actually reads, the report's

package/.claude/skills/cowork-harness/references/debugging.md

@@ -1,6 +1,6 @@
 # Debugging a run
 
-Tracks `cowork-harness 4.4.1` (baseline `desktop-2.19675.0`). Read it when a run misbehaved or a green looks wrong: triage, the observability output, and `chat`.
+Tracks `cowork-harness 4.5.0` (baseline `desktop-2.26454.0`). Read it when a run misbehaved or a green looks wrong: triage, the observability output, and `chat`.
 
 ## Part III — Debug
 
@@ -94,16 +94,14 @@ decide which assertions from *Assertions: two orthogonal axes* in `assertions-gu
   bare `trace` digests the whole run. The view set is actively being extended — run `trace --help` for
   the current list rather than relying on a fixed enumeration here.
 - **`lane: local|remote`** (scenario key, default `local`) — which Cowork lane's DELIVERY CONTRACT the run
-  is held to. As of Desktop 2.19675.0 the composer offers no per-session lane
-  picker and no setting reliably decides the lane (for Pro and Max plans, Anthropic
-  [announces](https://support.claude.com/en/articles/15520349-use-claude-cowork-on-web-desktop-and-mobile) that
-  new tasks run in the cloud from 2026-10-06); the lanes disagree about what *delivered* means. On `remote`,
+  is held to. `local` is the default and models the local lane, which new Pro and Max tasks do not use from
+  2026-10-06 (they run in the cloud); the lanes disagree about what *delivered* means. A live `local` run with an
+  environment-shaped assertion (a path, mount, delivery or egress key) prints one `[lane]` line on stderr saying
+  so, once per process; `--compact`/`--demo`, `CI` and `COWORK_HARNESS_NO_LANE_NOTICE=1` silence it. On `remote`,
   location delivers nothing (a remote container has no auto-delivering outputs dir and is reclaimed at
   session end), `present_files` is NOT served, and `user_visible_artifact` /
   `present_files_called` / `no_scratchpad_leak` are rejected at LOAD time as unable to pass. Reach for it
-  to check a skill's delivery survives the cloud lane (Anthropic
-  [announces](https://support.claude.com/en/articles/15520349-use-claude-cowork-on-web-desktop-and-mobile) that
-  from 2026-10-06 new Pro and Max tasks run in the cloud). Orthogonal to `fidelity` — a `lane: remote`
+  to check a skill's delivery survives the cloud lane, where new Pro and Max tasks run from 2026-10-06. Orthogonal to `fidelity` — a `lane: remote`
   scenario still runs locally.
 - **`cowork-harness stats [--metric <m>]`** — aggregate across the run index: `cost`, `duration`,
   `tokens`, `cache-tokens`, `model-cost`, `turns`, `pass-rate`. Filters: `--since`/`--baseline`/`--branch`,

package/.claude/skills/cowork-harness/references/eval.md

@@ -1,6 +1,6 @@
 # `eval` — paired before/after comparison of a skill edit (EXPERIMENTAL)
 
-Tracks `cowork-harness 4.4.1` (baseline `desktop-2.19675.0`). The full guide is
+Tracks `cowork-harness 4.5.0` (baseline `desktop-2.26454.0`). The full guide is
 [docs/eval.md](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/eval.md); this is the part you
 need while running it.
 

package/.claude/skills/cowork-harness/references/fidelity-and-answers.md

@@ -1,6 +1,6 @@
 # Fidelity tiers & answer paths
 
-Self-contained reference. Tracks `cowork-harness 4.4.1` (baseline `desktop-2.19675.0`).
+Self-contained reference. Tracks `cowork-harness 4.5.0` (baseline `desktop-2.26454.0`).
 
 > **This page vs. the repo docs.** This is the **offline snapshot** that ships inside the installed
 > plugin — it is self-contained on purpose. The repo carries four other fidelity views, each answering a
@@ -207,7 +207,11 @@ permissive behaviour is deliberately what the scenario is about.
 
 A Desktop update deletes the prior version's staged agent while often leaving an empty version dir, so
 a scenario pinning that agent version resolves to nothing. `doctor` validates the agent for its own
-current baseline, not what each scenario pins, so it can report ready seconds before the run fails.
+current baseline, not what each scenario pins, so it can report ready seconds before the run fails. Its
+staged-agent row ends with what Desktop has staged against that pin: staged and pinned; a newer agent staged
+(upgrade cowork-harness, or run `cowork-harness sync` if you maintain the baseline); this Desktop older than the
+pin; the pinned agent not staged (staging may be withheld, or no task has booted the VM
+since the update); or none found.
 
 To keep the exact pin, **recover the pinned ELF**: re-download that version from the release channel,
 check its sha256 against the baseline's, and set `COWORK_AGENT_BINARY` to it
@@ -298,7 +302,7 @@ up often enough to spell out:
   behavior). See [`docs/cassette.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/cassette.md) § "Still skipped on replay" and [`docs/scenario.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/scenario.md) § "Which
   assertions survive replay."
 - **`present_files` assertions can't verify off the tiers that serve the tool.** `no_scratchpad_leak` and
-  `present_files_called` check the `present_files` delivery path — the desktop-local lane's tool; remote
+  `present_files_called` check the `present_files` delivery path — the local lane's tool (not used by new Pro and Max tasks from 2026-10-06); remote
   Cowork delivers via the agent-native `SendUserFile` instead, so never hardcode a delivery tool name in
   a SKILL.md (Gotcha 24 in `gotchas.md`). **The harness** serves `present_files` on `container` **and `hostloop`**
   — not `microvm`/`protocol`. `present_files_called` works at both; `no_scratchpad_leak` stays

package/.claude/skills/cowork-harness/references/gotchas.md

@@ -1,6 +1,6 @@
 # Gotchas
 
-Tracks `cowork-harness 4.4.1` (baseline `desktop-2.19675.0`). The full "✓ passed ≠ correct" landmine catalog.
+Tracks `cowork-harness 4.5.0` (baseline `desktop-2.26454.0`). The full "✓ passed ≠ correct" landmine catalog.
 
 ## Gotchas — the "✓ passed ≠ correct" landmines
 
@@ -270,8 +270,8 @@ authorable). Reach for this list when debugging a run's behavior, that one while
     `--output-format json`). *Fix:* re-record against the pinned agent.
 
 24. **Never name the file-delivery tool in a `SKILL.md`.** *Why:* Cowork has **two**, one per product
-    lane, and an agent only sees the one for the surface it is on. The desktop-local sandbox this harness
-    emulates is served `mcp__cowork__present_files` (`{files:[{file_path}]}`); **remote** cloud-container
+    lane, and an agent only sees the one for the surface it is on. The local-lane sandbox this harness
+    emulates (not used by new Pro and Max tasks from 2026-10-06) is served `mcp__cowork__present_files` (`{files:[{file_path}]}`); **remote** cloud-container
     Cowork instead gives the agent the native `SendUserFile` (`files: string[]`, required `status`,
     optional `caption`/`display`). A skill that hardcodes either name works on one lane and fails on the
     other — and probing a remote session makes this harness look like it emulates the wrong tool under the

package/.claude/skills/cowork-harness/references/hillclimb-recipe.md

@@ -1,6 +1,6 @@
 # Recipe 7 — Climb a skill with `/claude-api hillclimb` and the harness as its runner
 
-Tracks `cowork-harness 4.4.1` (baseline `desktop-2.19675.0`). It needs a `cowork-harness` whose
+Tracks `cowork-harness 4.5.0` (baseline `desktop-2.26454.0`). It needs a `cowork-harness` whose
 `hillclimb --help` lists `--skill` (help goes to stderr). This page is the loop's procedure, step by step, in the order of the
 `/claude-api hillclimb` guide. Every mechanic (flags, refusals, the gate, `regrade`, `freeze-ref`, exit codes,
 row keys) is in [`hillclimb.md`](hillclimb.md); the setup and the full list of differences from the guide's own

package/.claude/skills/cowork-harness/references/hillclimb.md

@@ -1,6 +1,6 @@
 # `hillclimb` — the runner for a `/claude-api hillclimb` loop
 
-Tracks `cowork-harness 4.4.1` (baseline `desktop-2.19675.0`). It needs a `cowork-harness` whose
+Tracks `cowork-harness 4.5.0` (baseline `desktop-2.26454.0`). It needs a `cowork-harness` whose
 `hillclimb --help` lists `--skill` (help goes to stderr). The command reference is
 [docs/cli.md](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/cli.md); this is the part a loop needs
 while it runs. It covers `run`, `check`, `state-template`, `freeze-ref` and `regrade`.

package/.claude/skills/cowork-harness/references/measurement.md

@@ -1,6 +1,6 @@
 # Measurement
 
-Tracks `cowork-harness 4.4.1` (baseline `desktop-2.19675.0`). Read it before comparing runs: `--repeat`, `--ablate-skill`, and the hygiene that keeps a batch valid.
+Tracks `cowork-harness 4.5.0` (baseline `desktop-2.26454.0`). Read it before comparing runs: `--repeat`, `--ablate-skill`, and the hygiene that keeps a batch valid.
 
 ### Measure — before/after, with/without (`--repeat`, `--ablate-skill`)
 

package/.claude/skills/cowork-harness/references/run-record-replay.md

@@ -1,6 +1,6 @@
 # Run, record and lock
 
-Tracks `cowork-harness 4.4.1` (baseline `desktop-2.19675.0`). Read it when running a scenario, recording or placing a cassette, reading verdict signals, checking a background run, or choosing CI lanes.
+Tracks `cowork-harness 4.5.0` (baseline `desktop-2.26454.0`). Read it when running a scenario, recording or placing a cassette, reading verdict signals, checking a background run, or choosing CI lanes.
 
 ## Part II — RUN, RECORD & LOCK
 
@@ -220,7 +220,7 @@ Recognize these before "fixing" a non-bug:
   `markitdown`/`magika` (`ml_extract`), `cv2` (`cv`), `camelot`/`tabula` (`pdf_tables`), or `wand`
   (`magick`) can trip this even though real Cowork **ships** those (per the rootfs manifest captured at
   Desktop `2.9939.2` — `baselines/provisioning/rootfs-provisioning.json`, which is the dated evidence
-  behind that sentence; 3 baselines have shipped since without a re-capture). The message says so ("likely a FALSE
+  behind that sentence; 5 baselines have shipped since without a re-capture). The message says so ("likely a FALSE
   NEGATIVE (real Cowork ships them)"). Fix: rebuild full parity (`--build-arg COWORK_FULL_PARITY=1`, point
   `COWORK_AGENT_IMAGE` at it), or — if the skill's fallback is genuinely equivalent — assert
   `allow_missing_capability: true`. (Two sources: a skill *observed using* an omitted family, live lane;
@@ -248,7 +248,7 @@ Recognize these before "fixing" a non-bug:
   scratchpad walk, absent delivery telemetry, or a resumed turn) — "cannot tell" never reads as "clean".
   **The fix is lane-dependent — and so is the PATH.** On `lane: local`, write deliverables where the user
   can see them, and give the file tools an **absolute** path under the outputs directory the agent's prompt
-  names. On the desktop-local host-loop lane (what production runs), against Desktop **2.7032.0 and later**,
+  names. On the local lane's host loop (what Desktop ran when measured), against Desktop **2.7032.0 and later**,
   the agent process runs outside the session (`/var/empty`), so a relative `Read`/`Write`/`Edit` — a bare
   filename or `outputs/x.md` alike — is **refused** ("File is in a directory that is denied by your
   permission settings."); only a pathless or relative `Grep`/`Glob` is redirected to outputs. (Before

package/.claude/skills/cowork-harness/references/scenario-schema.md

@@ -1,7 +1,7 @@
 # Scenario & session schema, replay class, web_fetch, authoring gotchas
 
-Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 4.4.1`
-(baseline `desktop-2.19675.0`). If your checkout is newer, prefer the live [`docs/scenario.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/scenario.md),
+Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 4.5.0`
+(baseline `desktop-2.26454.0`). If your checkout is newer, prefer the live [`docs/scenario.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/scenario.md),
 [`docs/session.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/session.md), and `SPEC.md`.
 
 **Minimal scenario** — `prompt` and `fidelity` are required:

package/.claude/skills/cowork-harness/references/semantic-judging.md

@@ -1,6 +1,6 @@
 # `semantic_matches` — the full semantics
 
-Tracks `cowork-harness 4.4.1` (baseline `desktop-2.19675.0`). The one-line summary is in
+Tracks `cowork-harness 4.5.0` (baseline `desktop-2.26454.0`). The one-line summary is in
 [assertion-catalog.md](assertion-catalog.md); this is the whole contract, split out so the catalog stays within the
 agent's single-read size.
 

package/.claude/skills/cowork-harness/references/task-recipes.md

@@ -2,7 +2,7 @@
 
 Each recipe composes facts that live scattered across SKILL.md and the other references into one
 decision path. Every one answers a question a real fleet owner had to work out the hard way.
-Tracks `cowork-harness 4.4.1` (baseline `desktop-2.19675.0`), same as SKILL.md's front-matter. Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
+Tracks `cowork-harness 4.5.0` (baseline `desktop-2.26454.0`), same as SKILL.md's front-matter. Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
 Recipe 3's `init-redact` shipped in 0.24.0 and are part of the current feature set — no version gate
 needed if your CLI meets SKILL.md's version floor.
 
@@ -321,3 +321,125 @@ load-bearing gates with `--answer` once you know which fire.
 `critique` finds what is wrong; `skill`/`run` checks it works. The loop's procedure, with `hillclimb run` as its
 runner, is its own page: [`hillclimb-recipe.md`](hillclimb-recipe.md). The command reference is
 [`hillclimb.md`](hillclimb.md).
+
+## Recipe 8 — Goals the harness has no flag for
+
+Also in [docs/scenario.md](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/scenario.md#recipes-for-goals-the-harness-has-no-flag-for).
+Each recipe below uses only shipped flags and keys. Each says what it does **not** prove.
+
+### Force a context compaction
+
+Pin a session, run the task, compact it by hand, check that turn, then continue:
+
+```bash
+cowork-harness skill ./my-plugin "<the task>" --session-id compact-1
+cowork-harness skill ./my-plugin "/compact" --session-id compact-1 --resume
+jq -e '[.contextEvents[]? | select(.subtype=="compact_boundary")] | length > 0' <run-dir>/turns/2/result.json
+cowork-harness skill ./my-plugin "<continue the task>" --session-id compact-1 --resume
+cowork-harness trace <run-dir>        # shows the latest turn: what the continued task did
+```
+
+The run dir is the one each turn's `[status]` line prints. A resumed session's dir holds one `turns/<n>/` per
+turn, and `verify-run` refuses a dir with more than one turn, so the `compaction_occurred` assert cannot be checked
+on it: read the `/compact` turn's own `result.json` instead (`jq` exits `0` when it recorded a compaction, `1` when it
+did not). *Does not prove:* that the skill behaves as it would after an automatic compaction. A manual
+`/compact` may not re-attach skills exactly as autocompact does (not verified), and re-attached skill text can come
+back truncated, so a long `SKILL.md` may not return whole.
+
+### Ablate one `SKILL.md` section
+
+Copy the plugin, delete the section from the copy, and run the two as `eval` arms.
+Size it first, at no cost:
+
+```bash
+cp -R ./my-plugin /tmp/nosec && $EDITOR /tmp/nosec/skills/<skill>/SKILL.md   # remove the section
+cowork-harness eval scenarios/ --arm full=./my-plugin --arm nosec=/tmp/nosec --dry-run --target-effect 30
+```
+
+*Does not prove:* which section drove a given action; it shows only whether removing it changes the graded outcome.
+
+### Test a skill's parsing of a Desktop form reply
+
+Desktop's elicitation form sends its answers as the next user
+message, as one line. Send that line as a resumed turn: `cowork-harness skill ./my-plugin "<the reply line>" --session-id s --resume`. The format,
+from Desktop's own form guide:
+
+- one line: `<Title> details — Label: value · Label: value`, labels being the form's field names in sentence case;
+- a multi-select value comma-joined; a short multi-line value flattened with ` / `; a value of 81–200 characters
+  in quotes;
+- a value over 200 characters shown as `Label: (N chars — see below)`, and repeated in full after a
+  `--- Full content ---` line;
+- a skipped form arrives as one fixed sentence saying it was skipped.
+
+*Does not prove:* that the model would choose the form (the harness serves no `visualize` tools; see
+[fidelity-gaps.md](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/fidelity-gaps.md#skill-argument-collection--the-elicitation-form-branch-is-not-reachable-here)),
+or that a file the form attaches arrives.
+
+### Resume the work in a new conversation
+
+Keep the first run, export its outputs, and start a second scenario from
+them:
+
+```bash
+cowork-harness run step1.yaml --keep
+cowork-harness fixture export <run-dir> --out scenarios/step1-out
+```
+
+```yaml
+# scenarios/step2.yaml
+workspace_fixture: step1-out
+assert:
+  - file_exists: {path: outputs/next.md, authored: true}            # this conversation wrote it
+  - file_exists: {path: outputs/brief.md, authored: false}          # carried over, not rewritten
+```
+
+Record step 2 with `--out` inside the same tree as the fixture: `record` refuses a fixture outside the cassette's git repository (outside git, outside the cassette's directory).
+*Does not prove:* how Cowork treats a new task over the same folder on either lane (not verified); the second
+conversation starts with no memory of the first.
+
+### Assert a hook's JSON decision
+
+A hook that decides by printing JSON and exiting 0 is not a block to
+`hook_event_blocked`, which counts exit code 2 only. Read the hook's output, and what the agent got back:
+
+```yaml
+assert:
+  - hook_output_contains: {event: PreToolUse, stream: stdout, matches: '"permissionDecision"\s*:\s*"deny"'}
+  - tool_result_contains: "blocked by policy"
+  # updatedInput: the recorded call input is what the model sent; the rewrite shows in the paired result
+  - tool_called: {tool: Bash, result: {matches: 'outputs/archive/'}}
+  - hook_event_blocked: Stop        # a Stop hook that blocks with exit 2
+```
+
+*Does not prove:* which tool a hook frame was about (frames do not name it), or that the model read the reason.
+
+### Schema-check a written file
+
+In the Python lane, pass a `jsonschema` check as the predicate:
+
+```python
+import jsonschema
+def valid(doc):
+    jsonschema.validate(doc, SCHEMA)   # raises with the failing path
+    return True
+result.assert_artifact_json("outputs/cap.json", valid)
+```
+
+In a scenario, name the exact paths (`artifact_json` per file) and add `no_unexpected_files` so no other file slips
+in. *Does not prove:* anything about a file whose name you did not list (no globbing).
+
+### Hold a skill to an unattended host
+
+Make any question fail the run, and give the answers in the prompt:
+
+```yaml
+fidelity: container
+on_unanswered: fail            # the default for `run`; say it anyway
+prompt: "Build the weekly report. Assume: region = all, format = markdown; ask nothing."
+assert:
+  - questions_count_max: 0
+```
+
+Leave `allow_stall` out, so ending on a question fails. `trace <run> --view questions` shows who answered each gate
+(`answeredBy`). *Does not prove:* scheduled-task behaviour. Real scheduled tasks remove `AskUserQuestion` entirely and
+tell the model no user is present; the harness models neither.

package/.claude/skills/cowork-harness/scripts/scenario.py

@@ -1383,7 +1383,7 @@ def lint_doc(doc, path, raw_lines, cassette_records=None):
                 "no `fidelity:` — the key is required (since 4.0.0); `run`, `record` and the loader "
                 "refuse this scenario.",
                 "Add a tier: `fidelity: container` keeps the pre-4.0 behaviour (it was the default) and "
-                "models the VM-LOOP lane; production runs HOST-LOOP by default (gate 1143815894), so "
+                "models the VM-LOOP lane; Cowork's local lane runs HOST-LOOP by default (gate 1143815894), so "
                 "`fidelity: hostloop` matches it and `fidelity: cowork` auto-picks the way Cowork does. "
                 "Switching tiers can COST you assertions: `no_scratchpad_leak` is container-only (an "
                 "error elsewhere) and `transcript_no_host_path` fails by design at hostloop/protocol. "