cowork-harness 4.8.0 → 4.8.1

package/.claude/skills/cowork-harness/SKILL.md

@@ -3,8 +3,8 @@ name: cowork-harness
 description: Test or debug a Claude Code skill/plugin under Claude Cowork's runtime — sandboxed agent, default-deny egress, the can_use_tool permission/question protocol — using the cowork-harness CLI. Use when validating or regression-testing a skill, authoring or debugging a scenario YAML (prompt + scripted answers + assert:), choosing a fidelity tier, scripting AskUserQuestion / tool-permission answers, asserting artifacts, egress, or sub-agent dispatch, measuring how long each tool call took (toolDurations / trace), or debugging a failed run or verdict from its result.json or transcript. Especially when a harness run no-ops an assertion, fails on an unanswered gate, false-greens, a steered answer never reaches the model, or a web_fetch is unexpectedly denied or gated. Also when iterating or hardening a skill across fixes, or grounding a skill's self-critique against its own run evidence — including a document-analysis skill (cap table, deck, financial model, transcript) that needs an uploaded file attached to be critiqued at all. Also for comparing two versions of a skill before merging an edit — did it make answers worse? (`eval`: paired A/B, pinned models) — or improving one round by round (`hillclimb`, the `/claude-api hillclimb` runner). NOT for generic unit testing (pytest/vitest of your own scripts) or non-Cowork CI. Covers the skill / run / chat / record / replay / trace / decide / assertions / scaffold / critique / stats / eval / hillclimb commands and the session-vs-scenario split.
 metadata:
   author: cowork-harness
-  version: 4.8.0
-  tracks-harness: cowork-harness 4.8.0 (baseline desktop-2.31226.1)
+  version: 4.8.1
+  tracks-harness: cowork-harness 4.8.1 (baseline desktop-2.31226.1)
 ---
 
 # cowork-harness
@@ -26,7 +26,7 @@ allowlist). This skill exists mostly to keep you out of those traps — the *Inv
 full landmine catalog in [`references/gotchas.md`](references/gotchas.md) are the highest-value part.
 Read them.
 
-> **Version note:** the facts and `file:line` pointers here track `cowork-harness 4.8.0` (baseline
+> **Version note:** the facts and `file:line` pointers here track `cowork-harness 4.8.1` (baseline
 > `desktop-2.31226.1`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
 > `SPEC.md` / `docs/*.md` over this snapshot, and re-run the bundled linter.
 
@@ -43,7 +43,7 @@ Before the first command, confirm the CLI is reachable and **fail loud** (never
 
 - **One-shot check.** Run `cowork-harness doctor [--tier <tier>]` first — a read-only prerequisite check that inspects Docker, the staged agent, the token, and the baseline in one pass. The bullets below explain each thing it checks (and how to fix it).
 - **Replay-only? Skip `doctor`.** Replaying committed cassettes needs no Docker, no staged agent, and no token — and every tier's `doctor` validates the auth token (the live tiers also Docker + the staged agent), so a ✗ there is expected, not a blocker. Go straight to `cowork-harness replay <cassette>`.
-- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 4.8.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@^4.8.0" <cmd>` (Node ≥ 22), or install once with `npm i -g "cowork-harness@^4.8.0"`. **Pin `@^4.8.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
+- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 4.8.1**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@^4.8.1" <cmd>` (Node ≥ 22), or install once with `npm i -g "cowork-harness@^4.8.1"`. **Pin `@^4.8.1`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
 
   This skill documents the CURRENT surface, not release history. If `cowork-harness --version` is
   OLDER than the floor, the per-release record of what you are missing is [CHANGELOG.md](https://github.com/yaniv-golan/cowork-harness/blob/main/CHANGELOG.md)

package/.claude/skills/cowork-harness/references/assertion-catalog-agents-skills-budgets.md

@@ -1,6 +1,6 @@
 # Assertion catalog: sub-agents, skills and connectors, budgets, tasks, delivery
 
-Tracks `cowork-harness 4.8.0` (baseline `desktop-2.31226.1`). Part 2 of 3 of the per-key table. The conventions every key shares (an item with several
+Tracks `cowork-harness 4.8.1` (baseline `desktop-2.31226.1`). Part 2 of 3 of the per-key table. The conventions every key shares (an item with several
 keys is an AND; glob vs regex name matching) and the verdict-signal table are in
 [`assertion-catalog.md`](./assertion-catalog.md); the other parts are [`assertion-catalog-outcome-files-tools.md`](./assertion-catalog-outcome-files-tools.md), [`assertion-catalog-gates-hooks-modifiers.md`](./assertion-catalog-gates-hooks-modifiers.md).
 

package/.claude/skills/cowork-harness/references/assertion-catalog-gates-hooks-modifiers.md

@@ -1,6 +1,6 @@
 # Assertion catalog: gates, hooks, path denial, verdict modifiers, egress, judged keys
 
-Tracks `cowork-harness 4.8.0` (baseline `desktop-2.31226.1`). Part 3 of 3 of the per-key table. The conventions every key shares (an item with several
+Tracks `cowork-harness 4.8.1` (baseline `desktop-2.31226.1`). Part 3 of 3 of the per-key table. The conventions every key shares (an item with several
 keys is an AND; glob vs regex name matching) and the verdict-signal table are in
 [`assertion-catalog.md`](./assertion-catalog.md); the other parts are [`assertion-catalog-outcome-files-tools.md`](./assertion-catalog-outcome-files-tools.md), [`assertion-catalog-agents-skills-budgets.md`](./assertion-catalog-agents-skills-budgets.md).
 

package/.claude/skills/cowork-harness/references/assertion-catalog-outcome-files-tools.md

@@ -1,6 +1,6 @@
 # Assertion catalog: outcome, transcript, files and artifacts, tools, tool results
 
-Tracks `cowork-harness 4.8.0` (baseline `desktop-2.31226.1`). Part 1 of 3 of the per-key table. The conventions every key shares (an item with several
+Tracks `cowork-harness 4.8.1` (baseline `desktop-2.31226.1`). Part 1 of 3 of the per-key table. The conventions every key shares (an item with several
 keys is an AND; glob vs regex name matching) and the verdict-signal table are in
 [`assertion-catalog.md`](./assertion-catalog.md); the other parts are [`assertion-catalog-agents-skills-budgets.md`](./assertion-catalog-agents-skills-budgets.md), [`assertion-catalog-gates-hooks-modifiers.md`](./assertion-catalog-gates-hooks-modifiers.md).
 

package/.claude/skills/cowork-harness/references/assertion-catalog.md

@@ -1,6 +1,6 @@
 # Assertion catalog
 
-Tracks `cowork-harness 4.8.0` (baseline `desktop-2.31226.1`). Every `assert:` key with its semantics, and the
+Tracks `cowork-harness 4.8.1` (baseline `desktop-2.31226.1`). Every `assert:` key with its semantics, and the
 verdict-signal table. Which keys survive `replay` is in [`scenario-schema.md`](./scenario-schema.md#replay-class);
 the scenario and session YAML fields are there too.
 

package/.claude/skills/cowork-harness/references/assertions-guide.md

@@ -1,6 +1,6 @@
 # Assertions guide
 
-Tracks `cowork-harness 4.8.0` (baseline `desktop-2.31226.1`). Read it when choosing assertion keys: the two orthogonal axes and the goal → key map. The full catalog starts at `assertion-catalog.md`, which indexes the per-family files that hold every key's row.
+Tracks `cowork-harness 4.8.1` (baseline `desktop-2.31226.1`). Read it when choosing assertion keys: the two orthogonal axes and the goal → key map. The full catalog starts at `assertion-catalog.md`, which indexes the per-family files that hold every key's row.
 
 ### Assertions: two orthogonal axes
 

package/.claude/skills/cowork-harness/references/authoring.md

@@ -1,6 +1,6 @@
 # Authoring a scenario
 
-Tracks `cowork-harness 4.8.0` (baseline `desktop-2.31226.1`). Read it when composing a `scenarios/*.yaml`: session vs scenario, discovery, the fidelity tier, the answer path, `web_fetch`, and scaffold + lint.
+Tracks `cowork-harness 4.8.1` (baseline `desktop-2.31226.1`). Read it when composing a `scenarios/*.yaml`: session vs scenario, discovery, the fidelity tier, the answer path, `web_fetch`, and scaffold + lint.
 
 ## Part I — AUTHOR a scenario
 

package/.claude/skills/cowork-harness/references/ci-recipe.md

@@ -1,6 +1,6 @@
 # CI recipe — replay vs live lanes
 
-Self-contained reference. Tracks `cowork-harness 4.8.0` (baseline `desktop-2.31226.1`).
+Self-contained reference. Tracks `cowork-harness 4.8.1` (baseline `desktop-2.31226.1`).
 
 **Fastest path: the packaged Action.** One step gets you `replay`/`lint`/`verify-cassettes` plus a PR
 job-summary reporter (verdict table, staleness findings, cost/turns when available):
@@ -17,7 +17,7 @@ job-summary reporter (verdict table, staleness findings, cost/turns when availab
 CLI major reaches your workflow the moment it is promoted even though your `uses:` ref never changed — so a
 copy-pasted recipe that omits the input takes a major bump with no say in it. `^4` holds the major, needs no
 patch number to remember, and only wants a human decision at the next major. Pin an exact version
-(e.g. `version: "4.8.0"`) instead when you want byte-reproducible CI.
+(e.g. `version: "4.8.1"`) instead when you want byte-reproducible CI.
 
 Reach for the manual multi-step form below only when you need per-step control the Action's inputs don't
 cover (a custom flag combination, a different runner matrix per step, or `lint`/`verify-cassettes` gated
@@ -82,7 +82,7 @@ sha256-*checked* but not hard-blocking on mismatch — it's advisory for an inte
 GitHub-hosted runners, no token/Docker/agent:
 
 ```yaml
-- run: npm i -g "cowork-harness@^4.8.0"
+- run: npm i -g "cowork-harness@^4.8.1"
 - run: cowork-harness lint scenarios/*.yaml --strict --min-severity WARN
                                                     # no silent false-greens. WITHOUT --strict this
                                                     # step cannot fail on a WARN-class rule (e.g.
@@ -411,7 +411,7 @@ jobs:
         with: { node-version: '24' }
       - uses: actions/setup-python@v5
         with: { python-version: '3.x' }                                       # python3 only — PyYAML is bundled with the linter
-      - run: npm i -g "cowork-harness@^4.8.0"
+      - run: npm i -g "cowork-harness@^4.8.1"
       - run: cowork-harness lint scenarios/*.yaml                              # no-silent-false-green (needs python3; PyYAML bundled)
       - run: cowork-harness verify-cassettes cassettes/ --output-format json   # privacy + staleness gate
       - run: cowork-harness replay cassettes/ --output-format json             # token-free content/structure
@@ -440,7 +440,7 @@ jobs:
             echo "live=true" >> "$GITHUB_OUTPUT"
           fi
       - if: steps.guard.outputs.live == 'true'
-        run: npm i -g "cowork-harness@^4.8.0"
+        run: npm i -g "cowork-harness@^4.8.1"
       - if: steps.guard.outputs.live == 'true'
         run: cowork-harness run scenarios/ --output-format json
         env:

package/.claude/skills/cowork-harness/references/critique.md

@@ -1,6 +1,6 @@
 # Critique — the facts a plugin install can't otherwise reach
 
-Tracks `cowork-harness 4.8.0` (baseline `desktop-2.31226.1`). This is **not** a trim of the full
+Tracks `cowork-harness 4.8.1` (baseline `desktop-2.31226.1`). This is **not** a trim of the full
 [`docs/critique.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/critique.md) (repo-only —
 flags, cost, reading several critiques, known limitations all live there). This file covers exactly what a
 plugin install cannot otherwise discover: the run-dir artifact a harvester actually reads, the report's

package/.claude/skills/cowork-harness/references/debugging.md

@@ -1,6 +1,6 @@
 # Debugging a run
 
-Tracks `cowork-harness 4.8.0` (baseline `desktop-2.31226.1`). Read it when a run misbehaved or a green looks wrong: triage, the observability output, and `chat`.
+Tracks `cowork-harness 4.8.1` (baseline `desktop-2.31226.1`). Read it when a run misbehaved or a green looks wrong: triage, the observability output, and `chat`.
 
 ## Part III — Debug
 

package/.claude/skills/cowork-harness/references/eval.md

@@ -1,6 +1,6 @@
 # `eval` — paired before/after comparison of a skill edit (EXPERIMENTAL)
 
-Tracks `cowork-harness 4.8.0` (baseline `desktop-2.31226.1`). The full guide is
+Tracks `cowork-harness 4.8.1` (baseline `desktop-2.31226.1`). The full guide is
 [docs/eval.md](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/eval.md); this is the part you
 need while running it.
 

package/.claude/skills/cowork-harness/references/fidelity-and-answers.md

@@ -1,6 +1,6 @@
 # Fidelity tiers & answer paths
 
-Self-contained reference. Tracks `cowork-harness 4.8.0` (baseline `desktop-2.31226.1`).
+Self-contained reference. Tracks `cowork-harness 4.8.1` (baseline `desktop-2.31226.1`).
 
 > **This page vs. the repo docs.** This is the **offline snapshot** that ships inside the installed
 > plugin — it is self-contained on purpose. The repo carries four other fidelity views, each answering a

package/.claude/skills/cowork-harness/references/gotchas.md

@@ -1,6 +1,6 @@
 # Gotchas
 
-Tracks `cowork-harness 4.8.0` (baseline `desktop-2.31226.1`). The full "✓ passed ≠ correct" landmine catalog.
+Tracks `cowork-harness 4.8.1` (baseline `desktop-2.31226.1`). The full "✓ passed ≠ correct" landmine catalog.
 
 ## Gotchas — the "✓ passed ≠ correct" landmines
 

package/.claude/skills/cowork-harness/references/hillclimb-recipe.md

@@ -1,6 +1,6 @@
 # Recipe 7 — Climb a skill with `/claude-api hillclimb` and the harness as its runner
 
-Tracks `cowork-harness 4.8.0` (baseline `desktop-2.31226.1`). It needs a `cowork-harness` whose
+Tracks `cowork-harness 4.8.1` (baseline `desktop-2.31226.1`). It needs a `cowork-harness` whose
 `hillclimb --help` lists `--skill` (help goes to stderr). This page is the loop's procedure, step by step, in the order of the
 `/claude-api hillclimb` guide. Every mechanic (flags, refusals, the gate, `regrade`, `freeze-ref`, exit codes,
 row keys) is in [`hillclimb.md`](hillclimb.md); the setup and the full list of differences from the guide's own

package/.claude/skills/cowork-harness/references/hillclimb.md

@@ -1,6 +1,6 @@
 # `hillclimb` — the runner for a `/claude-api hillclimb` loop
 
-Tracks `cowork-harness 4.8.0` (baseline `desktop-2.31226.1`). It needs a `cowork-harness` whose
+Tracks `cowork-harness 4.8.1` (baseline `desktop-2.31226.1`). It needs a `cowork-harness` whose
 `hillclimb --help` lists `--skill` (help goes to stderr). The command reference is
 [docs/cli.md](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/cli.md); this is the part a loop needs
 while it runs. It covers `run`, `check`, `state-template`, `freeze-ref` and `regrade`.

package/.claude/skills/cowork-harness/references/measurement.md

@@ -1,6 +1,6 @@
 # Measurement
 
-Tracks `cowork-harness 4.8.0` (baseline `desktop-2.31226.1`). Read it before comparing runs: `--repeat`, `--ablate-skill`, and the hygiene that keeps a batch valid.
+Tracks `cowork-harness 4.8.1` (baseline `desktop-2.31226.1`). Read it before comparing runs: `--repeat`, `--ablate-skill`, and the hygiene that keeps a batch valid.
 
 ### Measure — before/after, with/without (`--repeat`, `--ablate-skill`)
 

package/.claude/skills/cowork-harness/references/run-record-replay.md

@@ -1,6 +1,6 @@
 # Run, record and lock
 
-Tracks `cowork-harness 4.8.0` (baseline `desktop-2.31226.1`). Read it when running a scenario, recording or placing a cassette, reading verdict signals, checking a background run, or choosing CI lanes.
+Tracks `cowork-harness 4.8.1` (baseline `desktop-2.31226.1`). Read it when running a scenario, recording or placing a cassette, reading verdict signals, checking a background run, or choosing CI lanes.
 
 ## Part II — RUN, RECORD & LOCK
 

package/.claude/skills/cowork-harness/references/scenario-schema.md

@@ -1,6 +1,6 @@
 # Scenario & session schema, replay class, web_fetch, authoring gotchas
 
-Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 4.8.0`
+Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 4.8.1`
 (baseline `desktop-2.31226.1`). If your checkout is newer, prefer the live [`docs/scenario.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/scenario.md),
 [`docs/session.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/session.md), and `SPEC.md`.
 

package/.claude/skills/cowork-harness/references/semantic-judging.md

@@ -1,6 +1,6 @@
 # `semantic_matches` — the full semantics
 
-Tracks `cowork-harness 4.8.0` (baseline `desktop-2.31226.1`). The one-line summary is in
+Tracks `cowork-harness 4.8.1` (baseline `desktop-2.31226.1`). The one-line summary is in
 [assertion-catalog-gates-hooks-modifiers.md](assertion-catalog-gates-hooks-modifiers.md); this is the whole contract, split out so the catalog stays within the
 agent's single-read size.
 

package/.claude/skills/cowork-harness/references/task-recipes.md

@@ -2,7 +2,7 @@
 
 Each recipe composes facts that live scattered across SKILL.md and the other references into one
 decision path. Every one answers a question a real fleet owner had to work out the hard way.
-Tracks `cowork-harness 4.8.0` (baseline `desktop-2.31226.1`), same as SKILL.md's front-matter. Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
+Tracks `cowork-harness 4.8.1` (baseline `desktop-2.31226.1`), same as SKILL.md's front-matter. Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
 Recipe 3's `init-redact` shipped in 0.24.0 and are part of the current feature set — no version gate
 needed if your CLI meets SKILL.md's version floor.
 

package/CHANGELOG.md

@@ -6,6 +6,37 @@ All notable changes to this project are documented here. The format is based on
 
 ## [Unreleased]
 
+## [4.8.1] — 2026-10-12
+
+### Upgrade notes
+
+- **For maintainers: `npm run preflight` now also fails when the newest baseline has no
+  `provenance.observedSpawnEnv`.** A baseline synced with an older cowork-harness must be re-synced before a
+  release. The shipped newest baseline already carries the block.
+
+### Changed
+
+- **`sync` records the env key names Desktop's own host-loop spawn carried.** The spawn-env check read only the env
+  literals in Desktop's bundle, and Desktop keeps writing to the env after they are built. `sync` now reads the final
+  key list Desktop logs for each local host-loop session (`~/Library/Logs/Claude/main*.log`) and records the names as
+  `provenance.observedSpawnEnv`. It also scans Desktop's spawn path for direct writes to the env made after it is built.
+  Every recorded name must be classified, with a reason, in one registry (`src/sync/spawn-env-registry.ts`). An
+  unclassified name that Desktop's own bundle carries refuses the write and is named in sync's local output; any
+  other unclassified name (an organisation's managed env, say) is counted as `withheld` and never printed or
+  committed. A name the registry says the harness sets, but the harness host loop does not set, also refuses the
+  write, as do unreadable dumps, local sessions that logged no dump, a `Starting app` log entry with no version, and
+  a bundle that no longer logs the dump.
+- **`npm run preflight` refuses a newest baseline whose observed spawn env is unobserved** (no local host-loop task
+  ran on that Desktop build). `--allow-unobserved-spawn-env` downgrades it to a warning for an emergency release.
+  When local tasks can no longer run, `sync --spawn-env-unobservable local-lane-removed|no-local-entitlement`
+  records that for the build, and the preflight only warns.
+- **`diff <baseline> <baseline>` describes a change to the observed spawn env in a few readable lines**, in the
+  default text output, with `--changelog`, and in `sync --diff`. A build that went from observed to unobserved
+  prints one line saying so, rather than a removal for every key it no longer records. Keys that moved between
+  "every session" and "some sessions" are listed as moved, not as an addition and a removal.
+- **`sync`'s unknown-delta header no longer points at `src/sync/cowork-sync.ts`.** Each delta line now names the
+  file to fix.
+
 ## [4.8.0] — 2026-10-11
 
 ### Upgrade notes

package/README.md

@@ -36,7 +36,7 @@ npm ci && npm run build
 node dist/cli.js replay examples/replays/example-pdf-skill.cassette.json
 ```
 
-(Installing globally — `npm install -g "cowork-harness@^4.8.0"` — gives you the `cowork-harness` CLI for your own
+(Installing globally — `npm install -g "cowork-harness@^4.8.1"` — gives you the `cowork-harness` CLI for your own
 scenarios and cassettes; the bundled example above also replays from a global install — see the `$(npm root -g)` path below.)
 
 Full setup → [Quick start](./docs/cli.md#quick-start).
@@ -49,8 +49,8 @@ Three ways to use this project. Each row is the whole hook — follow the link f
 
 | I want to… | Start here | Needs |
 |---|---|---|
-| **Run scenarios myself** from a terminal | **[docs/cli.md](./docs/cli.md)**<br><br>`npm i -g "cowork-harness@^4.8.0"`<br>`cowork-harness replay examples/replays/example-pdf-skill.cassette.json` | Node ≥ 22. The replay demo above is token-free and needs nothing else; live tiers above `protocol` need Docker + a staged agent binary |
-| **Have Claude Code drive it** for me | **[docs/companion-skill.md](./docs/companion-skill.md)**<br><br>`/plugin marketplace add yaniv-golan/cowork-harness`<br>`/plugin install cowork-harness@cowork-harness` | Claude Code. The skill self-bootstraps the CLI via `npx "cowork-harness@^4.8.0"` |
+| **Run scenarios myself** from a terminal | **[docs/cli.md](./docs/cli.md)**<br><br>`npm i -g "cowork-harness@^4.8.1"`<br>`cowork-harness replay examples/replays/example-pdf-skill.cassette.json` | Node ≥ 22. The replay demo above is token-free and needs nothing else; live tiers above `protocol` need Docker + a staged agent binary |
+| **Have Claude Code drive it** for me | **[docs/companion-skill.md](./docs/companion-skill.md)**<br><br>`/plugin marketplace add yaniv-golan/cowork-harness`<br>`/plugin install cowork-harness@cowork-harness` | Claude Code. The skill self-bootstraps the CLI via `npx "cowork-harness@^4.8.1"` |
 | **Gate my skill in CI** | **[docs/ci.md](./docs/ci.md)**<br><br>`- uses: yaniv-golan/cowork-harness@v4`<br>`  with: { command: replay, path: cassettes/ }` | Nothing for the token-free gate; the live lane needs a self-hosted runner with Docker + an agent binary |
 
 Improving a skill round by round with Claude Code's `/claude-api hillclimb` loop? The harness is its runner, with

package/RELEASING.md

@@ -242,7 +242,10 @@ tagging `1.0.0`, deliberately review and freeze the surfaces with no machine-rea
       the push-to-main live suite will be skipped and this release won't be live-validated in CI; warns if a
       ruleset **required status check** names no job in `ci.yml`; fails if the newest baseline's
       `provenance.desktopInitSurface` is unobserved — start one Cowork session and re-run `sync`, or pass
-      `--allow-unobserved-init-surface` for an emergency release; fails if the covered surface lost or changed
+      `--allow-unobserved-init-surface` for an emergency release; fails if its `provenance.observedSpawnEnv`
+      is missing, malformed, or unobserved with no declaration — run one local Cowork task on that Desktop and
+      re-run `sync`, or pass `--allow-unobserved-spawn-env` for an emergency release (a declared `lane-gone` only
+      warns); fails if the covered surface lost or changed
       a leaf since the last release tag and the bumped version is not a major — the same check as
       `npm run check:surface -- --since-tag`, which prints the counts and lists every removed/changed leaf.
       Before the bump it reports the diff without enforcing it).

package/baselines/desktop-2.31226.1.json

@@ -1240,6 +1240,87 @@
           "toolsSome": []
         }
       }
+    },
+    "observedSpawnEnv": {
+      "observed": true,
+      "appVersion": "2.31226.1",
+      "nativeAgentVersions": [
+        "2.1.295"
+      ],
+      "sessions": 26,
+      "keysAll": [
+        "ANTHROPIC_BASE_URL",
+        "ANTHROPIC_CUSTOM_HEADERS",
+        "API_FORCE_IDLE_TIMEOUT",
+        "API_TIMEOUT_MS",
+        "CLAUDE_AGENT_SDK_MCP_NO_PREFIX",
+        "CLAUDE_CODE_ACCOUNT_TAGGED_ID",
+        "CLAUDE_CODE_ACCOUNT_UUID",
+        "CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD",
+        "CLAUDE_CODE_COWORK_FRAME_ARTIFACTS",
+        "CLAUDE_CODE_DESKTOP_APP_VERSION",
+        "CLAUDE_CODE_DISABLE_AGENTS_FLEET",
+        "CLAUDE_CODE_DISABLE_AUTO_MEMORY",
+        "CLAUDE_CODE_DISABLE_BACKGROUND_TASKS",
+        "CLAUDE_CODE_DISABLE_CRON",
+        "CLAUDE_CODE_DISABLE_TERMINAL_TITLE",
+        "CLAUDE_CODE_EMIT_TOOL_USE_SUMMARIES",
+        "CLAUDE_CODE_ENABLE_APPEND_SUBAGENT_PROMPT",
+        "CLAUDE_CODE_ENABLE_ASK_USER_QUESTION_TOOL",
+        "CLAUDE_CODE_ENABLE_FINE_GRAINED_TOOL_STREAMING",
+        "CLAUDE_CODE_ENABLE_TASKS",
+        "CLAUDE_CODE_ENTRYPOINT",
+        "CLAUDE_CODE_HOST_PLATFORM",
+        "CLAUDE_CODE_IS_COWORK",
+        "CLAUDE_CODE_OAUTH_SCOPES",
+        "CLAUDE_CODE_OAUTH_TOKEN",
+        "CLAUDE_CODE_ORGANIZATION_UUID",
+        "CLAUDE_CODE_PLUGIN_ATTRIBUTION",
+        "CLAUDE_CODE_PROJECT_DIR_NAME",
+        "CLAUDE_CODE_PROMPT_CACHE_TTL",
+        "CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST",
+        "CLAUDE_CODE_RATE_LIMIT_TIER",
+        "CLAUDE_CODE_SIMPLE",
+        "CLAUDE_CODE_SKILL_ATTRIBUTION",
+        "CLAUDE_CODE_SUBAGENT_PROMPT_CACHE_TTL",
+        "CLAUDE_CODE_SUBSCRIPTION_TYPE",
+        "CLAUDE_CODE_TAGS",
+        "CLAUDE_CODE_USER_EMAIL",
+        "CLAUDE_CONFIG_DIR",
+        "CLAUDE_PREVIEW_CLASSIFIER_FLOOR",
+        "DISABLE_AUTOUPDATER",
+        "DISABLE_MICROCOMPACT",
+        "DOCUMENTS_MCP_SCRATCH_ROOT",
+        "ENABLE_PROMPT_CACHING_1H",
+        "GIT_CONFIG_COUNT",
+        "GIT_CONFIG_KEY_0",
+        "GIT_CONFIG_KEY_1",
+        "GIT_CONFIG_KEY_2",
+        "GIT_CONFIG_PARAMETERS",
+        "GIT_CONFIG_VALUE_0",
+        "GIT_CONFIG_VALUE_1",
+        "GIT_CONFIG_VALUE_2",
+        "GIT_DIR",
+        "HOME",
+        "LOGNAME",
+        "MCP_CONNECTION_NONBLOCKING",
+        "MCP_TOOL_TIMEOUT",
+        "NODE_USE_SYSTEM_CA",
+        "OTEL_RESOURCE_ATTRIBUTES",
+        "OTEL_SERVICE_NAME",
+        "PATH",
+        "PYTHONDONTWRITEBYTECODE",
+        "SHELL",
+        "TZ",
+        "USER",
+        "USE_LOCAL_OAUTH",
+        "USE_STAGING_OAUTH"
+      ],
+      "keysSome": [
+        "CLAUDE_CODE_HOST_SCHEDULED_RUN",
+        "CLAUDE_CODE_WORKSPACE_HOST_PATHS"
+      ],
+      "withheld": 0
     }
   },
   "requireFullVmSandbox": null,

package/dist/cli.js

@@ -5,7 +5,7 @@ import { readFileSync, writeFileSync, mkdirSync, statSync, existsSync, copyFileS
 import { join, basename, resolve, isAbsolute, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { parse as parseYaml, YAMLParseError } from "yaml";
-import { Scenario, Assertion, FIDELITY_TIERS, DesktopInitSurface, } from "./types.js";
+import { Scenario, Assertion, FIDELITY_TIERS, DesktopInitSurface, ObservedSpawnEnv, ObservedSpawnEnvDeclaration, } from "./types.js";
 import { writeAllSync, tildeify, installTerminalScrub, warn } from "./io.js";
 import { SECRET_ENV_KEYS } from "./runtime/host-env.js";
 import { loadBaseline, BASELINES_DIR, cmpVersionStrings, listBaselineNames, sha256File, countStringInFile, cliCapabilitiesOfFile, deriveNativeStagedPath, nativeManifestBuild, buildNextAgentBinary, } from "./baseline.js";
@@ -17,6 +17,7 @@ import { claudeCliCompleteDecider, isolationRefusal } from "./decide/llm-transpo
 import { vmInit, vmDelete, vmStatus, vmPrune, instanceName, vmProvisioned } from "./runtime/lima.js";
 import { resolveVmBaselineArg } from "./runtime/vm-baseline-arg.js";
 import { sync, canonicalizeEnv, syncedNetworkBlock } from "./sync/cowork-sync.js";
+import { checkObservedAgainstHarness, harnessHostLoopKeys } from "./sync/observed-spawn-env.js";
 import { cloudSchemaRefusal, withSyncedCloudBlock } from "./sync/remote-devices.js";
 import { diffBaselines, formatDiffLines, renderChangelog } from "./sync/baseline-diff.js";
 import { runBoundaryChecks, formatBoundary } from "./boundary.js";
@@ -246,7 +247,7 @@ const HELP = `cowork-harness <command>   (v${"$VERSION"})
       answer it with 'gates'/'answer' above (the one path here that waits — that is the rehearsal)
 
 ── Platform admin ─────────────────────────────────────────────────────────────
-  sync [--diff] [--allow-empty|--force]  derive/refresh a platform baseline from the live Desktop install (macOS only)
+  sync [--diff] [--allow-empty|--force] [--spawn-env-unobservable <reason>]  derive/refresh a platform baseline from the live Desktop install (macOS only)
   list                         list available platform baselines
   boundary-check [baseline] [--session <file>]   prove the sandbox enforces Cowork's limitations
   vm <init|status|delete|prune>  manage the L2 Apple-VZ microVM (fidelity: microvm); macOS arm64 only
@@ -490,7 +491,7 @@ function hasHelp(args) {
 // invocation. Intercept `--help`/`-h` at dispatch and print the command's usage (exit 0). One concise line
 // per command, kept in sync with each command's own bad-invocation `usage:` string.
 const SUBCOMMAND_USAGE = {
-    sync: "usage: sync [--diff] [--allow-empty|--force]   (re-sync the platform baseline from the installed Cowork app; macOS only)\n       --allow-empty (alias --force): write even when the derived egress allowlist is empty",
+    sync: "usage: sync [--diff] [--allow-empty|--force] [--spawn-env-unobservable local-lane-removed|no-local-entitlement]   (re-sync the platform baseline from the installed Cowork app; macOS only)\n       --allow-empty (alias --force): write even when the derived egress allowlist is empty\n       --spawn-env-unobservable: no local host-loop task can run on this Desktop build, so record its spawn env as unobservable (refused when any local session or dump exists for the build)",
     list: "usage: list [--output-format text|json]   (list available platform baselines)",
     "boundary-check": "usage: boundary-check [<baseline>] [--session <file>] [--output-format text|json]",
     vm: "usage: vm <init|status|delete|prune> [<baseline>] [--output-format text|json]   (macOS arm64 only)\n  init    create the L2 Apple-VZ microVM\n  status  show running VM state\n  delete  remove the VM\n  prune   drop all orphaned VMs\n  <baseline> (default: latest) is a baseline name like desktop-<version>, not a VM name — each acts on that baseline's VM",
@@ -2765,7 +2766,11 @@ async function cmdSync(args) {
     const normalizedArgs = args.map((a) => (a === "--force" ? "--allow-empty" : a));
     let syncParsed;
     try {
-        syncParsed = parseArgs(normalizedArgs, withCommandGlobals({ booleans: ["--diff", "--allow-empty"] }));
+        syncParsed = parseArgs(normalizedArgs, withCommandGlobals({
+            booleans: ["--diff", "--allow-empty"],
+            values: ["--spawn-env-unobservable"],
+            enums: { "--spawn-env-unobservable": [...ObservedSpawnEnvDeclaration.options] },
+        }));
     }
     catch (e) {
         return fail("sync", "usage", e.message, undefined, isJsonOutput(normalizedArgs));
@@ -2775,7 +2780,8 @@ async function cmdSync(args) {
         return fail("sync", "usage", `sync takes no positional arguments (got: ${syncParsed.positionals.join(", ")})`, undefined, isJsonOutput(normalizedArgs));
     }
     const allowEmpty = !!syncParsed.flags["--allow-empty"];
-    const res = sync();
+    const declared = syncParsed.options["--spawn-env-unobservable"];
+    const res = sync({ declareUnobservable: declared ? ObservedSpawnEnvDeclaration.parse(declared) : null });
     // refuse to write a baseline with empty version fields. An empty appVersion would produce
     // `desktop-.json` (invalid filename); an empty agentVersion means resolveAgentBinary will fail.
     const versionErrors = [];
@@ -3009,6 +3015,10 @@ async function cmdSync(args) {
     if (!initSurfaceCheck.success) {
         fail("sync", "runtime", `ERROR: provenance.desktopInitSurface failed its schema — refusing to write baseline (issue paths: ${initSurfaceCheck.error.issues.map((i) => i.path.join(".") || "(root)").join(", ")})`, "This is a reader bug in src/sync/desktop-init-surface.ts, not a Desktop change.", isJsonOutput(normalizedArgs), 1);
     }
+    const observedCheck = ObservedSpawnEnv.safeParse(res.observedSpawnEnv);
+    if (!observedCheck.success) {
+        fail("sync", "runtime", `ERROR: provenance.observedSpawnEnv failed its schema — refusing to write baseline (issue paths: ${observedCheck.error.issues.map((i) => i.path.join(".") || "(root)").join(", ")})`, "This is a reader bug in src/sync/observed-spawn-env.ts, not a Desktop change.", isJsonOutput(normalizedArgs), 1);
+    }
     // Same rule for the cloud block: names, hashes and counts only. A null block (extraction failed) already
     // printed a WARNING note, and is omitted rather than carried forward from the previous release.
     if (res.cloud) {
@@ -3065,8 +3075,17 @@ async function cmdSync(args) {
             // stamp the previous release's surface with this release's identity. Unobserved is written as
             // `observed:false`, which the release preflight refuses to ship.
             desktopInitSurface: res.desktopInitSurface,
+            // The env key NAMES Desktop's own host-loop spawn carried on THIS build, from its local log. Carried forward
+            // by the reader only for the same build (log rotation); never from a previous release.
+            observedSpawnEnv: res.observedSpawnEnv,
         },
     }, res.cloud);
+    // Desktop's observed host-loop env against what the harness host loop spawns for the baseline about to be written.
+    {
+        const cmp = checkObservedAgainstHarness(res.observedSpawnEnv, harnessHostLoopKeys(next));
+        res.unknownDeltas.push(...cmp.deltas);
+        res.notes.push(...cmp.notes);
+    }
     const diffFlag = !!syncParsed.flags["--diff"];
     if (diffFlag) {
         // Diff against `base` (the latest committed baseline `next` was merged onto), NOT a separate read of
@@ -3092,12 +3111,12 @@ async function cmdSync(args) {
             log("   - " + n);
     }
     if (res.unknownDeltas.length) {
-        log("\n⚠ unknown deltas (extend src/sync/cowork-sync.ts):");
+        log("\n⚠ unknown deltas (each line names the file to fix):");
         for (const d of res.unknownDeltas)
             log("   - " + d);
         // unknown deltas block the write unless --diff (diagnosis mode) is active.
         if (!diffFlag && !allowEmpty) {
-            fail("sync", "runtime", "Refusing to write baseline with unknown deltas. Fix src/sync/cowork-sync.ts or pass --allow-empty to force-write.", undefined, isJsonOutput(normalizedArgs), 1);
+            fail("sync", "runtime", "Refusing to write baseline with unknown deltas. Fix the file each delta names, or pass --allow-empty to force-write.", undefined, isJsonOutput(normalizedArgs), 1);
         }
     }
     if (!diffFlag) {

package/dist/runtime/hostloop.js

@@ -72,7 +72,7 @@ export const VM_LOOP_TOOL_ALIASES = { WebFetch: "mcp__workspace__web_fetch" };
  *   3. the authored `agentEnv` knob, applied last so it always wins.
  */
 export function buildHostLoopNativeEnv(baseline, opts) {
-    const nativeEnv = { ...process.env };
+    const nativeEnv = { ...(opts.operatorEnv ?? process.env) };
     for (const k of SCRUBBED_AGENT_ENV_KEYS)
         delete nativeEnv[k];
     delete nativeEnv[AUTO_MEMORY_ENV_KEY]; // owned by hostNativeSpawnEnv's autoMemoryEnv overlay — see AUTO_MEMORY_ENV_KEY