# yaml-language-server: $schema=../../schema/scenario.schema.json
# Example scenario: a prompt + scripted answers + assertions, run against a session.
# The session (model, folders, plugins, mcp, egress) lives in examples/sessions/default.yaml.
# Run:  cowork-harness run examples/scenarios/example-pdf-skill.yaml
baseline: latest # platform baseline (auto-synced from Desktop)
session: ../sessions/default.yaml # everything you'd set in Cowork pre-prompt
fidelity: container # protocol | container | microvm | hostloop | cowork

prompt: |
  Read report.pdf from your uploads, summarize it, and write the action items
  to outputs/actions.md as a markdown checklist.

# Scripted answers — same can_use_tool control channel Desktop's question UI uses.
answers:
  - when_question: "format|markdown|output style" # AskUserQuestion (regex, case-insensitive)
    choose: "Markdown checklist"
  - when_tool: Write
    decide: allow
  - when_tool: Bash
    allow_if: "!command.includes('rm') && !command.includes('curl')"
    else: deny

# No egress assertion here: this prompt never makes a network call, so there is nothing to
# deny — asserting egress_denied without a real attempt would be a latent false-green. For a
# genuine egress-denied test backed by real skill behavior, see
# examples/scenarios/csv-fx-normalize.yaml.

assert:
  - result: success
  # The session (default.yaml) connects a folder (../data/project -> mnt/project), so
  # {{workspaceFolder}} = mnt/project and the model writes the deliverable INTO that folder
  # (mnt/project/outputs/actions.md), NOT mnt/outputs. `user_visible_artifact` is the right
  # primitive for a workspace deliverable: it spans the user-visible roots (outputs + each
  # connected folder's mount). `file_exists` anchors only at mnt/, so it would miss this.
  - user_visible_artifact: project/outputs/actions.md
  - transcript_contains: "action items"
  - tool_called: Write
  # The intent is "this skill reads the LOCAL pdf, it does not fetch from the web". Name the tool that
  # actually exists on this tier, or the assertion cannot fail.
  #
  # It used to read `tool_not_called: WebFetch`. Production's VM-loop disallows the built-in `WebFetch`
  # and aliases the name to `mcp__workspace__web_fetch`; once the harness modelled that, `WebFetch` was no
  # longer offered at `container` — so the old line could never be violated and passed VACUOUSLY. That is
  # the harder failure to notice, because it goes silently green rather than loudly red.
  - tool_not_called: mcp__workspace__web_fetch