# yaml-language-server: $schema=../../schema/scenario.schema.json
# The zero-infra smoke test: `fidelity: protocol` (L0) runs the host `claude -p` control
# loop directly — NO Docker, NO staged agent binary, NO egress sandbox. The fastest inner
# loop for validating skill logic + scripted answers before you graduate to `container`.
#
# What a protocol scenario can assert: control-loop + skill-logic facts — a scripted answer
# reaches the model, a tool runs, a file is written, the transcript says what you expect.
# What it CANNOT assert: anything boundary-shaped (`egress_*` / `expect_denied`) — those are
# pre-rejected at protocol because there is no sandbox to enforce them (it'd be a false pass).
# For a genuine egress test, see examples/scenarios/csv-fx-normalize.yaml (runs at container fidelity).
#
# Run:  cowork-harness run examples/scenarios/protocol-smoke.yaml
baseline: latest
session: ../sessions/protocol-smoke.yaml
fidelity: protocol # L0 — host control loop, no sandbox; the one tier that needs no Docker/agent

prompt: |
  Ask me which output format to use, then write a one-line note to outputs/note.md
  in that format that contains the words "protocol smoke".

# Scripted answer — the same can_use_tool control channel Desktop's question UI uses.
# The model picks the option wording, so we steer with `choose: first` (the deterministic
# "option 1" keyword) instead of a literal label that the run-to-run wording might not match.
answers:
  - when_question: ".*" # any AskUserQuestion this prompt raises (regex, case-insensitive)
    choose: "first"
  - when_tool: Write
    decide: allow
  - when_tool: Bash # this task needs no shell — deny it so the run stays deterministic and
    decide: deny #     no Bash output echoes the host cwd (which would trip transcript_no_host_path)

# No egress assertion: protocol has no sandbox, so egress_denied/expect_denied are pre-rejected
# here (asserting them would be a false pass). Boundary tests belong at container fidelity.

assert:
  - result: success
  - file_exists: outputs/note.md
  - transcript_contains: "protocol smoke"
  - tool_called: Write
  # L0 has NO sealed filesystem: the agent runs on the real host cwd, so the Write tool_result
  # ("File created at /…/work/outputs/note.md") names a host path. That is EXPECTED at this tier —
  # exactly like `hostloop`, which also runs native file tools on real host paths — so the verdict
  # emits a `host_path_leak` *notice* (not a fail) and this scenario passes on every advertised lane.
  # A SANDBOXED tier (container/microvm) seals the FS and shows the model /sessions/… paths; there a
  # host path IS a regression, so you would add `- transcript_no_host_path: true` (enforced at any
  # tier via the assertion, independent of the tier-gated default signal).