Summary
runNativeClaudeSmoke (packages/agent-bundle/src/host-contracts/native-claude-contract.ts) cannot report passed against a real signed-in Claude Code 2.1.257 session: its snapshotClaudeNormalHome digests $HOME/.claude.json (claudeJson) beside config.json, settings.local.json, plugins/, and settings.json, and any difference yields claude-native.normal-home.changed → status: 'harness-failure'. Claude Code 2.1.257 rewrites .claude.json on every signed-in turn, even with --no-session-persistence (observed keys appearing or moving: cachedGrowthBookFeatures*, cachedExperiment*, firstStartTime, firstStartVersion, machineID, userID, migrationVersion, migration flags, seenNotifications, pluginUsage, skillUsage).
Evidence
docs/audits/2026-09-03-claude-live-session-proofs.md ("Defects revealed", item 3): the signed-in leg of native-claude-contract.test.ts (AGENT_BUNDLE_NATIVE_CLAUDE_SMOKE=1, isolated HOME) ran 17/18 — the smoke's own evidence was clean (authentication.status: 'subscription-session', version: '2.1.257', validation.exitCode: 0, stream.activationEvidence: 'observed', stream.authSource: 'non-environment', errorEnvelopes: [], stderr.present: false) and the sole diagnostic was claude-native.normal-home.changed. The native-host-smoke workflow's Claude source leg will report harness-failure on every run against 2.1.257 for the same reason.
Proposed fix
Guard the settings-and-plugins surface only, as the host-install session proofs and the packed native smoke already do (normalClaudeSettingsAndPluginsUnchanged, normalHome: 'settings-and-plugins-unchanged'): drop claudeJson from sameClaudeNormalHome, or compare .claude.json with the host's bookkeeping keys removed. The existing test protects the default sibling Claude state file without retaining its opaque contents in packages/agent-bundle/tests/native-claude-contract.test.ts asserts the opposite and must change with it; that file was owned by the concurrent test-determinism lane when the defect was found, so the fix was deferred here rather than edited in the audit PR. Needs a changeset (agent-bundle, patch) and a mention of the claude-native.normal-home.changed scope change in docs/diagnostics.md if its wording describes .claude.json.
Summary
runNativeClaudeSmoke(packages/agent-bundle/src/host-contracts/native-claude-contract.ts) cannot reportpassedagainst a real signed-in Claude Code 2.1.257 session: itssnapshotClaudeNormalHomedigests$HOME/.claude.json(claudeJson) besideconfig.json,settings.local.json,plugins/, andsettings.json, and any difference yieldsclaude-native.normal-home.changed→status: 'harness-failure'. Claude Code 2.1.257 rewrites.claude.jsonon every signed-in turn, even with--no-session-persistence(observed keys appearing or moving:cachedGrowthBookFeatures*,cachedExperiment*,firstStartTime,firstStartVersion,machineID,userID,migrationVersion, migration flags,seenNotifications,pluginUsage,skillUsage).Evidence
docs/audits/2026-09-03-claude-live-session-proofs.md("Defects revealed", item 3): the signed-in leg ofnative-claude-contract.test.ts(AGENT_BUNDLE_NATIVE_CLAUDE_SMOKE=1, isolatedHOME) ran 17/18 — the smoke's own evidence was clean (authentication.status: 'subscription-session',version: '2.1.257',validation.exitCode: 0,stream.activationEvidence: 'observed',stream.authSource: 'non-environment',errorEnvelopes: [],stderr.present: false) and the sole diagnostic wasclaude-native.normal-home.changed. Thenative-host-smokeworkflow's Claude source leg will reportharness-failureon every run against 2.1.257 for the same reason.Proposed fix
Guard the settings-and-plugins surface only, as the host-install session proofs and the packed native smoke already do (
normalClaudeSettingsAndPluginsUnchanged,normalHome: 'settings-and-plugins-unchanged'): dropclaudeJsonfromsameClaudeNormalHome, or compare.claude.jsonwith the host's bookkeeping keys removed. The existing testprotects the default sibling Claude state file without retaining its opaque contentsinpackages/agent-bundle/tests/native-claude-contract.test.tsasserts the opposite and must change with it; that file was owned by the concurrent test-determinism lane when the defect was found, so the fix was deferred here rather than edited in the audit PR. Needs a changeset (agent-bundle, patch) and a mention of theclaude-native.normal-home.changedscope change indocs/diagnostics.mdif its wording describes.claude.json.