Recorded here rather than as extra bullets: the four are gated on a count of
exactly four and Step 31 adds a fifth, so a sixth would break the Verify.
Checked both ways -- the live file still counts 0, a fully answered copy still
counts exactly 4.
O1. Host-side MCP reaches a cloud session through localMcpBridge. research/03
dimension 4 quoted Anthropic saying local MCP servers do not run in cloud
sessions, and flagged as unverified whether they still spawn on this Mac.
They do: main.log records Connecting / negotiated 2025-11-25 / Connected
(1 tools) / announcing, and ps shows the server as a child of Claude.app on
the host Python 3.14. The session addresses it as
mcp__remote-devices__plugin_jobbsok-probe_probe-tools__probe_ping. So
"host-side server" and "cloud session" are not exclusive here.
O2. Sandbox and host are two different interpreters: 3.11.15 [GCC 13.3.0] Linux
inside, 3.14.0 macOS outside, with CLAUDE_PLUGIN_ROOT resolving under
/root/.claude/plugins/synced/. That is also what answers the session-mode
question -- measured from the paths, not read off a settings screen. It
matters for M3: guard_ingest.py cannot import the guard in the sandbox, so
it belongs on the host side of the bridge that O1 shows is reachable.
O3. Cowork's built-in browser rendered a Finn job ad in full, with the operator
logged in after signing in by hand inside that browser. That is the brief's
invariant by a shorter route -- no credential handling, manual auth, an
already-authenticated browser. It raises an M3 question about what
Playwright over CDP still adds; the question is recorded, not decided.
Two limits are stated rather than glossed: login persistence across
sessions was not measured, and the built-in browser leaves no host-side
trace, so unlike O1 and O2 the operator's observation is the only
instrument.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Kjell Tore Guttormsen
41854ae01a