Retain Cursor local Product completion and billing evidence

Co-Authored-By: Paperclip <noreply@paperclip.ing>

doc/architecture/runner-cursor-capabilities.md

@@ -1,6 +1,6 @@
 # Cursor ACP capability inventory
 
-Evidence date: 2026-09-28. Candidate: `2026.09.26-dd393fe`. This profile is **not live-qualified**. One authorized task-context prompt on the initial free account returned an upgrade requirement, invoked no semantic tools, and supplied no usage receipt. Its cost is unknown; the account dashboard remained unchanged at coarse precision. The user then selected another account, whose exact-model local Runner Eval passed task-context and history tools with clean terminal settlement. Its dashboard attributed 56K rounded tokens to included usage and no incremental charge; ACP still supplied no token or dollar receipt. Product E2E, native interactions, restrictive permissions, recovery, and Daytona execution remain required qualification gates.
+Evidence date: 2026-09-28. Candidate: `2026.09.26-dd393fe`. This profile is **not live-qualified**. One authorized task-context prompt on the initial free account returned an upgrade requirement, invoked no semantic tools, and supplied no usage receipt. Its cost is unknown; the account dashboard remained unchanged at coarse precision. The user then selected another account, whose exact-model local Runner Eval passed task-context and history tools with clean terminal settlement. Its dashboard attributed 56K rounded tokens to included usage and no incremental charge; ACP still supplied no token or dollar receipt. The local Product hello subsequently passed through the real browser, server, database, native runner, and authenticated completion tool. Native interactions, file validation, restrictive permissions, recovery, and Daytona execution remain required qualification gates.
 
 The reference is the runner's Codex app-server integration and its closed thread-item inventory in `src/provider-events.ts`. Cursor ACP and its private extension methods are the transport; the legacy Cursor adapter is unchanged.
 
@@ -68,7 +68,7 @@ Passed in the provider worktree:
 
 The generic native-distribution lease now snapshots the pinned closure, launches Cursor through its verified bundled Node with a closed-module guard, and uses the existing lifetime guardian. A real nonbillable Cursor initialization passed through that lease. Its six focused tests passed, including argument fencing, external module rejection, and native child ownership/exit proof. The existing snapshot suite also passed. The foundation’s later master integration refreshes the common Claude/Codex pins; the candidate pack below was built against that synchronized graph.
 
-Priority follow-ups before advertising support: (1) actual inference entitlement and measured dollar budget after authenticated model discovery; (2) authenticated native lifetime, cleanup and restrictive denial proof; (3) local and Daytona semantic tools, files/artifacts, questions/plans and settlement proof; (4) parent tool content/diff projection and richer nested child presentation; (5) authenticated trace audit for additional unconsumed native fields. Shared receipt/recovery coverage now proves pipe delivery, provider-loss expiry, exact lifecycle IDs and no approval replay.
+Priority follow-ups before advertising support: (1) per-attempt cost attribution despite missing native usage receipts; (2) restrictive denial and interruption proof; (3) remaining local and Daytona files/artifacts, questions/plans, recovery and settlement proof; (4) parent tool content/diff projection and richer nested child presentation; (5) authenticated trace audit for additional unconsumed native fields. Shared receipt/recovery coverage now proves pipe delivery, provider-loss expiry, exact lifecycle IDs and no approval replay.
 
 Remaining rich capabilities intentionally unused: session discovery, generic mode/config-option UI, provider session titles, command/skill picker metadata, full nested child transcripts beyond bounded delegation summaries, native numeric task duration, and optional planUri. They are listed above with reasons; neither “unsupported” nor “complete” should be inferred for unverified live behaviors. The final combined report must update this inventory with integration evidence and include any further events observed during authenticated qualification.
 
@@ -113,6 +113,8 @@ The provider returned only an upgrade requirement and then normal completion. So
 
 The replacement-account attempt passed all four canonical `get-task-context` checks at source `01959b8a602683f13706807983f02c3cba9d36a0`, using newly rebuilt daemon source `f77ae83aeb6d802c73f1c955760017ae272eba29`. Both `get_task_context` and `get_task_history` returned successful authenticated semantic results. It took 29.291 seconds and exited cleanly. The Usage page showed a new `gpt-5.6-luna-medium` row at 19:28:55 UTC with 56K tokens, marked Included. Incremental cash was zero for that row; metered dollars remain unavailable. A conservative $0.07 list-price bound assumes at most 57K rounded tokens at the maximum listed $1.20/M rate and is not an invoice amount. There was no retry.
 
+The local Product hello first stopped at agent creation with HTTP 422 before any provider prompt. Foundation `26dde3cfe` fixed exact host-owned candidate/model admission at the public agent API. The separately authorized replacement passed at source `edf538e61e712dddb6b4d59045c3dcfd445686c7`, from 19:41:56.376 to 19:42:38.761 UTC. All six independent matchers passed: one exact completion marker, task Done, run succeeded, native mode, and local execution. The retained run confirms the 120-second configured deadline, no timeout, committed finalization, and clean cleanup. The final screenshot was inspected and shows the Cursor assignee, tool activity, one completion marker, and Done status. Native usage is null. The account Usage page attributes a new 19:42:25 UTC Luna row with 41.7K tokens, Included in Pro Plus, and zero incremental cash. Metered dollars remain unavailable; a conservative $0.06 list-price bound uses at most 42K rounded tokens at $1.20/M and is not a billing receipt. This proves the local completion-tool product path, not native question/plan, permission, file, recovery, or Daytona qualification. Both attempts remain in the sanitized evidence fixture.
+
 The first attempt also exposed the shared live-eval layer's rejection of missing usage. The foundation now retains explicit unavailable-usage records for diagnostic candidates, leaves the numeric receipt ledger empty, preserves the response for grading, and keeps unknown aggregate costs unknown across mixed turns. This fix does not retroactively turn the retained failed attempt into a pass.
 
 [Cursor's Grok Bot billing documentation](https://cursor.com/help/grok-bot/plans) says linking SuperGrok grants Grok Bot usage while leaving the Cursor plan unchanged. [Cursor's pricing page](https://cursor.com/pricing) lists Composer for free Hobby and frontier models for paid plans. These documents and model-list presence do not establish entitlement for a particular CLI prompt. The operator selected a replacement Pro+ account; its exact Luna configuration was echoed successfully, with no automatic model substitution.

packages/paperclip-runner/test/fixtures/cursor-acp/authenticated-qualification-attempts.json

@@ -153,6 +153,100 @@
         "listCostBoundBasis": "At most 57,000 rounded-display tokens at the maximum listed $1.20 per million token rate; this is not a billing receipt."
       },
       "scope": "Runner Eval: authenticated local native-MCP semantic tools on mock control plane; not Product E2E or native interaction/recovery/Daytona qualification"
+    },
+    {
+      "id": "cursor-product-hello-20260928",
+      "family": "product-e2e",
+      "case": "extended-harnesses.runner-acpx-cursor.local.hello-complete",
+      "runnerSourceRevision": "66ddbc1f9e2001e95dd8a32bd1da09e65df363f7",
+      "startedAt": "2026-09-28T19:37:31.806Z",
+      "finishedAt": "2026-09-28T19:37:32.243Z",
+      "result": "failed_before_agent_creation",
+      "failureClass": "permanent_infrastructure",
+      "errorCode": "paperclip_runner_acpx_agent_unavailable",
+      "submittedPrompts": 0,
+      "providerRuns": 0,
+      "automaticRetries": 0,
+      "cleanup": "passed",
+      "interpretation": "Public agent creation rejected the pending candidate before provider launch; foundation 26dde3cfe added exact host-owned candidate/model qualification admission. A separately authorized replacement retained the failure."
+    },
+    {
+      "id": "cursor-product-hello-replacement-20260928",
+      "family": "product-e2e",
+      "case": "extended-harnesses.runner-acpx-cursor.local.hello-complete",
+      "runnerSourceRevision": "edf538e61e712dddb6b4d59045c3dcfd445686c7",
+      "suiteDefinitionHash": "e75cb2222d2f52ec3a2a425211d195d36b95882de2cb9ed0ad93231b7c42768a",
+      "runnerdSha256": "986060810ba7377c6ddd64a5d89e322d0a434e1a9c80400e6d4acf5934bfc421",
+      "runnerdSourceRevision": "f77ae83aeb6d802c73f1c955760017ae272eba29",
+      "requestedModel": "gpt-5.6-luna[context=272k,reasoning=medium,fast=false]",
+      "startedAt": "2026-09-28T19:41:56.376Z",
+      "finishedAt": "2026-09-28T19:42:38.761Z",
+      "durationMs": 42385,
+      "providerStartedAt": "2026-09-28T19:42:03.686Z",
+      "providerFinishedAt": "2026-09-28T19:42:36.720Z",
+      "providerTimeoutSec": 120,
+      "timeoutFired": false,
+      "result": "passed",
+      "automaticRetries": 0,
+      "submittedPrompts": 1,
+      "providerRuns": 1,
+      "matchers": [
+        {
+          "kind": "message_exact",
+          "passed": true
+        },
+        {
+          "kind": "message_occurrences",
+          "passed": true
+        },
+        {
+          "kind": "issue_status",
+          "passed": true
+        },
+        {
+          "kind": "run_status",
+          "passed": true
+        },
+        {
+          "kind": "runtime_mode",
+          "passed": true
+        },
+        {
+          "kind": "environment",
+          "passed": true
+        }
+      ],
+      "invariantFailures": [],
+      "taskStatus": "done",
+      "runStatus": "succeeded",
+      "finalizationPhase": "committed",
+      "cleanup": "passed",
+      "resultSha256": "5e1ac034a851b0ea124ca314c67e16a6e562ca6e54a30c4421daca1459ccfcd9",
+      "screenshot": {
+        "id": "final-state",
+        "sha256": "04f163928e8f43a1216bc432c4be5248d2434070d270eff9274beaa76730e67a",
+        "visuallyInspected": true,
+        "observed": "Task Done; Cursor assignee; one completion marker; tool activity visible."
+      },
+      "usage": {
+        "nativeReceipt": null,
+        "tokenUsage": null,
+        "costUsd": null,
+        "coverage": "provider usage unavailable; dashboard row attributed"
+      },
+      "scope": "Real local browser/server/database/native runner and authenticated completion tool. Does not qualify native questions/plans, restrictive permissions, file artifacts, recovery, or Daytona.",
+      "billing": {
+        "source": "parent-observed account Usage row after bounded attempt",
+        "observedRequestAt": "2026-09-28T19:42:25Z",
+        "modelLabel": "gpt-5.6-luna-medium",
+        "tokensDisplay": "41.7K",
+        "usageType": "Included in Pro Plus",
+        "chargeDisplay": "Included",
+        "incrementalCashChargeUsd": 0,
+        "meteredCostUsd": null,
+        "conservativeListCostUpperBoundUsd": 0.06,
+        "listCostBoundBasis": "At most 42,000 rounded-display tokens at the maximum listed $1.20 per million token rate, rounded up to $0.06; not a billing receipt."
+      }
     }
   ],
   "newAccountDiscovery": {