docs(runner): update qualification evidence and remaining gates

doc/architecture/runner-copilot-capabilities.md

@@ -1,13 +1,10 @@
 # Copilot 1.0.88 rich ACP capability audit
 
-Current source candidate (2026-09-30): **Copilot profile v8 is unqualified**.
-Its native executable, owned mapper and native distribution closures are unchanged
-from v7, but its declaration binds the full shared ACPX patch. The patch's additive
-Cursor metadata persistence changes those bytes, so v8 has a distinct command
-digest and rejects v7 sessions. Copilot gains no usage or cost capability from this
-change. Retained v7 paid cases below remain exact historical evidence, not v8
-qualification. Fresh pack/image admission and the required exact-runtime local
-and Daytona qualification remain outstanding.
+Current qualification checkpoint (2026-09-30): **Copilot profile v8 remains unqualified.** The a8df warm attempt passed all nine Product matchers and daemon invariants, but the supervisor failed final-pack cleanup on an extra executable; the exact orphan was later retired safely and the original failure remains. The earlier 5c69 warm-PID failure is a separate unchanged historical grade. Sidecar rotation per `attach_run` is ACPX authority rotation, separate from daemon continuity. The Daytona denial observed no write but failed its original fixture when provider turn completion preceded acknowledged run Stop; later checks were not graded.
+
+Shutdown ownership [#14730](https://github.com/paperclipai/paperclip/pull/14730) and denial settlement [#14733](https://github.com/paperclipai/paperclip/pull/14733) remain under review. The latest findings concern process-inspection fallback, owner selection, and durable-event ordering. Neither change has a live qualification pass; final-source verification remains pending. V8 binds the shared ACPX patch under a new digest, rejects v7 sessions, and adds no usage/cost capability. Native per-run USD is unknown.
+
+Exact attempt references: warm result `effadec7b6b134e3b31148cf7eea3c2b24d37ee0fc6ce36dbc90ec420b171560`, reconciliation `1ad1788161e34abf7ddcda15e08134a4c80d1f0af176d7b5397ea6dd810dace0`; Daytona denial result `050a239b6d86754d0f0045979b7c343c007729528546b49f069e7396cd167b38`, reconciliation `2ef9834cd53345c03c04bbfec1ad0bba24a2de1d7096d9225acdfa185241b82a`.
 
 Historical v7 checkpoint (2026-09-30): **Copilot profile v7 remains unqualified**. Paid controller/Product source is `40064d28522de25fea85c1297f35b41bb8a8897a`; native runtime is `5b8e4454ef0bf12d0bb068c2e41d8c9df9356a1c`. Local attached async passed eight checks and local native denial passed ten, with exact command/permission correlation, expected task states, owned cleanup and full end integrity. Daytona hello passed six checks on the current Linux image; one owned sandbox was removed and absence observed through the cleanup window. The local three-turn warm case failed its stable-process invariant despite nine passing behavioral checks. The new controller repair retains the exact agent-files directory with the warm native owner and protects collection authority; it has deterministic and database coverage, but no new paid warm proof yet. The first Daytona denial launch failed before Product dispatch because two executable-digest fields were missing; it created no sandbox and remains a failed attempt. The source `3d21d375d` PR head has green CI and Greptile 5/5. Native per-run USD is unknown; included credits reached 20 with additional usage disabled at $0. The cloud hello infrastructure bound is $0.086931, with provisional analytics. These passes qualify only the named cases. See the [comparative capability report](runner-rich-acp-capabilities.md) for exact evidence, original failures and remaining gates.
 
@@ -87,14 +84,17 @@ status. The stream errors, aborts outstanding response delivery, and terminates
 the provider on violation; the existing runner owns bounded process cleanup.
 Other providers do not install this guard.
 
-The native `ask_user` and `exit_plan_mode` tools are absent from both agent and
-plan mode in the pinned deterministic tool catalogs. Forced model tool calls
-return explicit tool-unavailable results rather than producing a blocking
-request. No `--no-ask-user` or tool-exclusion flag was used. Agent mode is the
-only admitted production mode. If any native input-request event nevertheless
-arrives, the guard terminates the connection; it never presents a form whose
-answer cannot be delivered. This narrows the blocking-input question for the
-admitted pinned mode without claiming an upstream question responder exists.
+The Copilot SDK has native `ask_user` and `exit_plan_mode` capabilities, while
+inspection of the pinned deterministic ACP tool catalogs confirmed that these
+tools are absent in both agent and plan mode. Forced model tool calls in the
+inspected catalogs return explicit tool-unavailable results rather than
+producing a blocking request. This distinguishes SDK capability from ACP
+exposure. Agent mode is the only admitted production mode; no production
+qualification claim is made for plan mode. No `--no-ask-user` or tool-exclusion
+flag was used. If any native input-request event nevertheless arrives, the
+guard terminates the connection; it never presents a form whose answer cannot
+be delivered. Unexpected blocking input remains a guarded safety condition,
+not a qualified responder.
 
 The [offline conformance record](../../packages/paperclip-runner/test/fixtures/copilot-policy-conformance-2026-09-29.json)
 retains every attempt and its evidence digest, including the isolated comparison release. A protected file outside the

doc/architecture/runner-cursor-capabilities.md

@@ -1,16 +1,17 @@
 # Cursor ACP capability inventory
 
-Current source candidate (2026-09-30): **Cursor profile v9 is unqualified**.
-Its declaration binds `paperclip-cursor-usage-v4`, all three newly verified native
-closures and the shared ACPX patch that persists bounded diagnostic observations.
-Every native counter receipt remains partial with unverified semantics; it cannot
-satisfy token or dollar accounting. The exact model remains unpriced until a
-verified rate is available. Prior v7 source, builds and paid observations below
-are historical and do not qualify v9. Old v7/v8 sessions must be reopened.
-The v9 collector marks missing, invalid or reused child run ordinals as
-`child_run_attribution_unverified`. The offline proof executes the pinned
-vendor child creation and reuse methods on all three platforms; child counter
-aggregation semantics remain unverified.
+Current qualification checkpoint (2026-09-30): **Cursor profile v9 remains unqualified.** Draft PR #14724 at `3adee6f3fc652d5f5ee40b2061a16cea0c7341f5` passes Apex 5/5 and all 51 check runs plus one context; one unchanged-head failed-job retry is recorded. It fixes future eval-notice preservation but does not regrade the retained strict protocol-accounting failure or establish native USD. The verified fixed $25 account-cycle cap resets October 28 and applies to account on-demand fees, not per-cell costs. The separate 15-test helper proposal is unintegrated and grants no launch authority. Profile v9 binds usage-v4 and three native closures; counters remain partial with unverified semantics. Local and Daytona qualification remain pending.
+
+A separate native-question attempt ended without a captured
+`cursor/ask_question` callback, and the model reported that AskQuestion was
+unavailable. [Public upstream review](https://forum.cursor.com/t/agent-acp-never-offers-the-askquestion-tool-so-cursor-ask-question-is-never-sent/172976)
+attributed the reported symptom to server-side ACP session identification,
+without identifying a missing initialize capability or a verified fix release.
+Native AskQuestion therefore remains unverified for the pinned model/mode; this
+does not establish universal absence or support in every mode. Semantic question
+continuation is separate and does not qualify the native callback. Evidence is
+retained at `runtime-9-8-10-preparation/cursor-question-public-review/root-findings.json`
+(SHA-256 `2fc34c1942e85ab58577b7cfa8ccdeafe520cc7c539aa67a7eef5a474848ad73`).
 
 Historical v7 checkpoint (2026-09-30): **Cursor profile v7 remains unqualified**. The corrected local native-plan case on controller/Product source `3d21d375de2b6249d9f5322bf001ce0ce0e052aa` and native runtime `5b8e4454ef0bf12d0bb068c2e41d8c9df9356a1c` passed all 26 checks. Reject, feedback, revision-bound acceptance, browser reconnect, exact delivery and unchanged workspace bytes passed. The single planning run succeeded while the task remained In Progress with an explicit next-message wait; no implementation or task completion is claimed. Cleanup and full end integrity passed. Result SHA-256: `685609f01291db84f40d890ef562473b95065e86907bd964b656ad732f6dd97a`. The earlier controller40064 attempt remains failed. Controller fix `c58a8881f` uses the production schema/policy/contract hash envelope; native runtime/profile bytes are unchanged. That exact Cursor PR head has green CI and Greptile 5/5. All three platform builds exist, but the remaining current-profile local/Daytona cases are still required. Native AskQuestion availability remains unverified. Cursor on-demand usage remains $0 under the approved fixed $25 account cap; native per-run USD is unknown. See the [comparative capability report](runner-rich-acp-capabilities.md) for exact source roles, evidence and remaining gates.
 

doc/architecture/runner-pi-capabilities.md

@@ -1,12 +1,6 @@
 # Pi rich ACP runtime
 
-Current source candidate (2026-09-30): **Pi profile v10 is unqualified**.
-The native wrapper/runtime and their platform closures remain unchanged from v9.
-The declaration also pins the full shared ACPX patch, whose additive Cursor
-metadata persistence changes its digest. Therefore v10 rejects v9 sessions;
-retained evidence is not relabeled. No provider budget, token accounting or model
-pricing behavior changes. Paid qualification still requires the existing enforced
-provider spending bound and fresh exact-runtime pack/image admission.
+Current qualification checkpoint (2026-09-30): **Pi profile v10 remains unqualified.** The capped-key/login prerequisite remains blocked. Native USD is unknown. The optional private budget helper is not integrated; Cursor's account-cycle cap does not establish Pi's provider spending bound. V10 keeps the native wrapper and closures unchanged, binds the shared ACPX patch under a new digest, and rejects v9 sessions. Fresh exact-runtime admission and final controller verification remain pending.
 
 Historical v9 checkpoint (2026-09-30): **Pi profile v9 remains unqualified**. Current runtime source is `5b8e4454ef0bf12d0bb068c2e41d8c9df9356a1c`; controller/Product harness source is `40064d28522de25fea85c1297f35b41bb8a8897a`. Runtime builds for macOS ARM64/x64 and Linux x64 are complete. No paid profile-v9 pass is claimed. A credential with a verifiable spend limit is still needed for the remaining paid qualification. The optional transport-budget candidate is frozen on a separate branch and is not integrated or a live spending guarantee. See the [comparative capability report](runner-rich-acp-capabilities.md) for current qualification gates and the field audit. The dated observations below retain their original profile identities.
 

doc/architecture/runner-rich-acp-capabilities.md

@@ -1,27 +1,34 @@
 # Rich ACP integration and qualification report
 
-Current source checkpoint (2026-09-30): **Cursor v9, Copilot v8 and Pi v10
-remain unqualified**. All three declarations bind shared ACPX patch SHA-256
-`bd5393058a218040d217fa85449d59a6f30507de54cd645bf0ef21422823f85e`.
-Cursor additionally binds newly materialized `paperclip-cursor-usage-v4` closures;
-Copilot and Pi native distribution bytes are unchanged. The new identities reject
-retained 7/7/9 sessions, plus Cursor v8 sessions. Claude, Codex and Grok profile declarations stay unchanged.
-The metadata is observation-only: native counters always remain partial, absent
-fields stay absent, and no token totals or dollar costs are inferred. A supported
-schema does not prove native counter aggregation semantics. No new paid pass,
-build, publication or production qualification is claimed for these identities.
-External eval definitions for 8/8/10 merged in [#35](https://github.com/paperclipai/paperclip-evals/pull/35)
-as `25303cf84953985b961b95f89aff0bdb864b2d65`, from head
-`b4ef1aa1296f8897714325d189e5a6f51dad9e01`: 136 deterministic tests,
-21 validated cells, passing CI and Apex 5/5. Models, pricing and graders are
-unchanged; this adds no paid proof. Those definitions remain the historical
-Cursor v8 checkpoint and require a separate reviewed Cursor v9 update.
+Current checkpoint (2026-09-30): **Cursor v9, Copilot v8 and Pi v10 remain unqualified.** The frozen runtime is `5c69b69ef2aeab8d8a367b25a8d894cc5308befa`; controller candidate is `a8df2064d68f40fbf4dec670c4b8478c4b1b1b3f`. All profiles bind shared ACPX patch SHA-256 `bd5393058a218040d217fa85449d59a6f30507de54cd645bf0ef21422823f85e`. No profile is promoted and no prior grade is changed.
 
-| Source candidate | Remaining production gate |
+Current-profile protocol eval definitions merged in [paperclip-evals #36](https://github.com/paperclipai/paperclip-evals/pull/36) as `d987357461933baca0d4c10cc081f40e7eae5c1b`: 136 deterministic tests and 21 validated cells. These definitions do not supply paid qualification evidence.
+
+| Profile | Latest status |
 | --- | --- |
-| Cursor v9 | Qualify the exact new runtime locally and on Daytona; resolve native counter semantics and verified exact-model pricing before treating observations as accounting. Native input, permissions, recovery, isolation and warm continuity remain required. |
-| Copilot v8 | Admit fresh exact-runtime packs/images and qualify the required local/Daytona cases. Prior v7 passes remain case-specific historical proof. Native external-tool/sampling/limits callbacks must not leave unresolved admitted requests. |
-| Pi v10 | Retain the enforced spending-bound requirement, then qualify the exact runtime locally and on Daytona. The optional transport-budget candidate remains unintegrated. |
+| Cursor v9 | Draft #14724 at `3adee6f3fc652d5f5ee40b2061a16cea0c7341f5`; Apex 5/5 and 51 checks plus one context are green. Eval-notice preservation is fixed for future runs. The strict accounting failure remains; native USD is unknown. Local/Daytona qualification remains pending. |
+| Copilot v8 | Current warm attempt passed all 9 Product matchers and daemon invariants; overall supervisor failed final-pack cleanup on an extra executable. That exact orphan was later retired safely; the original grade stays failed. Daytona denial observed no write, but the fixture failed when provider turn completion preceded acknowledged run Stop; later checks were not graded. The 5c69 warm-PID failure is a separate historical grade. |
+| Pi v10 | Capped-key/login access remains blocked. Native USD is unknown; fresh exact-runtime qualification remains pending. |
+
+Copilot follow-ups remain under review: [#14730](https://github.com/paperclipai/paperclip/pull/14730) fixes shutdown ownership, while [#14733](https://github.com/paperclipai/paperclip/pull/14733) distinguishes provider settlement from operator Stop. Current Apex findings concern process-inspection fallback, owner selection, and durable-event ordering. Final-source verification and fresh paid qualification remain pending. Sidecars rotate by `attach_run`, a separate ACPX authority behavior from daemon continuity.
+
+Cursor's verified fixed $25 account-cycle cap resets October 28 and applies to account on-demand fees, not per-cell costs. Its separate 15-test helper proposal is unintegrated and grants no launch authority. Pi's capped-key prerequisite remains unresolved; the optional helper is not integrated. Account-control review SHA-256: `0b661e38043759b5569a586dea57160926a361367c779bfe0fb0080c122f3bdd`.
+
+Latest Copilot attempt references: warm result `effadec7b6b134e3b31148cf7eea3c2b24d37ee0fc6ce36dbc90ec420b171560`, reconciliation `1ad1788161e34abf7ddcda15e08134a4c80d1f0af176d7b5397ea6dd810dace0`; Daytona denial result `050a239b6d86754d0f0045979b7c343c007729528546b49f069e7396cd167b38`, reconciliation `2ef9834cd53345c03c04bbfec1ad0bba24a2de1d7096d9225acdfa185241b82a`.
+
+Earlier current-profile case evidence (grades retained) is tied to Paperclip source `5c69b69ef2aeab8d8a367b25a8d894cc5308befa` and eval definitions `e4989bae1cedc36835da199826bf207d86b75761`. Copilot v8 protocol coverage totals seven cells: six passed and one behavior failure. The earlier `get_task_context` cell passed (result SHA-256 `7a30ad3de932f7e1bc3c3c3c766d8aa128c7003b35447ac0c73ef5f1f36914c0`); the remaining-batch reconciliation records five passes and one failure (SHA-256 `0e746a85e529a2fd45da4e553062753eabc1d8cb37d701529c5bc030a200cb81`). The `context-before-action` failure called `report_progress` before `get_task_context` and generated two comments. No native per-run USD was available; estimated model cost is separate. In local warm continuity, all nine matchers across three turns matched, but the candidate failed the stable-process requirement after observing three runner PIDs (result SHA-256 `e05e1af41a0c43396e8297ca0ac670065ff1f20bf3ce343930d5f45139277ed6`). For the Daytona permission-denial attempt, the recorded sandbox state was `building_snapshot` when the fixture lease wait expired, before the native permission operation or lease. That state can include queueing or image pulling; the evidence does not prove a snapshot was actually being built (result SHA-256 `fb928929a578403943707544e770ddc6ababe358c344a33c4af9028406804407`; state receipt SHA-256 `e32e5bf9b6ee18e8c2a4cb97436ceac7974b0fe1ed7cce02dae4ad2d3d58d875`). The later a8df attempt is recorded in the current checkpoint above; these earlier artifact grades remain unchanged and do not establish complete provider qualification.
+
+Cursor v9's current `get_task_context` cell passed four behavior checks, only one of which asserts a semantic operation. Root reconciliation classifies the attempt as `accounting_failure_account_bounded`, but the capture did not retain the bounded v4 usage envelope: the usage ledger was empty, the retained artifact records `provider_did_not_report_usage`, and native counters were not inspected. There is no usable provider aggregate or estimated cost, so this capture cannot live-qualify partial v4 diagnostics. The case and provider remain unqualified, and no native per-run USD is inferred. Result SHA-256 `7968dc62496feca03a7def6ee20b95ba825d42e9a98f1b6b763ccb8a263b35f4`; root reconciliation SHA-256 `3558c09a839a8aaf9a34970fb793e9c84ff8ca3c125f9543da9c208d4323c54f`.
+A later live-eval recorder review found that generic mapping and evidence fallback drop `paperclip/canonicalProviderEvent`. This identifies a recorder loss path; the prior artifact does not prove that the provider emitted the diagnostic, so the existing `accounting_failure_account_bounded` result and its accounting failure remain unchanged. Draft Paperclip PR [#14724](https://github.com/paperclipai/paperclip/pull/14724), targeting #14699, is at head `3adee6f3fc652d5f5ee40b2061a16cea0c7341f5`. Its non-native suite passed 73 tests with one explicit native exclusion. The initial Apex review identified two P1 issues, subsequently repaired and re-reviewed at the current head above. Evidence `cursor-eval-notice-fix/APEX-REPAIR-01.json` records `nativeExecuted: false` and `oldPaidFailuresRegraded: false` (SHA-256 `a792c3979e4a33801d44974b32fa9078294ec650641ca4e23b1b28212a62659e`). This TS-only repair does not establish deploy-pack or native-runtime reusability: the whole provider deploy pack includes live/eval files and its digest would change; native equalities remain unproven.
+
+Startup preparation on controller `a8df2064d68f40fbf4dec670c4b8478c4b1b1b3f` with frozen runtime `5c69b69ef2aeab8d8a367b25a8d894cc5308befa` first failed because the frozen offline install recreated `node_modules` without the excluded Daytona workspace plugin-SDK link. The narrow `link-plugin-dev-sdk` export restored one symlink and its owned parent. The subsequent preparation digest is `b824a5dde48c94a7c64f2be273b1b03508bdbbd55dbc7cfe63a45a19371b0fd7`; readiness receipt `product-readiness.pending.json` SHA-256 `60fa994d929851670ce29d2dfb2cb773a06ee9e0c037142ccda44fb6e522a9d9` passed health, recovery, UI and plugin checks, retired 32 owned PIDs and observed clear IPC. Root review digest is `4be4f8ce295457b50c69683417bd3883b101089a994bae59be518fe781bf97ce`. This is setup evidence only: zero provider or cloud calls, not provider qualification.
+
+
+The preceding PR workflow on candidate `a027895ea66ac74578ff677d4c555c263773c0a7` ended with nine jobs reporting the same runner shutdown signal at approximately 13:50 UTC, followed by cancellation. Bounded job logs show no explicit failed-test summary, so this is recorded as runner interruption evidence, not a product qualification result or source-test failure. Final PR review snapshot (2026-09-30): paperclip/paperclip #14696 at exact head `9dbf9ae0d030d837a9a4d9241967ff5d3d5c974e` has 52/52 checks green. Greptile Apex reviewed that exact head at 5/5 with no new findings; all eight existing Greptile review threads are resolved. This confirms the PR review state only; provider production qualification remains pending. The preparation review itself records that no paid authority was granted (receipt `protocol-preparation/root-preparation-review.json`, SHA-256 `a716c6bb1d31a7c5bd6547d9295ac8b133f4ad86ab8fccf53683c3b92cab5dac`).
+
+Cursor's native-question report has a [public upstream review finding](https://forum.cursor.com/t/agent-acp-never-offers-the-askquestion-tool-so-cursor-ask-question-is-never-sent/172976): the reported missing AskQuestion behavior was attributed to server-side ACP session identification, with no missing initialize capability identified and no verified fix release in the visible thread. This is diagnostic evidence, not confirmation that the pinned Cursor distribution supports the callback in every mode or proof that it is universally absent. Evidence identity: `root-findings.json`, SHA-256 `2fc34c1942e85ab58577b7cfa8ccdeafe520cc7c539aa67a7eef5a474848ad73`.
+
+The existing provider inventories remain the source for methods, events, projections and explicit gaps. Optional native artifact, diff and every-mode surfaces remain listed as gaps; they are not blanket qualification blockers for unrelated declared scope. No support declaration changes here.
 
 The following checkpoint and chronology retain their original source/profile
 identities; their builds and paid outcomes do not qualify the new candidates.