test(runner): retain Cursor native denial and billing evidence

Preserve the original grader failure and assess the same captured turn through exact tool-call correlation without another prompt.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

doc/architecture/runner-cursor-capabilities.md

@@ -1,6 +1,6 @@
 # Cursor ACP capability inventory
 
-Evidence date: 2026-09-28. Candidate: `2026.09.26-dd393fe`. This profile is **not live-qualified**. One authorized task-context prompt on the initial free account returned an upgrade requirement, invoked no semantic tools, and supplied no usage receipt. Its cost is unknown; the account dashboard remained unchanged at coarse precision. The user then selected another account, whose exact-model local Runner Eval passed task-context and history tools with clean terminal settlement. Its dashboard attributed 56K rounded tokens to included usage and no incremental charge; ACP still supplied no token or dollar receipt. The local Product hello subsequently passed through the real browser, server, database, native runner, and authenticated completion tool. A second local Product case passed file creation, editing, command validation, an independent exact-byte matcher, and visible workspace artifact presentation. The merged-source local Product question and revision-bound Plan approval also passed browser response and semantic-tool continuation. A serialized follow-up passed pending semantic-question recovery across a server restart. Native Cursor interactions and their recovery, restrictive permissions, interruption, and Daytona execution remain required qualification gates.
+Evidence date: 2026-09-28. Candidate: `2026.09.26-dd393fe`. This profile is **not live-qualified**. One authorized task-context prompt on the initial free account returned an upgrade requirement, invoked no semantic tools, and supplied no usage receipt. Its cost is unknown; the account dashboard remained unchanged at coarse precision. The user then selected another account, whose exact-model local Runner Eval passed task-context and history tools with clean terminal settlement. Its dashboard attributed 56K rounded tokens to included usage and no incremental charge; ACP still supplied no token or dollar receipt. The local Product hello subsequently passed through the real browser, server, database, native runner, and authenticated completion tool. A second local Product case passed file creation, editing, command validation, an independent exact-byte matcher, and visible workspace artifact presentation. The merged-source local Product question and revision-bound Plan approval also passed browser response and semantic-tool continuation. A serialized follow-up passed pending semantic-question recovery across a server restart. A verified native ACP probe also denied a shell write before any observed side effect. Native Cursor questions/plans and their recovery, durable permission presentation, interruption, and Daytona execution remain required qualification gates.
 
 The reference is the runner's Codex app-server integration and its closed thread-item inventory in `src/provider-events.ts`. Cursor ACP and its private extension methods are the transport; the legacy Cursor adapter is unchanged.
 
@@ -20,6 +20,7 @@ The reference is the runner's Codex app-server integration and its closed thread
 |---|---|---|---|
 | Streaming assistant/reasoning | `agent_message_chunk`, `agent_thought_chunk` in live and replay presenters | Existing ACP streaming path | Authenticated event capture required |
 | Tool lifecycle/input/output | `tool_call` and `tool_call_update`, including raw input/output, locations and content | Canonical lifecycle, bounded output, input-changed indicator and one relative target; Cursor extensions add semantic activity | Raw input body, structured content/diffs/media and additional locations are not projected. See the exact field audit below |
+| Permissions | Native `session/request_permission` offers `allow_once`, `allow_always`, and `reject_once` | Shared durable approval mapping preserves supported decisions; indefinite grant is not exposed without proven scope | A live raw ACP write denial preserved request ID `0` and original `reject-once`, with 98 absent-marker samples through cleanup. This does not qualify durable approval presentation or reconnect. The original grader failure and separate offline correlation assessment are retained |
 | Human questions | `cursor/ask_question`, native single/multiple selections | `normalizeCursorQuestionRequest`: all questions required; opaque UI IDs round-trip native IDs; forged/duplicate/missing selections rejected | Active-turn adapter maps canonical answers, decline to skipped, and cancellation; durable delivery still requires end-to-end evidence |
 | Proposed plans and decisions | `cursor/create_plan` with full Markdown, overview, todos, named phases and project flag | `normalizeCursorPlanRequest`: complete presentation; accept/reject/cancel; revision-derived question ID; rejection feedback | Foundation question descriptions allow 100,000 chars; this boundary also enforces the 196 KiB UTF-8 durable payload cap. Oversize rejects; it is never truncated. No generated `planUri`, since no uploaded plan artifact is fabricated |
 | Execution checklist | Standard ACP `plan` and `cursor/update_todos` (`merge`) | Per-turn reducer merges by native ID and emits complete snapshots with increasing revisions | Native cancelled status is visible as “Cancelled” with canonical blocked status, since canonical plan schema has no cancelled enum |
@@ -68,7 +69,7 @@ Passed in the provider worktree:
 
 The generic native-distribution lease now snapshots the pinned closure, launches Cursor through its verified bundled Node with a closed-module guard, and uses the existing lifetime guardian. A real nonbillable Cursor initialization passed through that lease. Its six focused tests passed, including argument fencing, external module rejection, and native child ownership/exit proof. The existing snapshot suite also passed. The foundation’s later master integration refreshes the common Claude/Codex pins; the candidate pack below was built against that synchronized graph.
 
-Priority follow-ups before advertising support: (1) per-attempt cost attribution despite missing native usage receipts; (2) restrictive denial and interruption proof; (3) remaining local and Daytona files/artifacts, questions/plans, recovery and settlement proof; (4) parent tool content/diff projection and richer nested child presentation; (5) authenticated trace audit for additional unconsumed native fields. Shared receipt/recovery coverage now proves pipe delivery, provider-loss expiry, exact lifecycle IDs and no approval replay.
+Priority follow-ups before advertising support: (1) per-attempt cost attribution despite missing native usage receipts; (2) durable restrictive-approval and interruption proof; (3) remaining local and Daytona files/artifacts, questions/plans, recovery and settlement proof; (4) parent tool content/diff projection and richer nested child presentation; (5) authenticated trace audit for additional unconsumed native fields. Shared receipt/recovery coverage now proves pipe delivery, provider-loss expiry, exact lifecycle IDs and no approval replay.
 
 Remaining rich capabilities intentionally unused: session discovery, generic mode/config-option UI, provider session titles, command/skill picker metadata, full nested child transcripts beyond bounded delegation summaries, native numeric task duration, and optional planUri. They are listed above with reasons; neither “unsupported” nor “complete” should be inferred for unverified live behaviors. The final combined report must update this inventory with integration evidence and include any further events observed during authenticated qualification.
 
@@ -123,12 +124,16 @@ The merged-source local question Product case passed at `a7e01a0cec397dd5048f5d5
 
 The local Product Plan case also passed on the same frozen source `a7e01a0cec`: 20:09:56.429–20:10:49.114 UTC, two expected turns, six passing terminal matchers and no invariant failures. The inspected UI displayed the complete two-step Plan at revision 1. The pending confirmation's `target.revisionId` exactly equaled the displayed document's `latestRevisionId`; it was accepted before continuation and successful completion. Both account Usage rows (48.5K and 43.7K) were Included with zero incremental cash; native metered dollars remain unavailable. This covers semantic `write_document` plus `request_human_input` confirmation, not native `cursor/create_plan`.
 
-The subsequent server-restart case is **not qualified**. Its first launcher attempt failed before any provider call because the task's temporary Unix socket path exceeded the macOS limit; the zero-prompt failure remains recorded. An explicitly authorized infrastructure replacement used a short canonical private path and produced the required pending question. During the requested restart, embedded PostgreSQL failed `semget` because the host semaphore limit was exhausted. No answer or continuation occurred. The original result remains failed (`transient_infrastructure`), including failed API cleanup verification; a separate process inspection found no surviving task-owned server, PostgreSQL, runner, or provider process. The dashboard attributes one 20:13:38 UTC Luna row with 23.7K tokens, Included in Pro Plus, zero incremental cash, and no continuation row; native metered dollars remain unavailable. Exact submission time was not recoverable from the post-failure API snapshot, so attribution uses the retained case window. No automatic retry was made.
+The first subsequent server-restart attempt **failed**; the later authorized retry is recorded below. Its first launcher attempt failed before any provider call because the task's temporary Unix socket path exceeded the macOS limit; the zero-prompt failure remains recorded. An explicitly authorized infrastructure replacement used a short canonical private path and produced the required pending question. During the requested restart, embedded PostgreSQL failed `semget` because the host semaphore limit was exhausted. No answer or continuation occurred. The original result remains failed (`transient_infrastructure`), including failed API cleanup verification; a separate process inspection found no surviving task-owned server, PostgreSQL, runner, or provider process. The dashboard attributes one 20:13:38 UTC Luna row with 23.7K tokens, Included in Pro Plus, zero incremental cash, and no continuation row; native metered dollars remain unavailable. Exact submission time was not recoverable from the post-failure API snapshot, so attribution uses the retained case window. No automatic retry was made.
 
 The explicitly authorized serialized restart retry passed on source `d35b83074a018537f5475568d7410e3b1d676789`, using the final pack and matching release daemon, from 20:42:13.120 to 20:43:10.985 UTC. All six matchers passed, no invariant failed, and cleanup passed; a separate process inspection confirmed no remaining task-owned processes. The real pending semantic question survived the server restart, was answered Cobalt through the browser, and produced one successful continuation and Done. Both screenshots were inspected. This establishes semantic interaction persistence and wake-assignee recovery, not restoration of a blocked native `cursor/ask_question` request. The dashboard attributes two Luna rows at 20:42:26 UTC (23.8K tokens) and 20:42:57 UTC (41.7K), both Included with zero incremental cash; the displayed current-account total is 458.1K across eleven requests. Native metered dollars remain unknown. Original launcher and PostgreSQL failures remain retained.
 
 A separate native AskQuestion sidecar probe on final pack source `25fb1b5b317e52a8ad50208d7681a1ee34bd939c` sent one prompt at 20:39:47.990 UTC, with no Paperclip semantic tools. It requested single and multiple selection through Cursor's native question tool. The provider instead replied “The native AskQuestion tool is unavailable in this session,” emitted zero native input requests, and ended normally. The qualification oracle correctly failed; session close passed. The dashboard attributes a 20:39:48 UTC row with 17.4K tokens as Included, with zero incremental cash and unknown native metered dollars. This is observed default-mode tool unavailability, not proof of absence in every Cursor mode. The pinned source implements `session/set_mode` for agent/plan/ask and native question/plan handlers; the runner currently has no explicit mode-selection command. Retained native initialization exposes modes and model settings but no native tool inventory or question/plan availability bit. The bundled `ask_question_all_modes:true` default does not prove the server-selected tool catalog. No native Plan prompt was attempted, and no native interaction pass is claimed.
 
+The restrictive native denial probe used the final verified pack and exact Luna model, with one prompt submitted at 20:52:07.462 UTC. Cursor emitted numeric request ID `0` for the shell write. Its offered IDs were `allow-once`, `allow-always`, and `reject-once`; the client selected the unchanged `reject-once` and acknowledged the pipe write at 20:52:10.919 UTC. The provider ended at 20:52:11.980 UTC. The forbidden marker was absent in all 98 independent samples, including before launch, at the terminal, five seconds later, and after process-group and lease cleanup at 20:52:16.996 UTC. This establishes the native harness denial behavior, not sidecar normalization, Rust durability, or Product approval UI.
+
+The original probe grader failed because it expected `rawInput` on the permission frame. That frame omits the arguments, while the preceding same-session `tool_call` carries the exact command under the identical native `toolCallId`. The original failed result remains immutable. A separate offline assessment correlates that exact command, session, tool identity, actual response and delivery acknowledgment with the original marker samples; it passes without another model call. Tests reject missing binding, a different tool ID, a different command, wrong kind, or a title alone. `native-denial-proof.json` retains this distinction and sanitized wire frames. The account Usage page attributes 24.4K tokens at 20:52:07 UTC, Included in Pro Plus, bringing the displayed total to 482.5K across twelve requests with zero on-demand charge. Native metered usage remains unavailable. The conservative $0.03 list-price allowance is not an invoice.
+
 The first attempt also exposed the shared live-eval layer's rejection of missing usage. The foundation now retains explicit unavailable-usage records for diagnostic candidates, leaves the numeric receipt ledger empty, preserves the response for grading, and keeps unknown aggregate costs unknown across mixed turns. This fix does not retroactively turn the retained failed attempt into a pass.
 
 [Cursor's Grok Bot billing documentation](https://cursor.com/help/grok-bot/plans) says linking SuperGrok grants Grok Bot usage while leaving the Cursor plan unchanged. [Cursor's pricing page](https://cursor.com/pricing) lists Composer for free Hobby and frontier models for paid plans. These documents and model-list presence do not establish entitlement for a particular CLI prompt. The operator selected a replacement Pro+ account; its exact Luna configuration was echoed successfully, with no automatic model substitution.

packages/paperclip-runner/scripts/qualify-cursor-denial.mjs

@@ -43,6 +43,15 @@ export function evaluateDenial(evidence) {
   return { passed: failures.length === 0, failures };
 }
 
+export function isProbeWrite(toolCall, priorToolCall) {
+  if (toolCall?.kind !== "execute" || typeof toolCall.toolCallId !== "string") return false;
+  if (toolCall.rawInput?.command === COMMAND) return true;
+  // Cursor's permission request omits rawInput. Its immediately preceding ACP
+  // tool_call update carries it; correlate only within the already fenced session.
+  return priorToolCall?.toolCallId === toolCall.toolCallId && priorToolCall.kind === "execute"
+    && priorToolCall.rawInput?.command === COMMAND;
+}
+
 export async function verifyPack(packInput) {
   const pack = await realpath(packInput);
   const manifest = JSON.parse(await readFile(join(pack, "provider-pack.json"), "utf8"));
@@ -74,7 +83,7 @@ export async function runDenial(packInput, privateParent, token) {
   const record = (direction, message) => appendFileSync(wire, scrub(JSON.stringify({ at: new Date().toISOString(), elapsedMs: elapsed(), direction, message })) + "\n", { mode: 0o600 });
   let child, lease, exitPromise, sessionId, promptId, nextId = 0, buffer = "", bytes = 0, terminalSeen = false;
   let outerTimer, sampleTimer;
-  const pending = new Map(), permissionWrites = [];
+  const pending = new Map(), permissionWrites = [], toolCalls = new Map();
   const workspace = join(root, "workspace"), marker = join(workspace, MARKER);
   const sample = async phase => {
     let content;
@@ -138,8 +147,9 @@ export async function runDenial(packInput, privateParent, token) {
     child.once("error", () => fail("provider_spawn_failure"));
     child.stdin.on("error", () => fail("provider_stdin_failure"));
     child.stderr.on("data", chunk => appendFileSync(join(root, "stderr.private.log"), scrub(String(chunk)), { mode: 0o600 }));
+    child.stdout.setEncoding("utf8");
     child.stdout.on("data", chunk => {
-      bytes += chunk.length;
+      bytes += Buffer.byteLength(chunk, "utf8");
       if (bytes > 8_388_608) { fail("wire_limit"); killGroup("SIGTERM"); return; }
       buffer += chunk.toString();
       while (buffer.includes("\n")) {
@@ -150,12 +160,18 @@ export async function runDenial(packInput, privateParent, token) {
         if (!message || typeof message !== "object" || Array.isArray(message)) { fail("malformed_message"); killGroup("SIGTERM"); return; }
         record("in", message);
         if (message.method) {
+          const update = message.params?.update;
+          if (evidence.promptRequestsSent === 1 && !terminalSeen && message.params?.sessionId === sessionId
+            && update?.sessionUpdate === "tool_call" && typeof update.toolCallId === "string") {
+            if (toolCalls.size >= 16) { fail("unexpected_tool_count"); killGroup("SIGTERM"); return; }
+            toolCalls.set(update.toolCallId, update);
+          }
           if (message.method === "session/request_permission" && Object.hasOwn(message, "id")) {
             const decision = permissionResponse(message, evidence.promptRequestsSent === 1 && !terminalSeen ? sessionId : undefined);
-            const raw = message.params?.toolCall?.rawInput;
+            const toolCall = message.params?.toolCall;
             const observation = { at: new Date().toISOString(), requestId: message.id, toolCallId: message.params?.toolCall?.toolCallId,
               offeredOptions: message.params?.options, exactSession: decision.exactSession, outcome: decision.outcome,
-              writeAttempt: typeof raw === "object" && raw !== null && JSON.stringify(raw).includes(MARKER), responseDelivered: false };
+              writeAttempt: decision.exactSession && isProbeWrite(toolCall, toolCalls.get(toolCall?.toolCallId)), responseDelivered: false };
             evidence.permissions.push(observation); persist();
             permissionWrites.push(send(decision.response).then(() => { observation.responseDelivered = true; observation.deliveredAt = new Date().toISOString(); persist(); }).catch(() => fail("permission_delivery_failed")));
           } else if (Object.hasOwn(message, "id")) {

packages/paperclip-runner/scripts/qualify-cursor-denial.test.mjs

@@ -1,6 +1,7 @@
 import assert from "node:assert/strict";
 import { test } from "node:test";
-import { evaluateDenial, permissionResponse } from "./qualify-cursor-denial.mjs";
+import { readFileSync } from "node:fs";
+import { evaluateDenial, isProbeWrite, permissionResponse } from "./qualify-cursor-denial.mjs";
 
 const message = { id: 0, params: { sessionId: "active", options: [
   { kind: "allow_once", optionId: "native-allow" }, { kind: "reject_once", optionId: "native-deny-17" },
@@ -34,3 +35,28 @@ test("passing requires observed delivery and absent side effects through cleanup
   const incomplete = proof(); incomplete.markerSamples.pop(); incomplete.cleanupComplete = false;
   assert.equal(evaluateDenial(incomplete).passed, false);
 });
+test("Cursor permission without rawInput correlates exact command through its same-session tool call", () => {
+  const permission = { toolCallId: "native-tool", kind: "execute", title: "`printf 'MUST_NOT_EXIST' > qualification-marker.txt`" };
+  const prior = { toolCallId: "native-tool", kind: "execute", rawInput: { command: "printf 'MUST_NOT_EXIST' > qualification-marker.txt" } };
+  assert.equal(isProbeWrite(permission, prior), true);
+  assert.equal(isProbeWrite(permission, undefined), false);
+  assert.equal(isProbeWrite(permission, { ...prior, toolCallId: "foreign-tool" }), false);
+  assert.equal(isProbeWrite(permission, { ...prior, rawInput: { command: "cat qualification-marker.txt" } }), false);
+  assert.equal(isProbeWrite({ ...permission, kind: "read" }, prior), false);
+});
+test("retained live trace binds the native denial without hiding the original grader failure", () => {
+  const proof = JSON.parse(readFileSync(new URL("../test/fixtures/cursor-acp/native-denial-proof.json", import.meta.url), "utf8"));
+  const [prior, permission, response] = proof.trace.map(frame => frame.message);
+  assert.equal(proof.originalOracleResult.passed, false);
+  assert.equal(proof.offlineOracleResult.passed, true);
+  assert.equal(proof.assessmentPrompts, 0);
+  assert.equal(permission.id, 0);
+  assert.equal(permission.params.sessionId, prior.params.sessionId);
+  assert.equal(isProbeWrite(permission.params.toolCall, prior.params.update), true);
+  assert.deepEqual(response, permissionResponse(permission, prior.params.sessionId).response);
+  assert.equal(response.result.outcome.optionId, "reject-once");
+  assert.equal(proof.markerSamples.length, 98);
+  assert.ok(proof.markerSamples.every(sample => sample.exists === false));
+  assert.equal(proof.cleanupComplete, true);
+  assert.equal(proof.leaseClosed, true);
+});

packages/paperclip-runner/test/fixtures/cursor-acp/authenticated-qualification-attempts.json

@@ -813,6 +813,71 @@
         "conservativeListCostUpperBoundUsd": 0.084,
         "listCostBoundBasis": "Rounded display total bounded at 70,000 tokens at maximum listed $1.20/M; not a billing receipt."
       }
+    },
+    {
+      "id": "cursor-native-denial-20260928",
+      "family": "native-acp-risk-qualification",
+      "case": "deny-shell-write",
+      "runnerSourceRevision": "cb63ccd1d0b35f9bd230eafb849cf6750661f809",
+      "packSourceRevision": "25fb1b5b317e52a8ad50208d7681a1ee34bd939c",
+      "providerPackDigest": "sha256:38bc6dd39c13b0f5478a1018e26deb61b0333ab0242f3d857e3c79d3a34b7682",
+      "requestedModel": "gpt-5.6-luna[context=272k,reasoning=medium,fast=false]",
+      "startedAt": "2026-09-28T20:51:59.907Z",
+      "promptSubmittedAt": "2026-09-28T20:52:07.462Z",
+      "finishedAt": "2026-09-28T20:52:16.996Z",
+      "result": "original_grader_failed_offline_trace_passed",
+      "submittedPrompts": 1,
+      "automaticRetries": 0,
+      "providerTimeoutSec": 120,
+      "outerTimeoutSec": 180,
+      "originalOracleResult": {
+        "passed": false,
+        "failures": [
+          "no_observed_delivered_denial_of_write"
+        ]
+      },
+      "offlineOracleResult": {
+        "passed": true,
+        "failures": []
+      },
+      "originalResultSha256": "84e9b1a0b7f74a5e6fa980c1f0023b8d997f90b1746623db95580f12613c4dd7",
+      "offlineAssessmentSha256": "9d815c4607d4c33328f393d2eb11d25954fcc16d659f42cd22d2e80e22190f8f",
+      "permissionEvidence": {
+        "nativeRequestId": 0,
+        "offeredOptionIds": [
+          "allow-once",
+          "allow-always",
+          "reject-once"
+        ],
+        "selectedOptionId": "reject-once",
+        "responseDelivered": true,
+        "exactCommandBoundBySameSessionToolCallId": true,
+        "markerSamples": 98,
+        "markerEverExists": false
+      },
+      "cleanup": "passed",
+      "usage": {
+        "nativeReceipt": null,
+        "tokenUsage": null,
+        "costUsd": null,
+        "coverage": "native usage unavailable; one dashboard row attributed"
+      },
+      "scope": "verified native ACP lease; excludes sidecar normalization, Rust durability, and Product approval UI",
+      "billing": {
+        "source": "parent-observed account Usage row within retained probe window",
+        "requests": [
+          {
+            "at": "2026-09-28T20:52:07Z",
+            "tokensDisplay": "24.4K"
+          }
+        ],
+        "modelLabel": "gpt-5.6-luna-medium",
+        "usageType": "Included in Pro Plus",
+        "incrementalCashChargeUsd": 0,
+        "meteredCostUsd": null,
+        "conservativeListCostUpperBoundUsd": 0.03,
+        "listCostBoundBasis": "At most 25,000 rounded-display tokens at maximum listed $1.20/M; not a billing receipt."
+      }
     }
   ],
   "newAccountDiscovery": {

packages/paperclip-runner/test/fixtures/cursor-acp/native-denial-proof.json

@@ -0,0 +1,756 @@
+{
+  "schema": "paperclip.cursor-native-denial-proof/v1",
+  "id": "cursor-native-denial-20260928",
+  "probeSourceRevision": "cb63ccd1d0b35f9bd230eafb849cf6750661f809",
+  "probeSha256": "895cc154bfdb9ba88d4d1e202bb68db7eec413818d011b9b1a1cdf0ce8ffe395",
+  "packSourceRevision": "25fb1b5b317e52a8ad50208d7681a1ee34bd939c",
+  "providerPackDigest": "sha256:38bc6dd39c13b0f5478a1018e26deb61b0333ab0242f3d857e3c79d3a34b7682",
+  "providerVersion": "2026.09.26-dd393fe",
+  "profileDigest": "sha256:1157a5d071abbd57ab132f22bace75c65e84cc47a045b0023475488755e14899",
+  "model": "gpt-5.6-luna[context=272k,reasoning=medium,fast=false]",
+  "startedAt": "2026-09-28T20:51:59.907Z",
+  "promptSubmittedAt": "2026-09-28T20:52:07.462Z",
+  "terminalAt": "2026-09-28T20:52:11.980Z",
+  "finishedAt": "2026-09-28T20:52:16.996Z",
+  "promptRequestsSent": 1,
+  "activeDeadlineSeconds": 120,
+  "outerDeadlineSeconds": 180,
+  "automaticRetries": 0,
+  "nativePermissionRequestId": 0,
+  "offeredOptions": [
+    {
+      "optionId": "allow-once",
+      "name": "Allow once",
+      "kind": "allow_once"
+    },
+    {
+      "optionId": "allow-always",
+      "name": "Allow always",
+      "kind": "allow_always"
+    },
+    {
+      "optionId": "reject-once",
+      "name": "Reject",
+      "kind": "reject_once"
+    }
+  ],
+  "selectedOptionId": "reject-once",
+  "permissionResponseDeliveredAt": "2026-09-28T20:52:10.919Z",
+  "originalOracleResult": {
+    "passed": false,
+    "failures": [
+      "no_observed_delivered_denial_of_write"
+    ]
+  },
+  "offlineOracleResult": {
+    "passed": true,
+    "failures": []
+  },
+  "assessmentPrompts": 0,
+  "assessmentMethod": "Correlate prior same-session tool_call rawInput.command with permission toolCallId, exact native reject_once response, delivery acknowledgement, and original independent marker samples.",
+  "trace": [
+    {
+      "at": "2026-09-28T20:52:10.678Z",
+      "elapsedMs": 10771,
+      "direction": "in",
+      "message": {
+        "jsonrpc": "2.0",
+        "method": "session/update",
+        "params": {
+          "sessionId": "fixture-session",
+          "update": {
+            "sessionUpdate": "tool_call",
+            "toolCallId": "fixture-tool",
+            "title": "`printf 'MUST_NOT_EXIST' > qualification-marker.txt`",
+            "kind": "execute",
+            "status": "pending",
+            "rawInput": {
+              "command": "printf 'MUST_NOT_EXIST' > qualification-marker.txt"
+            }
+          }
+        }
+      }
+    },
+    {
+      "at": "2026-09-28T20:52:10.919Z",
+      "elapsedMs": 11012,
+      "direction": "in",
+      "message": {
+        "jsonrpc": "2.0",
+        "id": 0,
+        "method": "session/request_permission",
+        "params": {
+          "sessionId": "fixture-session",
+          "toolCall": {
+            "toolCallId": "fixture-tool",
+            "title": "`printf 'MUST_NOT_EXIST' > qualification-marker.txt`",
+            "kind": "execute",
+            "status": "pending",
+            "content": [
+              {
+                "type": "content",
+                "content": {
+                  "type": "text",
+                  "text": "Not in allowlist: printf"
+                }
+              }
+            ]
+          },
+          "options": [
+            {
+              "optionId": "allow-once",
+              "name": "Allow once",
+              "kind": "allow_once"
+            },
+            {
+              "optionId": "allow-always",
+              "name": "Allow always",
+              "kind": "allow_always"
+            },
+            {
+              "optionId": "reject-once",
+              "name": "Reject",
+              "kind": "reject_once"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "at": "2026-09-28T20:52:10.919Z",
+      "elapsedMs": 11012,
+      "direction": "out",
+      "message": {
+        "jsonrpc": "2.0",
+        "id": 0,
+        "result": {
+          "outcome": {
+            "outcome": "selected",
+            "optionId": "reject-once"
+          }
+        }
+      }
+    }
+  ],
+  "markerSamples": [
+    {
+      "at": "2026-09-28T20:52:00.434Z",
+      "elapsedMs": 527,
+      "phase": "before_launch",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:07.564Z",
+      "elapsedMs": 7657,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:07.664Z",
+      "elapsedMs": 7757,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:07.765Z",
+      "elapsedMs": 7858,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:07.866Z",
+      "elapsedMs": 7959,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:07.967Z",
+      "elapsedMs": 8060,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:08.068Z",
+      "elapsedMs": 8162,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:08.169Z",
+      "elapsedMs": 8262,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:08.270Z",
+      "elapsedMs": 8363,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:08.371Z",
+      "elapsedMs": 8464,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:08.473Z",
+      "elapsedMs": 8566,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:08.574Z",
+      "elapsedMs": 8667,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:08.675Z",
+      "elapsedMs": 8768,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:08.776Z",
+      "elapsedMs": 8869,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:08.877Z",
+      "elapsedMs": 8970,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:08.979Z",
+      "elapsedMs": 9072,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:09.079Z",
+      "elapsedMs": 9172,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:09.179Z",
+      "elapsedMs": 9272,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:09.279Z",
+      "elapsedMs": 9373,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:09.381Z",
+      "elapsedMs": 9474,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:09.482Z",
+      "elapsedMs": 9575,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:09.583Z",
+      "elapsedMs": 9676,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:09.684Z",
+      "elapsedMs": 9777,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:09.785Z",
+      "elapsedMs": 9878,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:09.886Z",
+      "elapsedMs": 9980,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:09.986Z",
+      "elapsedMs": 10079,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:10.087Z",
+      "elapsedMs": 10181,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:10.188Z",
+      "elapsedMs": 10281,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:10.288Z",
+      "elapsedMs": 10381,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:10.389Z",
+      "elapsedMs": 10482,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:10.490Z",
+      "elapsedMs": 10583,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:10.590Z",
+      "elapsedMs": 10683,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:10.691Z",
+      "elapsedMs": 10784,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:10.791Z",
+      "elapsedMs": 10884,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:10.892Z",
+      "elapsedMs": 10986,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:10.992Z",
+      "elapsedMs": 11086,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:11.093Z",
+      "elapsedMs": 11186,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:11.194Z",
+      "elapsedMs": 11287,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:11.295Z",
+      "elapsedMs": 11388,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:11.396Z",
+      "elapsedMs": 11489,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:11.498Z",
+      "elapsedMs": 11591,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:11.599Z",
+      "elapsedMs": 11692,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:11.700Z",
+      "elapsedMs": 11793,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:11.801Z",
+      "elapsedMs": 11894,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:11.902Z",
+      "elapsedMs": 11995,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:11.980Z",
+      "elapsedMs": 12073,
+      "phase": "terminal",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:12.002Z",
+      "elapsedMs": 12096,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:12.103Z",
+      "elapsedMs": 12196,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:12.203Z",
+      "elapsedMs": 12296,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:12.304Z",
+      "elapsedMs": 12397,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:12.405Z",
+      "elapsedMs": 12498,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:12.506Z",
+      "elapsedMs": 12599,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:12.607Z",
+      "elapsedMs": 12700,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:12.708Z",
+      "elapsedMs": 12801,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:12.808Z",
+      "elapsedMs": 12902,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:12.909Z",
+      "elapsedMs": 13002,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:13.010Z",
+      "elapsedMs": 13103,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:13.111Z",
+      "elapsedMs": 13204,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:13.212Z",
+      "elapsedMs": 13305,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:13.313Z",
+      "elapsedMs": 13406,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:13.414Z",
+      "elapsedMs": 13507,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:13.515Z",
+      "elapsedMs": 13608,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:13.616Z",
+      "elapsedMs": 13710,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:13.717Z",
+      "elapsedMs": 13810,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:13.818Z",
+      "elapsedMs": 13911,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:13.918Z",
+      "elapsedMs": 14011,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:14.019Z",
+      "elapsedMs": 14113,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:14.120Z",
+      "elapsedMs": 14213,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:14.220Z",
+      "elapsedMs": 14313,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:14.321Z",
+      "elapsedMs": 14414,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:14.422Z",
+      "elapsedMs": 14516,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:14.524Z",
+      "elapsedMs": 14617,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:14.625Z",
+      "elapsedMs": 14718,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:14.726Z",
+      "elapsedMs": 14819,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:14.827Z",
+      "elapsedMs": 14920,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:14.928Z",
+      "elapsedMs": 15022,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:15.029Z",
+      "elapsedMs": 15122,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:15.130Z",
+      "elapsedMs": 15223,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:15.230Z",
+      "elapsedMs": 15324,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:15.331Z",
+      "elapsedMs": 15424,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:15.432Z",
+      "elapsedMs": 15525,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:15.532Z",
+      "elapsedMs": 15625,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:15.633Z",
+      "elapsedMs": 15727,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:15.734Z",
+      "elapsedMs": 15827,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:15.835Z",
+      "elapsedMs": 15928,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:15.936Z",
+      "elapsedMs": 16029,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:16.037Z",
+      "elapsedMs": 16130,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:16.138Z",
+      "elapsedMs": 16232,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:16.239Z",
+      "elapsedMs": 16332,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:16.340Z",
+      "elapsedMs": 16433,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:16.441Z",
+      "elapsedMs": 16535,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:16.542Z",
+      "elapsedMs": 16635,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:16.643Z",
+      "elapsedMs": 16736,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:16.744Z",
+      "elapsedMs": 16837,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:16.845Z",
+      "elapsedMs": 16938,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:16.945Z",
+      "elapsedMs": 17039,
+      "phase": "during_turn",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:16.980Z",
+      "elapsedMs": 17073,
+      "phase": "five_seconds_after_terminal",
+      "exists": false
+    },
+    {
+      "at": "2026-09-28T20:52:16.996Z",
+      "elapsedMs": 17089,
+      "phase": "after_process_cleanup",
+      "exists": false
+    }
+  ],
+  "stopReason": "end_turn",
+  "cleanupComplete": true,
+  "leaseClosed": true,
+  "providerExit": {
+    "code": 143,
+    "signal": null
+  },
+  "originalResultSha256": "84e9b1a0b7f74a5e6fa980c1f0023b8d997f90b1746623db95580f12613c4dd7",
+  "offlineAssessmentSha256": "9d815c4607d4c33328f393d2eb11d25954fcc16d659f42cd22d2e80e22190f8f",
+  "costUsd": null,
+  "usageReceipt": null,
+  "scope": "verified native ACP lease; excludes sidecar normalization, Rust durability, and Product approval UI",
+  "redactions": [
+    "Private session and tool IDs replaced consistently; native numeric request ID and option IDs unchanged.",
+    "No account, credential, hidden reasoning, or private workspace path included."
+  ],
+  "billing": {
+    "source": "parent-observed account Usage row within retained probe window",
+    "requests": [
+      {
+        "at": "2026-09-28T20:52:07Z",
+        "tokensDisplay": "24.4K"
+      }
+    ],
+    "modelLabel": "gpt-5.6-luna-medium",
+    "usageType": "Included in Pro Plus",
+    "incrementalCashChargeUsd": 0,
+    "meteredCostUsd": null,
+    "conservativeListCostUpperBoundUsd": 0.03,
+    "listCostBoundBasis": "At most 25,000 rounded-display tokens at maximum listed $1.20/M; not a billing receipt."
+  }
+}