From eb0f43c45a66909197b2cbb59c9eec909bd0b3d3 Mon Sep 17 00:00:00 2001 From: Dotta Date: Mon, 28 Sep 2026 12:34:29 -0500 Subject: [PATCH] Retain final rebased Cursor pack and registry launch proof Co-Authored-By: Paperclip --- doc/architecture/runner-cursor-capabilities.md | 8 ++++---- .../cursor-acp/provider-pack-darwin-arm64.json | 14 +++++++------- .../cursor-acp/provider-pack-offline-proof.json | 11 ++++++----- 3 files changed, 17 insertions(+), 16 deletions(-) diff --git a/doc/architecture/runner-cursor-capabilities.md b/doc/architecture/runner-cursor-capabilities.md index b061dace2c8..c64b3a9f588 100644 --- a/doc/architecture/runner-cursor-capabilities.md +++ b/doc/architecture/runner-cursor-capabilities.md @@ -84,16 +84,16 @@ Three real ACP stream tests prove child lifecycle/transcript preservation before ## Integrated pack and offline launch evidence -The full `build-provider-pack.mjs --candidate-providers=cursor` path passed on source `f4bb4a5c316acf12f08a2caf8b9a0ad311588210` (foundation includes upstream master `14795136f56c11ed83dc754791945bb5a0b8f7fd`). It used standalone Node, pnpm 9.15.4, a fresh production deployment and the pinned vendor archive. The build checked portable Node relocation, fresh ACPX import and complete Cursor materialization. The retained manifest is `packages/paperclip-runner/test/fixtures/cursor-acp/provider-pack-darwin-arm64.json`; it contains only relative paths and digests. +The full `build-provider-pack.mjs --candidate-providers=cursor` path passed on source `1055c13f8cffd8c06070eb6403d3beff83e64374` (foundation includes upstream master `14795136f56c11ed83dc754791945bb5a0b8f7fd`). It used standalone Node, pnpm 9.15.4, a fresh production deployment and the pinned vendor archive. The build checked portable Node relocation, fresh ACPX import and complete Cursor materialization. The retained manifest is `packages/paperclip-runner/test/fixtures/cursor-acp/provider-pack-darwin-arm64.json`; it contains only relative paths and digests. -- Pack digest: `sha256:2f791844619982531282197e8554c2d1e1a2a031bd92e1abf78dae087fc80af6`. +- Pack digest: `sha256:480ae2eaa7a61852533286648911304fa1e47d2e40e80dcc19f0cce0149cb77e`. - Cursor declaration: `sha256:1157a5d071abbd57ab132f22bace75c65e84cc47a045b0023475488755e14899`. - macOS ARM64 closure: `sha256:77394184a89b0e7384971181da19c3c82d83a399b04e7944b3f94fe3d7e62b25`. - Resolved dependency lock: `sha256:774e3070ecba7bedaf70502a1a85bc05df535db1b34462b389de49031b6b8232`, also the reviewed Daytona build digest for this branch. CI regenerates the lock from source-owned patches and rejects a different digest before execution. -`provider-pack-offline-proof.json` records a real launch from the pack’s verified native closure and retained snapshot, using private directories and no credentials. ACP v1 initialize succeeds. The correct `cursor/list_available_models`, `session/list` and `session/new` methods return authentication-required; `session/fork` and `session/resume` return method-not-found. The process produced no stderr, was explicitly terminated after these probes, and its lease closed. The earlier discovery fixture’s `_cursor/list_available_models` probe used an incorrect method prefix; this later probe corrects that uncertainty without changing the original evidence. +`provider-pack-offline-proof.json` records a real launch through the generic profile installation registry from the pack’s verified native closure and retained snapshot, using private directories and no credentials. ACP v1 initialize succeeds. The correct `cursor/list_available_models`, `session/list` and `session/new` methods return authentication-required; `session/fork` and `session/resume` return method-not-found. The process produced no stderr, was explicitly terminated after these probes, and its lease closed. The earlier discovery fixture’s `_cursor/list_available_models` probe used an incorrect method prefix; this later probe corrects that uncertainty without changing the original evidence. -After rebase: TypeScript/verified-sidecar build passed; 17 Cursor Vitest cases, 28 installed ACPX/materializer Node cases, and 6 Daytona image-content cases passed. Daytona content identity includes the candidate selection, Cursor materializer and distribution manifest. This is local macOS ARM64 packaging/initialization evidence only. It does not qualify Linux execution, a Daytona image build/run, authenticated model work, permissions, or dollar accounting. No screenshot is claimed for these headless tests. Total billable prompts and spend remain zero. +At the initial integration checkpoint, 17 Cursor Vitest cases, 28 installed ACPX/materializer Node cases, and 6 Daytona image-content cases passed. After the final foundation rebase to `5aeebb20c`, TypeScript/verified-sidecar build, all 17 Cursor cases, and 11 installed extension-hook/materializer Node cases passed again. The fresh pack/probe above binds this final runtime source. Its explicit offline factory model sentinel is not an authenticated model selection; no ACP prompt was sent. Daytona content identity includes the candidate selection, Cursor materializer and distribution manifest. This is local macOS ARM64 packaging/initialization evidence only. It does not qualify Linux execution, a Daytona image build/run, authenticated model work, permissions, or dollar accounting. No screenshot is claimed for these headless tests. Total billable prompts and spend remain zero. ## Exact remaining field audit diff --git a/packages/paperclip-runner/test/fixtures/cursor-acp/provider-pack-darwin-arm64.json b/packages/paperclip-runner/test/fixtures/cursor-acp/provider-pack-darwin-arm64.json index 028b0012264..e430c64d833 100644 --- a/packages/paperclip-runner/test/fixtures/cursor-acp/provider-pack-darwin-arm64.json +++ b/packages/paperclip-runner/test/fixtures/cursor-acp/provider-pack-darwin-arm64.json @@ -1,6 +1,6 @@ { "schema": "paperclip-runner/remote-provider-pack/v1", - "digest": "sha256:2f791844619982531282197e8554c2d1e1a2a031bd92e1abf78dae087fc80af6", + "digest": "sha256:480ae2eaa7a61852533286648911304fa1e47d2e40e80dcc19f0cce0149cb77e", "payload": { "pins": { "nodeMinimum": "24.11.0", @@ -14,9 +14,9 @@ "platform": "darwin", "architecture": "arm64" }, - "runnerSourceRevision": "f4bb4a5c316acf12f08a2caf8b9a0ad311588210", - "distDigest": "sha256:364a72974524c442e8f5a876c3cfe85b071fdb9ab154dad63ac221f7d32b61df", - "bridgeDigest": "sha256:9f4f46c692317ad4a2a9558554695f5e35824f78084924fcc4ce6c2b9a45d7d5", + "runnerSourceRevision": "1055c13f8cffd8c06070eb6403d3beff83e64374", + "distDigest": "sha256:4f7303572ec9f64a54b9fc8d766c007c88119711b601a0294b54a81367ddd888", + "bridgeDigest": "sha256:acc33db0c5c261aa4e9792f8cbbf8b7edff5ff6234555c20d72ea12c1388d8d9", "acpxProfileDigests": { "claude": "sha256:9d73d1f0f121fb96cc8badb28c22d5bff02d8582eb2e40360a81c189e1b9422a", "codex": "sha256:c4538599d1ab767db5dff50934f13bb5ba313a59d9c4a83e993fac4617ea63d3" @@ -38,7 +38,7 @@ }, "productionLock": { "path": "pnpm-lock.yaml", - "sha256": "sha256:774e3070ecba7bedaf70502a1a85bc05df535db1b34462b389de49031b6b8232" + "sha256": "sha256:e0c928a494f90ddad3c00791e83f09315ee8c82df2a0418a809dcf93649a8ab3" }, "opencodeCommand": { "path": "node_modules/.bin/opencode", @@ -50,11 +50,11 @@ }, "opencodeProxy": { "path": "dist/cli/opencode-app-server-proxy.cjs", - "sha256": "sha256:4b5599705325483dc5922dde126435eb102153acadca367163525fbfc1676a5c" + "sha256": "sha256:26c685c57e196d94cf4524b000b5c7d81a66bb11c8687a3a4944c7445af785f0" }, "acpxSidecar": { "path": "dist/cli/acpx-runtime-sidecar.cjs", - "sha256": "sha256:2a11a1abf785215589219eab0f5f87ad30e2a46f78bebfd31f5df7e7bc258294" + "sha256": "sha256:731d577d16afb6eccc03328261ec7bc9e21f302e9154c99185cc2410283facfa" } } } diff --git a/packages/paperclip-runner/test/fixtures/cursor-acp/provider-pack-offline-proof.json b/packages/paperclip-runner/test/fixtures/cursor-acp/provider-pack-offline-proof.json index e3ba7c90012..2979432963f 100644 --- a/packages/paperclip-runner/test/fixtures/cursor-acp/provider-pack-offline-proof.json +++ b/packages/paperclip-runner/test/fixtures/cursor-acp/provider-pack-offline-proof.json @@ -1,8 +1,8 @@ { "schema": "paperclip-cursor-offline-pack-proof/v1", - "capturedAt": "2026-09-28T17:11:14.939Z", - "runnerSourceRevision": "f4bb4a5c316acf12f08a2caf8b9a0ad311588210", - "packDigest": "sha256:2f791844619982531282197e8554c2d1e1a2a031bd92e1abf78dae087fc80af6", + "capturedAt": "2026-09-28T17:33:30.123Z", + "runnerSourceRevision": "1055c13f8cffd8c06070eb6403d3beff83e64374", + "packDigest": "sha256:480ae2eaa7a61852533286648911304fa1e47d2e40e80dcc19f0cce0149cb77e", "target": { "platform": "darwin", "architecture": "arm64" @@ -15,7 +15,7 @@ "path": "provider-assets/cursor/darwin-arm64", "sha256": "sha256:3b6de19114d4df62f648604025a0d71937dfa7c2b15b397cce5da2c5da268994" }, - "productionLock": "sha256:774e3070ecba7bedaf70502a1a85bc05df535db1b34462b389de49031b6b8232", + "productionLock": "sha256:e0c928a494f90ddad3c00791e83f09315ee8c82df2a0418a809dcf93649a8ab3", "launch": { "entrypoint": "verified bundled node + index.js", "arguments": [ @@ -24,7 +24,8 @@ "acp" ], "credentials": "none; private home/config/data/cache; memory credential store", - "verification": "whole closure digest verification, retained immutable native snapshot, closed module bootstrap" + "verification": "generic profile installation registry, whole closure digest verification, retained immutable native snapshot, closed module bootstrap", + "modelAdmission": "offline-installation-probe is a factory identity sentinel only; no ACP model selection or prompt; model remains unverified" }, "requests": [ {