PaperClipAI/doc/plans/2026-10-28-cursor-cloud-native-runner.md

# Cursor Cloud on native Paperclip Runner — 2026-10-28

Owner: the lead integration agent in this task; delegated owners cover the Cloud
API client and this research/acceptance record. The lead owns integration,
qualification, review, and the final handoff.

Original source baseline: `25f1070fbdabd96b26cdf199e624a77905f3ca37`.
Current qualification checkout branch: `codex/cursor-cloud-qualified-base`.
Target: a reviewable PR with experimental, local-first native Runner support.
Merge, package publication, production rollout, and automatic conversion of
existing agents are separate actions, not completed or implied by this record.

Current delivery: [Runner core PR #18068](https://github.com/paperclipai/paperclip/pull/18068)
and dependent [product PR #18069](https://github.com/paperclipai/paperclip/pull/18069).
Neither PR is merged. Product PR #18069's Verification section owns the latest
candidate, check status and final acceptance decision.

## Hosted placement correction — 2026-10-30

Native Cursor Cloud uses a provider API controller. Cursor hosts the model and
commands; Paperclip runs only its qualified API client and bounded private artifact
stager. This placement has no Paperclip Computer, lease, task checkout or host
provisioning command. It is derived from the validated native Cursor profile and
persisted with the admitted run; recovery retains that backend and placement.
Earlier Cursor profiles retain their admitted workspace binding as identity;
recovery does not reopen that workspace or allocate a Computer. Known backend
and driver contradictions fail closed, while historical missing driver values
remain recoverable.
The generic managed-sandbox-only policy and local Computer denial stay intact.
Kubernetes-only execution remains unsupported in save, Test, inventory and run
admission. An unavailable Computer does not advertise local Legacy execution.
Legacy direct agents retain their existing selection and execution behavior.

Ordinary native setup clears the Computer binding and explains Cursor's hosted
environment. Save/reopen and Test use the same account/configuration contract as
run admission. The Cloud front door must pass the exact authenticated native-run
callback to the tenant; Core still enforces live run authority and per-turn scope.

The ordinary Cloud card is available only with native rollout and a qualified
controller. A server-held new setup draft can use that managed API default before
model selection. It keeps its setup hold and does not inherit another harness's
model or permissions. Unsaved automatic Test uses the advertised native default;
saved Legacy agents still require an explicit conversion.

This correction requires fresh hosted acceptance on its final image. Local and
synthetic checks do not qualify that deployed journey or erase prior failures.

## Review correction checkpoint — 2026-10-29 20:25 UTC

All six original acceptance gates have passed on their recorded candidates;
these results do not establish a pass for subsequent runtime changes.

| Gate | Retained live evidence |
| --- | --- |
| C1 Ordinary setup | Fresh Advanced → Paperclip Runner setup, saved reload and real catalog Test on `27172d6ee899`; saved trial retested on `3f4d92f3751e` |
| C2 Task and C6 artifact | `cursor-cloud-local-20261028-artifact-sonnet-2`, source `b18b743cd45d`, eight strict matchers and exact registered/downloaded bytes; owned remote cleanup confirmed |
| C3 Continuation and C5 replay | `cursor-cloud-local-20261029-followup-sonnet-11`, source `7591c52a8c32`, two runs on one owned Agent, one answered question, one injected stream cut and matching-cursor reconnect, unique ordered events, settled receipts and owned cleanup |
| C4 Active Stop | `cursor-cloud-local-20261029-stop-sonnet-3`, source `27172d6ee899`, independently observed foreground command, ordinary UI Stop, terminal cancellation, 15-second quiet window, zero accounting debt and owned cleanup |

The original failed Stop attempts remain failed: Stop-1 lacked the required
standard final API/screenshot package, and Stop-2 did not complete its observation
window after a status-read timeout. Stop-3 does not establish Stop-2's cause.

Final review corrections cover semantic planning, bounded status-read recovery,
atomic artifact staging and checkpoint acquisition. The planning repair retains
the pinned Paperclip context and tool restrictions while using the Cloud default
harness. Its two separate rejection gates have RED/GREEN proof; 2,390 affected
tests and Core typecheck pass, with an additional real-Rust/private-facade Plan
control. The Cloud driver, checkpoint and artifact suites pass 45, 38 and 15
controls respectively. Completed Product E2E support checks pass 4,905 tests
(two skipped) plus 137 source-contract tests. These are controlled results.

The explicit Cloud suite now also registers the ordinary semantic
`plan-revise-accept` cell. Its oracle requires draft/revision continuity and a
fresh owned session tied to approval of the exact revised confirmation. The
existing same-Agent follow-up oracle remains unchanged. The new Plan cell and a
fresh artifact cell are **unattempted at this checkpoint**, pending final source,
artifact and local-trial readiness. Historical artifact staging byte identity is
invalidated by the staging repair. Preserve the earlier grades and record the
new runtime identities and evidence impact before carrying other passes forward.

The local trial is intentionally stopped during dependency/source refresh; its
database was backed up before the additive upstream migration. No new provider
work has started in this review-correction phase. Existing experimental-model
acknowledgment and unpriced-cost limits still apply. No merge, publication or
deployment is implied.

## Historical pre-qualification snapshot — 2026-10-29

The following is the retained **pre-qualification snapshot**,
with production source `77b423471668d1ad55cbd4b66841d8a2b3acadf9` and Core
`53112a12cbd8d4850ff6d88b9d739f93b49f28f9`. The latest candidate and live
verdict belong in Product PR #18069's Verification section; keep the dated
snapshots here as historical evidence. A later passing attempt never rewrites
an earlier failed grade. Core has a fresh exact-head 5/5 review; current checks
and final live qualification are still pending.

The combined source contains the reviewed asynchronous Cloud authority fix,
safe checkpoint retirement for fresh sessions, ordinary Advanced Runner setup
forwarding, and the reproduced title-editor readiness/navigation fixes. Before
this combined candidate, Product `b0296016d5be` passed recursive typecheck and
build, and `3a4a7c558d73` passed all 1,000 native-session-executor tests.
New focused checks passed: 25 Core checkpoint archive controls; 13 Product
replacement/relay/non-Cloud controls; five relay/artifact cases; 341 UI cases,
then 232 affected editor/detail cases after the cached-route fix; UI typecheck
and token gates; and the unchanged original title-outage browser test. These
are bounded code gates, not complete live acceptance. Build and typecheck the
combined frozen source before another paid attempt.

The saved local trial retains the real private key binding, native Cloud runtime
and explicit Sonnet model. Its earlier save/reload and key/catalog Test passed.
The trial is temporarily paused to isolate the qualification bundle and callback
port. Restore its ordinary idle state, serving candidate and callback listener
after the live campaign, then retest ordinary setup and saved configuration.
Candidate `b18b743cd45d` retains the earlier ordinary task and exact artifact
passes. Continuation, full replay and active Stop remain unqualified at this
snapshot; the next Sonnet-11 attempt has not been activated.

Native create is working again. On 2026-10-29 a bare HTTP control and the unchanged
client plus original observer each returned 201, completed the exact expected
reply, and independently confirmed owned Agent/Run absence after deletion.
The official [Multiple services degraded incident](https://status.x.ai/history?incident=automations%2Fps_d25569b21cabd283)
covered Cloud Agents on 2026-10-28 from 21:15 to 23:13 UTC. The three late failed
minimal controls occurred inside that window. This is the likely explanation
for those HTTP 500 responses; request-level causation remains unproven. No
credential, account, model, SDK, request-schema or header change was needed to
restore successful creation.

The tenth continuation attempt reached a successful first turn, answered its
semantic question, committed a matching interrupted terminal and settled the
explicitly unpriced accounting receipt. Its second local turn failed before a
second native create at the local Runner authority-rotation boundary. The
bounded cold-handoff repair passes real Rust/private-facade checks. The original
failed/cleanup-failure grade remains retained. The next paid attempt requires
exact source/artifact readiness; active Stop remains held until strict
continuation/full replay passes. Both PRs stay draft while gates remain open.

## Release outcome and authority

An operator selects Cursor Cloud in native Runner, saves an API-key binding and
explicit model, assigns an ordinary task, sees real provider activity, and gets
an independently verified result through Paperclip. Cursor executes in its hosted
environment; the first Paperclip controller/Runner acceptance environment is the
local development stack. Local-first does not mean that Cursor's model or tools
execute on the operator's computer.

The user authorized implementation and a reviewable PR. On 2026-10-28 the user
also approved the experimental exception below and selected local-first delivery.
This adds a native integration for a harness already available through the legacy
direct adapter. Preserve that adapter, historical records, and saved runtime
selection. Do not migrate existing agents as a side effect.

**Authorized experimental exception:** the Cloud interface does not acknowledge
the effective model or instruction digest before starting the first prompt.
Proceed with explicit submitted model selection, recorded exact instruction
content/digest, visible experimental treatment, and honest evidence labels.
Do not describe a submitted value or an SDK echo as a native acknowledgment.
This exception does not relax company authorization, semantic-tool policy,
credential isolation, Stop fencing, result acceptance, or existing budget gates.

Native Cursor permission requests, native questions, native plan decisions, and
fixed per-run dollar enforcement are unsupported in this release. Paperclip
semantic tools remain a distinct contract. Cursor-native tools are not governed
by a Paperclip per-command approval callback.

Authentication uses an explicitly bound Cursor user/service-account API key.
Authenticated catalog, repository access and real hosted execution were observed
on 2026-10-28. Task and artifact acceptance passed on the candidate recorded below.
Record binding identifiers only;
never put key values in this plan or evidence. Select the acceptance model from
the real account's catalog and record it before a paid attempt. It is a test
choice, not a product allowlist. No paid calls were made by the research owner.
The user explicitly delegated disposable repository/model selection and approved
the test spend on 2026-10-28. The initial operational reservation was $10 for the
small acceptance cells. The user subsequently delegated proportionate test
spending. Actual spend remains unknown; do not infer it from prompt count or
call the reservation a provider-enforced limit. Each campaign permits one
attempt per cell and no automatic paid retries. This is a planning limit, not a native
Cloud dollar cap: provider cost remains unknown until a billing receipt is
available. Diagnose the first divergence before another paid attempt.

## Architecture and compatibility boundaries

- Provider-owned code owns HTTP v1 requests, SSE decoding/replay, native identity,
  status mapping, model parameters, provider errors, and cancellation.
- Native Runner owns normalized events and the semantic transport. The selected
  design is a Node sidecar behind the existing Rust Codex-style facade, following
  the OpenCode pattern. A public MCP relay forwards to the sidecar-owned Unix
  HTTP bridge, which emits `item/tool/call` through Rust and existing PRP to Core
  authority, then returns the result. Do not add a parallel PRP command. Controlled transport checks and real tools in the recorded C2 candidate
  exercised this bridge. The remaining live cells retain separate gates.
  A cloud VM cannot call the local controller's loopback address. Choose and
  record the relay's authentication, reachability, expiry, and cleanup contract
  before a live run. Do not substitute SDK in-process custom tools: those are
  local-agent functionality.
- The controller remains authoritative for company/run/session identity,
  authorization, audit, revisions, budgets, task completion, and durable effects.
  A replayed or late remote call must pass current source-run authority.
- New provider-neutral shared fields require a concrete consumer and an absent/
  disabled-provider behavior. Keep Cursor payloads and SDK types in provider code.
- Persist the durable Cloud agent ID separately from each Cloud run ID and the
  local Paperclip run/session identity. Recovery must observe the existing run
  before creating paid work. Refresh scoped MCP credentials on continuation.
- Stop must cancel the owned Cloud run, verify provider terminal state, close
  local stream/relay resources, and fence later effects. A local socket close or
  terminal Paperclip row alone does not prove remote work stopped.
- Preserve legacy direct invocations, transcripts, cancellation, and finalization.
  A direct run starts no runnerd process or PRP connection. Visiting/saving an
  existing agent does not change its runtime.
- The first supported controller platform is the actual local host used for
  acceptance; record OS/architecture and installed runtime identity when tested.
  SSH, Daytona, self-hosted Cursor workers, all-platform claims, and fleet rollout
  are outside this campaign. Source execution alone does not prove packaging.

## Research dossier

Research date: 2026-10-28, with a primary-source refresh on 2026-10-29. Public
documentation is mutable; the original inspected shipped SDK is exactly
`@cursor/sdk@1.0.28`. The refresh inspected `@cursor/sdk@1.2.0` and the unchanged
OpenAPI digest below; it found no request-schema or transport change needed
for the observed successful v1 creates. Evidence labels below distinguish
**documented**, **source-observed**, **unverified**, and **product-qualified**.
The dossier describes the inspected provider contract. Authenticated observations
and exact product results are recorded separately in the ledger below.

Official references:

- [Cloud API reference](https://cursor.com/docs/cloud-agent/api/endpoints) and
  [OpenAPI schema](https://cursor.com/docs-static/cloud-agents-openapi.yaml).
- [API authentication and rate limits](https://cursor.com/docs/api).
- [TypeScript SDK](https://cursor.com/docs/sdk/typescript).
- [Cloud environment setup](https://cursor.com/docs/cloud-agent/setup),
  [capabilities](https://cursor.com/docs/cloud-agent/capabilities), and
  [secrets/network](https://cursor.com/docs/cloud-agent/security-network).
- [Local CLI ACP](https://cursor.com/docs/cli/acp), a separate interface.

The Cloud API is v1 public beta: durable agents contain per-prompt runs. Creation
starts work immediately. Follow-ups, steering, SSE, cancellation, artifacts, and
usage have first-class APIs. Replay is run-scoped and retention-bounded. Agent
git state spans runs, so it cannot independently attribute a change to one turn.
The downloaded OpenAPI SHA-256 is
`dd3b836c4e95ad68892274280e53c348619cdd2051988793d2a85e8213d9a489`.
Current prose and schema differ on agent `IDLE` and some newer fields; preserve
unknowns and verify actual responses rather than assuming agreement.

Installed SDK findings, reproducible by inspecting its distributed
`dist/esm/options.d.ts`, `cloud-api-client.d.ts`, and `642.js`:

1. The Cloud run constructor assigns its model from a caller argument. `send()`
   passes the chosen input; a fresh get/list does not. `run.model` and
   `result.model` therefore do not establish provider model admission.
2. Cloud model validation checks catalog membership/aliases and tolerates some
   discovery failures. It is not native model acknowledgment.
3. The status mapper handles `CREATING`/`RUNNING`, `FINISHED`, and `CANCELLED`;
   every other value maps to error. It does not recognize the documented active
   `WAITING_FOR_BACKGROUND_WORK` state. Unmodified reuse is unsafe.
4. This Cloud SDK chunk has no steering implementation. A provider-owned HTTP
   client or a deliberately qualified SDK upgrade must cover the chosen API.
5. Host callback `customTools` are local only; per-send Cloud use is rejected.
   Tool restrictions are also local only. Cloud MCP means a reachable remote
   server or a server process inside the VM.
6. The inspected public Agent/Run API responses have neither an effective-model
   field nor an instruction-digest receipt. There is no pre-prompt admit phase
   or native human-decision response endpoint in that schema.

The SDK chunk SHA-256 is
`67a4eacc8435774d52a1d0f0a2d608c00b7f4f62ffa9cb46fe0b71523304a7bf`.
No workstation path is needed to understand or reproduce these findings: inspect
the published package version and named distribution files.

## Capability inventory

`Required` means part of this release; `Outside` means discovered but not part of
this campaign; `Unsupported` means no product promise. Controlled checks establish
their tested boundary; authenticated observation and product qualification are
distinct evidence levels. Exact candidate identities and failed attempts are
in the ledger. Cloud v1 means the documented API as researched above; SDK means
the exact inspected 1.0.28 package.

| Capability/field | Exact harness/version/mode | Native evidence | Transport/wrapper | Runner mapping | Durable product/UI | Qualification | Loss/reason/next action |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Auth/key identity | Cloud v1 | Authenticated catalog and hosted work observed | Bound Bearer auth | Native admission implemented | Saved secret reference/Test | C1 passed | Required; no credential value in evidence |
| Entitlement/repository access | Cloud v1 | Private fixture access and hosted clone observed | Typed API errors | Actionable admission failure | Reopen/reconnect | C1/C2 passed | Required setup |
| Protocol/version discovery | Cloud v1 beta | Documented; mutable | Strict v1 client and SSE decoder | Versioned driver/launch profile | Diagnostic identity | Controlled checks and live traffic | Retain exact candidate; no provider version negotiation claim |
| Model catalog/parameters | Cloud v1 | Authenticated catalog observed | HTTP discovery and explicit submitted values | No model fallback | Saved model/params | C1 passed; explicit Sonnet submitted live | Qualification model is not an allowlist or effective-model acknowledgment |
| Exact model acknowledgment | Cloud v1 / SDK | Source-observed absent/echo | No receipt | Submitted identity only | Visible experimental limit | Unsupported | Authorized exception |
| Default/Auto routing | Cloud v1 | Documented | Provider routing | Preserve caller choice | No fixed-model claim | Unverified | Outside acceptance model |
| Agent/Plan modes | Cloud v1 | Agent request observed | Always explicit Agent mode | Plan rejected | Agent-only Cloud configuration | Agent observed in C2 | Native Plan decisions unsupported |
| Reasoning/context params | Cloud v1 | Documented catalog shape | Per-model values | Preserve values | Selected configuration | Unverified | Outside required cells |
| Exact instructions on create | Cloud v1 | No digest receipt | Full inline text and submitted digest | Content bound to checkpoint | Experimental limit | Controlled serialization; C2 behavior observed | Native acknowledgment unavailable |
| Instructions on continuation | Cloud v1 | No digest receipt | Current full revision or fixed per-turn control guidance | Active digest changes fenced | Saved current instructions | Controlled revised/unchanged-turn checks | Required C3 remains unqualified |
| Assigned skills | Cloud v1 | Bounded text assets inline | Virtual read-only file bundle | No local path/mount assumption | Submitted instruction bundle | Controlled asset checks | Binary assets, scripts by local path and persistent directory unsupported |
| MCP discovery/execution | Cloud v1 | Authenticated SDK discovery and real tools observed | Scoped HTTPS relay to private Unix bridge | Normal Rust/PRP semantic transport | Authorized Core receipts | C2 passed; real question observed in C3 | Required real tool result |
| MCP refresh/reconnect | Cloud v1 / SDK | Run-scoped inline configuration | Re-supply on every turn | Fresh expiring tool capability | Current source-run authority | Controlled follow-up/revocation checks | Required live C3 remains unqualified |
| Runtime secrets | Cloud v1 | Key and scoped callback auth observed live | Bound auth key and scoped MCP headers only | Reject other selected process variables | Hosted shell secrets configured in Cursor | C1/C2 passed; controlled rejection checks | Hosted envVars unsupported |
| Host callback tools | SDK 1.0.28 Cloud | Source-observed local only | No Cloud callbacks | Use relay | No callback claim | Unverified | Unsupported route |
| Assistant text/boundaries | Cloud v1 | Real SSE and durable PRP rows observed | Typed SSE | Ordered canonical events | Task transcript | C2 passed | Required normal task |
| Thinking visibility | Cloud v1 | Documented event | SSE | Existing visibility policy | Policy-controlled rendering | Unverified | Outside required cells |
| Tool identity/arguments/results | Cloud v1 | Real tool names, statuses and bounded results observed | SSE with stable call identity | Builtin facade; Core raw-argument policy retained | Activity and semantic receipts | C2 passed; controlled projection checks | Native truncation/redaction is not lossless raw capture |
| Tool errors/partial deltas | Cloud v1 | Running frames and argument updates observed | Bounded typed projection | Consistent repeated starts accepted | Native activity and error status | Controlled projection/Stop observer checks | No broader lossless-delta promise |
| Shell output/background work | Cloud v1 / SDK | Native command traffic observed | Active/background status handling | Preserve active wait | Running until terminal proof | Controlled status checks | C4 must observe actual pending command |
| Native permission approval | Cloud v1 | No API callback | Native tools auto-run | No interception | Explicit limitation | Unverified | Unsupported |
| Native question | Cloud v1 | No response contract found | No API callback | None | No supported claim | Unverified | Unsupported |
| Native plan decision | Cloud v1 | No response contract found | No API callback | None | No supported claim | Unverified | Unsupported |
| Semantic tool authorization | Paperclip native | Existing controller contract | Run/session/company/agent/epoch-bound relay | Normal semantic dispatcher | Durable audit/effects | C2 accepted effects; controlled negative/expiry checks | No parallel authorization path |
| Semantic questions/approval/plans | Paperclip native | Separate existing contracts | Normal semantic relay | Structured question delivered | Real browser answer persisted | Question and answer observed in C3 | Complete continuation still unqualified; no native equivalence or broader decision claim |
| Todos/plans/revisions | Cloud v1 | Rich events not qualified | Provider translation | No invented capability | Existing generic surface only | Unverified | Outside required cells |
| Active steering/queue | Cloud v1; SDK absent | Provider API documented | Not exposed by this driver | Descriptor explicitly disables both | No active steering/queue promise | Unsupported in this release | Ordinary follow-up is separate |
| Ordinary follow-up | Cloud v1 | Documented | Existing Agent/new Run | Stable session identity and refreshed callback | Same task continuation | Controlled same-Agent and governed-yield tests | Required C3 awaits live confirmation of the bounded timing repair |
| Interruption/replacement | Cloud v1 | Cancel/new-run primitives | Provider-owned sequencing | Ownership fence | Stop then continue | Unverified | No implicit simultaneous turn |
| Load/resume/history | Cloud v1 | Durable Agent/Run API observed | Exact owned identity lookup | Saved deadline and cursor; durable terminal acknowledgment | Persisted separate Agent/Run IDs | Controlled native crash/recovery checks | Ambiguous follow-up identity remains fenced |
| Fork/compaction | Cloud v1 | Not qualified | No promised route | None promised | None promised | Unverified | Outside/unknown |
| SSE replay | Cloud v1 | Real event IDs and exact cursor reconnect observed | Last-Event-ID | Ordered source-sequence deduplication | Durable event/effect identity | Controlled checks; partial live C5 transport proof | Full C5 requires normal two-turn settlement |
| Expired replay | Cloud v1 | Documented 410 | Exact owned terminal lookup | No new paid prompt; bounded reconciliation | Incomplete history remains explicit | Controlled expired-stream check | No live retention-expiry claim |
| Subagents/children | Cloud v1 | Custom agents documented | Rich identities not qualified | No attachment promise | No invented parent/child UI | Unverified | Outside required cells |
| File edits/diffs | Cloud v1 | Tools/git documented | Provider stream/git snapshot | Activity only until proven | Independent result check | Unverified | Do not trust agent summary |
| Images/inbound media | Cloud v1 | Images documented | Prompt attachment | Bound existing input | No broader media claim | Unverified | Outside required cells |
| Artifacts | Cloud v1 | Native listing and signed download observed | Exact-host HTTPS and bounded bytes | Verified private staging and relative Core reference | Registered/downloadable result | C6 passed; exact 24 bytes/SHA/MIME | Core containment, symlink and hash guards retained |
| Usage/cache/subagent totals | Cloud v1 / SDK | Authenticated token response observed diagnostically | Client usage API available | Quantitative production facade not wired | Usage/cost unknown | Production accounting unsupported | Confirmed terminal closure settles explicitly unpriced; receipt/budget controls pass |
| Settled dollar cost | Current SDK docs | Documented eventual fields | API/schema divergence | Unknown until receipt | No fabricated zero | Unverified | Outside fixed-dollar guarantee |
| Per-run dollar ceiling | Cloud v1 | No enforcement contract | No admitted native cap | Existing budget gates only | Explicit limitation | Unverified | Unsupported |
| Idle/heartbeat/retry behavior | Cloud v1 | Partial documentation | Stream/recovery policy | Bounded activity | Quiet idle state | Unverified | No idle polling loop claim |
| Cancel/terminal status | Cloud v1 | Cancellation and terminal API reads observed | Exact Run cancel plus lookup | Unconfirmed termination stays fenced | Durable cancellation | Cleanup observed; native Stop/recovery controls pass | Required active-work C4 unrun |
| Late callbacks/effects | Paperclip native | Existing authority contract | Expiry/revocation and current actor authority | Fence stopped generation | Stale mutation rejected | Controlled relay/authority checks | C4 still requires bounded live observation |
| Native process/VM cleanup | Cloud v1 | Hosted lifecycle opaque | Delete plus independent exact Agent/Run 404 | No host-PID proof | Exact API absence recorded | Observed after retained campaigns | No physical remote VM cleanup claim |
| Local relay/stream cleanup | New integration | Exact owned process exit observed | Socket close/expiry | Bounded shutdown and receipt acknowledgment | No lingering owned local work | Packaged/native controls and live cleanup | Required C4 still unrun |
| Config/command discovery | Cloud v1 | Limited API inventory | Provider-specific | No arbitrary CLI promise | Normal configuration | Unverified | Outside required cells |

## Finite acceptance ledger

These six cells are the release's ordinary-user denominator. Each live attempt
must name the exact application/Runner commit, dirty state, client/profile
identity, local OS/architecture, provider API contract, credential binding,
model/params/mode, fixture/grader revision, run IDs, cost/reservation, and cleanup.
Keep original failures and new attempts together. A later patch requires an
evidence-impact decision before carrying a prior pass forward.

| Gate | Local-first cell | Required independent observation | Candidate/attempts | Verdict | Next action/owner |
| --- | --- | --- | --- | --- | --- |
| C1 Setup | Fresh configure; save/reopen/Test/reconnect | Correct saved runtime/model/binding; useful credential failure; real account test; no launch merely on read | Served `ed4ef4796586` passed save/reload, explicit Sonnet and real key/catalog Test with only the authorized effective-model acknowledgment warning. Ordinary UI cleared the paused manager. The trial is temporarily paused during the current campaign. The ordinary Advanced Runner mapping is now repaired and controlled; its final browser acceptance remains pending | Passed on recorded saved trial | Restore the final app/callback, complete ordinary setup and reopen/Test; configuration Test does not prove native create succeeds |
| C2 Task delivery | Ordinary task using real semantic tools | Provider activity; exact submitted content; authorized tool result; durable task finish accepted by controller; independently checked output; cleanup | `cursor-cloud-local-20261028-artifact-sonnet-2`, source `b18b743cd45d`, explicit `claude-sonnet-4-5`, all 8 matchers passed; result SHA-256 `eea3414ff54c7de99f4fc533cd4d88d415bc501dc56e95aa73a8c8f7fe09f270`; original failed campaigns retained below | Passed on recorded candidate | Assess pending recovery changes before carrying this pass forward |
| C3 Continuation | Follow-up on existing task/session | Same Cloud agent, distinct Cloud run; current instructions/tool grants; visible reply and durable result without duplicate work | Seven failed live campaigns (1/2/3/4/7/9/10) retain original grades. Attempts 5/6/8 stopped at local infrastructure. Sonnet-10 completed the first turn and accounting settlement but failed local authority rotation before a second native create; the cold-handoff repair passes controlled real-boundary checks. The separate stale-response repair passed 60 Cloud cases, including 14 old-driver red controls | Unqualified | Build and freeze the combined candidate, then one bounded Sonnet-11 attempt; no automatic paid retry |
| C4 Stop | Stop while provider work is actually pending | Cancel exact run; observe provider terminal state; close local resources; later relay calls/replays cannot mutate task; bounded observation recorded | Supporting controlled cancellation and race checks pass; no live active-command Stop has been attempted | Unqualified; live cell unattempted | After C3/full C5 passes, verify real pending command identity before ordinary UI Stop |
| C5 Replay | Disconnect/reconnect and retention expiry | Resume cursor; stable order; no duplicate effect/reply; expired stream reconciles through known run without a new paid prompt | Failed campaigns retain exact cuts/cursors and ordered unique events. Sonnet-10 recorded one cut, matching-cursor 200 reconnect and 61 unique ordered canonical events, but failed before second-turn admission | Partial transport proof; unqualified | Requires normal two-turn completion on the new frozen candidate |
| C6 Artifact | Download provider-produced result | Listed relative artifact; safe retrieval; independently verified bytes; usable Paperclip result access after settlement; cleanup recorded | Same Sonnet-2 result as C2; one registered/downloaded artifact, exact 24-byte fixture and MIME verified; SHA-256 `475af2a29ebe3347d92d24efaa58ee6e50a96c1e25297a4410ea12407aa5c1d9`; exact owned Agent and Run each returned 404 after cleanup | Passed on recorded candidate | Keep the original artifact bytes/receipt and repeat if the output path changes |

Pre-qualification snapshot total: **3 passed on recorded candidates and 3
unqualified of 6 required**. See Product PR #18069 Verification for the later
current verdict. C1 retains its saved-trial candidate; C2/C6 retain their original
candidate identities. C4 has no live attempt. At this snapshot the release was
not qualified.
A user-approved 30-day key now authenticates to the real Cloud model catalog and
is bound privately in the ready local trial. The user approved the callback
tunnel and access to the new private README-only fixture repository. Both are
configured, and a fresh authenticated repository preflight confirms access.
The saved product Test passed after reopening across a controller restart. An
initial Test failure was traced to test-drive intentionally discarding ambient
PAPERCLIP_* routing variables; saving auth.publicBaseUrl in its isolated instance
configuration supplied the callback origin. This was setup repair, with no
production-code change or provider prompt. Task delivery retains its earlier
pre-prompt and hosted failures alongside the passing Sonnet artifact attempt.
The first four continuation attempts retain their original failed grades and
exact owned Agent/Run absence after cleanup or later reconciliation. The fourth
keeps its original cleanup-failure grade. Later blocks and create failures are
recorded separately below. The direct controls and latest cleanup report no
remaining active owned native work. No accepted Run ID existed for the create
500 controls, so no Run lookup or Run-404 evidence was invented.
The original cleanup-uncertainty grades remain retained. Hosted billing is
unknown; no zero-cost claim is made.
No source, simulation, protocol test, or screenshot qualifies a live cell.

Required supporting verification, reported separately from those six cells:

- Credential-free client/driver checks cover status mapping, SSE chunking and
  duplicates, transient errors, unavailable features, cancellation races, unknown
  usage, replay expiry, and malformed provider data. They must exercise the
  selected implementation rather than mirror its internals.
- Semantic relay checks prove source-run/company binding, denied operations,
  credential expiry/revocation, tool-result delivery, and no late mutation.
- Focused regressions preserve legacy Cursor Cloud and another existing native
  provider, with absent/disabled integration behavior.
- Exercise the clean installed package/runtime resolution used by the local
  release. Record actual installed artifacts and dependencies. A source checkout
  or startup probe alone is insufficient.
- Before PR-ready handoff run `pnpm -r typecheck`, `pnpm test:run`, and
  `pnpm build`; report any unrun checks precisely. Run relevant token/map/catalog
  checks if those owned surfaces change. Follow the repository PR template and
  resolve applicable review feedback.

## Resumable state and next gate

| Item | Verified state | Owner | Exact next action |
| --- | --- | --- | --- |
| Research | Official docs and original SDK 1.0.28 inspected; SDK 1.2.0/OpenAPI refresh on October 29 confirms unchanged successful v1 requests | Research owner | Keep original and refreshed findings tied to their evidence dates |
| Experimental exception | User-approved 2026-10-28 | Lead | Preserve honest admission/cost limits in product and PR |
| API client | Implemented by client owner; supporting controlled wire proof reported separately | Client owner | Preserve exact pinned contract and run live acceptance |
| Native driver/semantic relay | Earlier real C2 tools passed; current cold-handoff repair passes real Rust/private-facade tests. Generation/authority fencing now passes 60 Cloud controls | Lead | Build and freeze the combined exact artifact identity |
| Credentials/model/budget | Real key privately bound; catalog/repository access and hosted execution observed; scoped tunnel approved; cost unknown | Lead | Preserve explicit model and owned cleanup for each paid attempt |
| Candidate/evidence | Production source `77b423471668`, Core `53112a12cbd8`; controlled repair gates above pass. Final combined build, current CI and live gates remain pending at this snapshot; both PRs draft | Lead | Freeze exact source/artifacts, run C3/full C5 then C4, prove private package closure and restore the trial; record the current ledger in Product PR Verification |

Native create is available again under unchanged requests. The remaining gates
are exact-candidate artifact readiness, continuation/full replay, active
Stop, current private package proof and the saved local trial restoration.
Latest-head CI must also be green. A generic retained-Codex replay ACK test has
an unchanged local failure; its bounded investigation is recorded below and
must not be silently relabeled as passing.
Each paid task must be small, have a known output,
retain run/evidence identity, and have cleanup already wired. Diagnose the first
divergence before another paid attempt. Record active jobs and cleanup obligations
here before interruption; there are no active provider jobs recorded by the
research owner.

The driver-owned supporting check used the real sidecar stdio, Cloud HTTP/SSE
client with a controlled peer, private Unix MCP bridge, and exact accepted Core
tool result. It covers fresh creation, same-Agent follow-up, a revised idle
instruction bundle delivered once, unchanged follow-up without repeated bundle,
strict active recovery identity, replay cursor deduplication, initialized MCP
session isolation, ambiguous initial-create recovery without another prompt,
Stop cancellation plus native terminal lookup, killed-owner stale-socket
recovery through the actual initialized driver under umask 022, persisted
absolute deadline cleanup, expired relay rejection before
mutation, provider-owned artifact discovery, verified artifact bytes, and
reconciliation HTTP 401/403/404/422 preserving uncertain initial-create identity.
The final local command ran the four driver/asset/artifact/proxy test files with
default Vitest deadlines; all 26 passed in 4.18 seconds. The proxy fixture uses
explicit bounded five-second readiness waits. Earlier attempts had four
default-five-second test timeouts and one default-one-second readiness timeout
during host contention; they remain failed supporting attempts, and no
production or repository-wide test timeout was increased. Client token usage
retrieval exists, but the production facade does not deliver those receipts, so
its descriptor marks production usage accounting unsupported and the UI must
retain unknown usage/cost. A follow-up whose HTTP response loses the native Run
identity remains deliberately fenced: it is not retried or cancelled by guessing
an Agent's unrelated latest Run. This limitation needs explicit live evidence or
an improved provider identity contract before stronger recovery claims.

## Local milestone evidence — 2026-10-28

Entries below retain earlier state and pending decisions at each milestone.
The ledger above is the dated pre-qualification snapshot; the later current
release decision is recorded in Product PR #18069 Verification.

### Native create recovery and local cold handoff — 2026-10-29

The independent bare HTTP control returned 201/FINISHED with the exact expected
31-byte reply. The paired original client/observer control did the same. Both
had independently verified owned Agent and Run 404 responses after cleanup.
Their comparison receipt SHA-256 is
`4991f87568eb2619277ba062bb9b1c27d16eb5425edcf78e736e17b24d6e6d07`.
The official incident window and these unchanged successful requests support a
service-outage explanation for the earlier late 500 responses, without proving
a request-level vendor root cause. Usage and cost remain unknown.

Sonnet-10 on source `f7bfb75f794a567175d9938d2c8c0ad4dea4669a` reached
first-turn success, one applied question answer, the matching canonical
interrupted terminal and accounting-ready receipt sequence 4. The second local
turn failed at `native_runner_prp_run_rotation_unavailable` before a second
native create. One SSE cut and matching-cursor reconnect returned 200; 61 unique
canonical events stayed ordered. The original FAIL/cleanup_failure result is
retained with SHA-256
`963c331d5061836560774d8ffc06d82a42d2c3a4ae2b9324e7ff9e9d89b3b2ff`.
Later exact owned Agent/Run lookups returned 404; all six owned local process
identities exited, the fixture PostgreSQL stopped and the callback port was
released. Reconciliation does not rewrite the original grade.

Repair `45ab2610fa7d1d2f9731cd88dcacb87e4c32c222` admits locally owned
Cloud cold authority rotation separately from warm recovery. The new authority
refreshes current instructions; same-authority recovery retains the admitted
instructions. The Rust backend accepts that changed Cloud instruction field
only after confirmed owned shutdown and a freshly validated receipt have
atomically persisted durable prepared state. Every other provider-profile field
remains exactly compared; ambiguous stop, foreign ownership and retained ACK
debt stay fenced. Real Rust/private-facade cases verify distinct per-turn process
and Run identity with the same Agent, fresh relay/tool grants and exact
instruction serialization. The final merged candidate passed 9 facade cases,
14 existing transport controls, 12 Cloud Rust and 7 native Cloud cases, and 107
profile/history controls. Published identity bytes remain unchanged; new current
identities account for the changed bound source inputs.

One generic retained bare-Codex replay case failed at the existing two-second
old-authority ACK fence (`native_cleanup_maintenance_unproven`); its cohort was
18/19. The unchanged isolated case also failed using a pristine upstream Rust
binary with the merged controller. Selected controller ACK and maintenance code
is byte-identical to upstream. That mixed-controller experiment does not prove
a full pristine baseline, and an instrumented diagnostic pass does not replace
the unchanged failure. No timeout, guard, oracle or skip was changed. Generic
ACK latency work is deferred; local verification remains nongreen for that
case and latest-head CI is required.

The Product `3a4a7c558d73` title-editor CI failure occurred after a successful
heading click and before the first textarea fill. No outage or persistence
assertion ran. Seven relevant source paths match pinned upstream; a loading
readiness remount is a hypothesis awaiting deterministic reproduction. The
separate Core review race allowed a delayed old native read to settle a newer
turn. Repair `9283dcdb3207` passed 60 Cloud tests, including 14 controls that
independently failed against the original driver. Captured logical/native
authority fences launch, reads, stream output, errors and Stop. Controlled
passes do not substitute for current live qualification.

### Reviewed setup, fresh replacement and editor repairs — 2026-10-29

Core `53112a12cbd8` adds the checkpoint owner's archive helper through the
existing vendor boundary. It acquires the existing exclusive lock, validates the
exact binding/session/owner and admits only pristine idle or confirmed terminal
state with no pending create, deadline or terminal ACK debt. It archives only
the exact checkpoint and durably syncs the destination chain. Live ownership,
foreign/corrupt/missing or ambiguous state stays fenced. All 25 filesystem and
lock controls passed; directory durability and pristine-history audit gaps were
repaired before the commit. Published provider identities remain unchanged.

Product `9550dc119d` calls that helper before moving generic continuity state.
The real-driver server regression first failed with the original checkpoint
already-exists error, then passed with exact old checkpoint preservation and a
fresh Core session open. The 13-case cohort covers positive replacement,
active/foreign/unacknowledged/live-owner refusal, relay cleanup and non-Cloud
compatibility; five relay/artifact cases and direct server typecheck also passed.
No PostgreSQL or real provider was used for these controls.

Product `5d16e75d84` forwards ordinary Cursor Cloud Advanced Runner selection to
both Run Test and Finish setup. Its regression first observed the missing
Runner field. The same commit retains the active loading title editor until
editing actually ends, using the existing InlineEditor editing callback for
single-line edits. The unchanged Product and pinned upstream UI both reproduced
the original editor replacement before the fix. The repaired actual-hook case
retained the same connected/focused input and saved through the ordinary path.
All 341 affected UI cases, UI typecheck and token gates passed. The unchanged
browser case then edited a title through a simulated outage, recovered its write
and preserved it on reload: 1/1 passed, 5.6 seconds, no retry. The initial command
collected zero tests because of an anchored title filter; that harness failure
is retained separately and is not a browser-test pass.

Product `77b4234716` keys the early editor by issue. A separate red regression
proved that navigation from actively edited A to cached B while preferences
were pending reused A's input. The fixed case retires A, preserves B's own
input/focus/draft through readiness and keeps A's stored draft separate, with no
save on cancellation. The two affected files passed 232 tests, UI typecheck and
token gates. The earlier unchanged browser pass retains its original patch
identity; this later edit changes only cross-task editor lifetime.

Earlier Core `314b9a2cc894` CI failed because a Rust integration constructor
omitted the new optional launch-profile field. The separate test-only None fix
passed workspace test compilation and the integration case, and Core `9283`
Rust CI passed. Core `9283` also retained an unclassified decision-expiry timing
failure (nextWakeAt 90 seconds earlier; 2,092 passed, one failed, four skipped).
Product `b029` retained an E2E failure after a verified first continuation when
the reloaded conversation was still loading; the later always-allow scenario
never ran. Do not silently call these old failures green or infer a cause.
Require the final exact-head checks and reviews.

### Final local handoff and unresolved native create — 2026-10-28

All later campaigns and direct controls below pin served source
`ed4ef4796586723c47ba39cc4e0620dc489e4123`. Product code
`146376c108f82c4130cabd112d6566a5f44b453a` has identical production, Runner and
README bytes. Its only other differences are four test-only chat brief fixture
files. Those files do not change the Cloud live definition or runtime inputs.
A deterministic partial-write regression first failed, then atomic publication
at every brief writer passed. Full credential-free support passed 4,725 tests
with two skipped, plus 137 Node checks. E2E typecheck passed. Full recursive
typecheck passed at merged code `e1aeeaa2e4`; the later fixture-only change was
covered by the E2E typecheck. Current Core and Product code CI/review passed;
this final documentation update still needs its own latest-head gates.

The separate older full repository test run was stopped at its exact owned
coordinator after about 2 hours 35 minutes, with exit 130 and known failures.
It remains partial and not green. The host had exhausted its System V semaphore
capacity. That fact does not establish the cause of every earlier test failure.
No unaffected local suite was rerun for this documentation update.

| Later campaign | First measured boundary | Native work and retained grade |
| --- | --- | --- |
| Sonnet-5 | Local package-manager resolution | No fixture/native job admitted; no canonical live result. Retain the local tooling block |
| Sonnet-6 | Sandboxed tsx IPC listener denied | No fixture/native job admitted; no canonical live result. Retain the local tooling block |
| Sonnet-7 | One native create POST returned HTTP 500; exact proposed Agent GET returned 404 | No accepted Run, question, SSE stream or cut. Original candidate-failure result retained; cleanup passed after ordinary Board intervention |
| Sonnet-8 | Embedded PostgreSQL initdb exited 1 while host semaphore capacity was 87,381/87,381 across 5,140 sets | Zero native requests. Keep the original failed/cleanup-failure grade despite later local retirement; the exact failing syscall stderr was not retained |
| Sonnet-9 | One native create POST returned HTTP 500 after host recovery; exact proposed Agent GET returned 404 | No accepted Run, question, SSE stream or cut. Original candidate-failure result retained; cleanup passed after ordinary Board intervention |

Canonical result SHA-256 values remain:

- Sonnet-7: `d39a52de698ed89289d78ac598edaa645c03cba2b99aac3517feaf817d8e3671`.
- Sonnet-8: `847c7d6732b70a20b31c47ee6d23b0032e2c02399050769e12ae82d63cf63907`.
- Sonnet-9: `bc8b717e6c24645301354edb63b364c57a0e129604d627e2d96d6cc87a8bf723`.

The 500 campaigns do not test the repaired terminal accounting or cancellation
composition. Their capture remains pending without a matching committed
terminal. Vendor usage and dollar cost remain unknown, not measured zero.
Each create was issued once. No automatic paid mutation retry occurred.

Three minimal native controls omitted MCP. Bearer and Basic auth each returned
HTTP 200 from `/v1/me` for the same hashed user and key metadata. Sonnet minimal
create returned HTTP 500 under both schemes. A catalog-supported
`gpt-5.4-mini` Bearer control also returned 500, with a generic provider message
and no provider error code. Its create response arrived in about 7.23 seconds;
the exact proposed Agent lookup returned 404 in about 0.25 seconds. Request
metadata matched except for fresh ownership identity and selected model.
All three direct controls had one create POST, no cancel or DELETE, no
mutation retry, no accepted Run identity and no remaining active owned work.
No Run lookup was fabricated when the provider supplied no Run identity.

These controls show that the failure persists without Paperclip MCP, across
both successful authentication schemes, and across Sonnet and the selected
Mini model. They do not identify an account, repository, entitlement,
provisioning or service root cause. Read-only account UI inspection showed a
connected GitHub account and no visible blocking notice; it supplied neither a
confirmed cause nor a campaign billing receipt. No account setting or payment
was changed. No additional native creates are planned.

| Diagnostic evidence | SHA-256 |
| --- | --- |
| Same-identity auth/create comparison | `75fb7a722f9593c464dba4dd19b8299c644c0cd88d1a9eb8558edde1451a1bd1` |
| Minimal Sonnet Bearer control | `da538d42435d2fdbaa8609c0e081996f321df536245942feae369f9e3ca9e599` |
| Minimal Sonnet Basic control | `0f58432420baae4017ed34b686e80a6414ba58a0f47ea1c873205513c6d2fcee` |
| Minimal Mini Bearer control | `546a36f418f15eb403e31876f3b920d31eb80529af35d05a027dabb512c11a59` |
| Sonnet/Mini comparison | `5223faf425827ab4cefdd1a7cca739f35ba84538b73ed4eb6db36491ba8d0453` |

Final ordinary UI verification retained the explicit native Cloud/Sonnet and
private secret binding across save/reload, then passed the real no-prompt
key/catalog Test. The only warning was the user-approved lack of independent
effective-model acknowledgment. Clearing the paused manager through the UI
persisted `reportsTo: null`; the trial is idle and server health/recovery are
ready. Temporary plaintext credential material was removed after the encrypted
secret and real Test were validated; the valid 30-day binding remains available.
The private local app and separate callback listener remain running for the
user's test drive. No callback exposure of the board or general API was added:
public root and API probes returned 404, unauthenticated callback POST returned
401, and callback GET returned 405 with `Allow: POST`.

The final sanitized trial-state receipt has SHA-256
`a66701bc674e43bc0150b233c7ae962d32437f19823b0c21df82aec82e40f5a6`.
The private screenshot shown to the user has SHA-256
`e38c7e65561e333b1b9237c92fbdca6ce6c919bdcf9512c7936342189434b93e`.
Neither a ready configuration Test nor this screenshot qualifies C3/C5/C4.

The latest private Runner archive and compiled-consumer proofs passed on the
recorded macOS arm64 host with Node 26.4.0. The tarball has 1,696 entries,
14,031,063 bytes and no bundled `node_modules` or symlinks. Extracted stdio/Unix
MCP checks exercised a synthetic accepted tool result, terminal retention and
ACK, clean exit and socket removal. The separate compiled consumer loaded 175
modules inside its extracted closure and made zero parent or child provider
requests; no turn was submitted. These prove the tested private package
closure, not ordinary public installation or live Cloud acceptance.

| Current package/runtime artifact | SHA-256 |
| --- | --- |
| Private Runner archive | `eb7fbb3d65752de71bbc29f411e5d2c62904184134fdfe3a3b8791cb30901d7c` |
| Local daemon | `519ca52449ec584311107460f155d6b951272001447e15e9a4ac1790989463cc` |
| Cloud CJS proxy | `15e1c48df44e4e3bc48eb8814430cf2e37c800c4c4c8c00915bee8a8b8fe8c23` |
| Cloud ESM proxy | `1a1c92e3985f2af42baff74a6f30e08075709980289f1c1b595fd902acf16eeb` |
| Full compiled transport | `be516371bbd21d7f3a0b4d16713166b43e02b22bf67d67823bedd3ce52dc9590` |
| Compiled 175-module closure | `d65d92fe16a8486e7468b60a4ffa75b504b1eb6fa2ca2d56d31ab9151e1133f5` |
| Observed 26-file Node dynamic closure | `ce8e6d8d7e9845600a853d7d675810268c29126b6deaafdcc1337a4213c05c48` |

Node is still an operator-supplied observed host runtime, not a newly bundled
or pinned release distribution. The archive proof report has SHA-256
`a1aecad1bbf8054aa86006251d8ac606a4f2eed33b0265bdee225bc13dbbe20a`;
the compiled-consumer report has SHA-256
`89f8fa290e840439707df57311cfdd5cd4a89fddb323de6f1b9afa3160d3017e`.
Earlier archive identities below remain historical. Source, package, CI and
controlled proof do not replace the three unqualified live gates. No merge,
public package publication or production rollout was performed.

### Earlier controlled repair evidence

The controlled reproduction separated transport delivery from the governed-wait
deadline. Actual Rust/private Node proxy cases delivered the applied question
response and canonical interrupted terminal with both immediate and 18-second
cancellation, without a Stop command. The same real backend under
`executeNativeSession` passed immediate cancellation but failed the 18-second
case at `governed_wait_provider_terminal_unproven`. Cloud permits 20 seconds
for cancellation; the generic governed drain allowed 15 seconds.

Core repair `9c54295c5060` adds a trusted, optional terminal-drain bound to the
existing cancellation result. The Cloud backend supplies 30 seconds from its
20-second cancellation budget plus handoff margin. Other providers retain the
15-second default. The runtime validates the bound, preserves the existing
operation cap and consumption-owner abort, and still requires the matching
canonical terminal. The same real governed case now passes at both delays.
Fourteen negative, default, operation-cap and recovery controls, 326 affected
unit cases and eight bundle/Grok checks passed. Missing, foreign and explicitly
unconfirmed terminal evidence still fails. No accounting or budget fence changed.
Copilot advances to immutable v73 because shared identity inputs changed; v72
bytes and decoding are preserved. Grok v8 bytes are unchanged. This asserts no
new Copilot or Grok live qualification. Fresh Core review and CI are required.

Old Product head `3115d0bf2c` also failed its Copilot v71 source attestation and
the two already-repaired Cloud launch fixtures. One browser test copied whole
page text instead of YAML. Its unchanged isolated case passed, then its complete
six-case browser file passed on the aligned Product source. The original CI
failure remains retained and its cause is unclassified; new-head CI is still
required. No speculative UI or browser-test edit was made.

The fourth continuation campaign used clean source `de3c7d6b6c27`, with the
same explicit Sonnet selection, omitted parameters, fixture repository/ref,
allow-unpriced opt-in, deadlines and zero automatic retries. Full build passed
and its build stamp matched the source. All source and test files matched
Product `cacb45fd5bfd`; only this qualification document differed. The Runner
package source and exact CJS/daemon bytes were unchanged from the previous
packaged proof.

The exact question tool was applied. An interrupt command was issued, followed
by a Stop command issued about 15 seconds later. Those command timestamps do
not establish completion times or a fast interrupt acknowledgment. The exact
native stop receipt records `providerExitConfirmed: true`, `remoteStopped: true`
and status `FINISHED`.
The matching Node checkpoint retained its interrupted terminal-delivery batch.
No canonical turn terminal reached Core before the governed-wait drain failed.
The checkpoint's later last-write time is not asserted to be terminal creation
time. The 15-second drain and 20-second Cloud cancellation bounds require a
controlled composition check; the live timing alone does not prove its cause.
This is a candidate terminal-handoff divergence; it is not evidence of a
provider provisioning failure. No eligible replay frame was cut, no answer or
second run completed, and C4 remained on hold. Missing canonical evidence
correctly leaves accounting pending; do not weaken that boundary.

The ordinary result remains FAIL/cleanup_failure, SHA-256
`2965928841f50408cc07eb705c9a785680acf2a106735a37ab9a9f1a4f3536f7`.
Its original cleanup could not confirm deletion. Later independent exact owned
Agent/Run lookups both returned 404. That reconciliation does not replace the
original grade. The wrapper restored the exact original CJS and released the
callback port and source/dist freeze. No further paid work is active.

Before that attempt, the accounting repair passed ten focused tests, including
nine scenarios through the actual PostgreSQL receipt, ledger and budget path.
Matching completed and interrupted terminals settle as complete and explicitly
unpriced, with no fabricated counters or zero dollar cost. Allow-unpriced
permits the next reservation only after ledger settlement; block still blocks.
Missing, foreign and explicitly unconfirmed terminals, capture failures and
replaced recorders retain pending debt. Saved canonical evidence also restores
collection closure on recovery. Generic receipt, ledger and budget code is
unchanged. Full recursive typecheck passed at Product `cacb45fd5bfd`.

The third continuation campaign on `69edecfd84ae` saved and independently
verified explicit allow-unpriced policies before dispatch. It discovered the
correct MCP server, created the exact structured question and received the
browser answer. The committed matching `turn.interrupted` carried
`error: null` and `status: interrupted`; native cancellation was confirmed and
the exact owned Node process had exited. Nevertheless, Core emitted incomplete
Cursor accounting because numeric usage was absent. The run remained pending
with no accounting receipt, and the normal budget gate paused the company.
The original ordinary result is FAIL/candidate_failure, SHA-256
`0326c611f99557fbcd0fb6dcda6bacdbcda6f4fe8079189abef2f0cd748d9596`.
Cleanup passed; independent final Agent/Run reads returned 404, the exact
shipping CJS was restored and the callback port was released. One real cut and
cursor reconnect occurred, but no second run completed, so C3/C5 remain
unqualified and C4 is unattempted.

This is an accounting-producer defect. A confirmed matching committed terminal
must close collection as explicitly unpriced when Cursor supplies no numeric
usage. Missing or mismatched terminals, explicitly unconfirmed provider
termination and capture failures must remain pending. Receipt, ledger and
budget enforcement retain their existing contracts. Prove these boundaries
through the actual accounting path before another paid campaign; do not mutate
the failed measured company to bypass its pending incident.

The second continuation campaign on `9683ba4678ee` found the run-bound catalog,
created the required structured question and received the real browser answer.
Its next run could not enqueue because the fixture company and agent policies
blocked unpriced usage. A budget incident paused the company after the first
unknown-cost turn; retrying the response could not bypass that policy. The
original result remains FAIL/candidate_failure, SHA-256
`1dfdd92bef4e69dd09bfde0eb7294f219d5a8bfd8e9803b4e747c2e33791aa93`.
Cleanup passed and exact owned Agent/Run each returned 404. The original CJS was
restored. C5 again exercised a real cut/reconnect, but no second turn completed.

This is a qualification-policy mismatch, not a reason to change production
budget enforcement. The bounded fixtures now require explicit
`PAPERCLIP_CURSOR_CLOUD_ALLOW_UNPRICED_QUALIFICATION=1`, upsert only their owned
company and agent monthly billed-cent policies, and verify both saved policies
before dispatch. Each remains active with a 1,000-cent known-cost hard stop;
unknown pricing is explicitly allowed under the user's test-spending approval.
It is not a provider dollar cap. Cost reporting remains unknown. Missing opt-in,
failed readback and changed guards block setup. The red controls, 71 passing
fixture/registration cases, 19 strengthened budget controls and full E2E
typecheck are retained. No production default changed. The separate saved local
trial received the same explicit policy through the public API and verified
readback; its actual vendor cost remains unknown.

Only fixture policy/evidence changed after `9683ba4678ee`; the model prompt,
provider CJS and native daemon are unchanged. Retain all prior grades at their
original definition hashes and run a fresh company/Agent campaign. Do not
unpause the failed measured company or relabel its result.

The first live continuation/replay campaign failed its required question on
`62fb0252e931`. Cursor queried unrelated inherited account MCP namespaces, both
requiring authentication, and never selected the injected `paperclip` server.
It then ended with objective unsatisfied and no structured question. The
ordinary fixture retained its failed grade and cleanup passed; exact Agent/Run
reads returned 404. No second run or Stop attempt occurred. One real SSE cut
reconnected to the same owned run using the exact cursor, with ordered unique
retained events, but this does not pass the complete C3/C5 contract. Original
CJS bytes were restored after finalization.

Code and retained C2 traffic identify a product guidance gap. The request names
the injected server, but model-facing instructions did not identify it. C2
found it by a broad tool search; C3 selected similarly named account servers.
Neither unrelated name comes from the repository, and the current semantic
question tool remains available. [Cursor's SDK documentation](https://cursor.com/docs/sdk/typescript)
confirms that Cloud also loads account/team MCP servers; local setting-source
filters do not apply. The repair now binds one provider server-name constant,
directs discovery to that server on every turn, distinguishes semantic questions
from native callbacks, and explains controller-managed authentication without
VM REST credentials. Two serialized-request regressions first failed; all 46
Cloud cases then passed. This is a supported correction hypothesis, not a claim
that model causality has been proved. Keep the outcome oracle unchanged and use
a fresh campaign because active checkpoints reject instruction-digest changes.

Core CI also exposed a real Copilot source-attestation mismatch after shared
bridge/contract changes. The immutable identity advanced to v72 while preserving
the original v71 bytes and decoder. Eighty-six identity/compatibility controls
passed. This refresh does not assert a new Copilot live qualification. The final
Core source has a green full build, 436 selected TypeScript cases, 33 native
backend integrations and eight bundle/profile checks; fresh remote gates for
that source remain pending. Earlier Copilot CI and local failures stay retained.

A further recovery race was reproduced during review: the native run could
finish between two startup reads, causing Rust to reject the valid terminal
batch against an older active-turn cache. The repair validates active state and
terminal delivery from one snapshot and updates the cache only after validation.
The proxy likewise returns one captured state view after the queued checkpoint
commit. Both native and proxy red controls reproduced the mismatch; all 33
native integrations and 46 Cloud/facade cases then passed. A paused-write test
also proves thread/read cannot return the random terminal receipt before it is
durable: the response stays blocked while disk remains running, then returns
the exact receipt found in the committed checkpoint. Preserve these controls
and the earlier review grades; a new review is still required for this repair.

The saved local test-drive was restarted on `abb79acfb016` and returned healthy.
The ordinary UI retained the explicit Sonnet model and organization-secret
reference, passed the account/catalog Test with its expected experimental
warning, and completed Finish setup. Independent API state confirms
`paperclip_runner`, provider `cursor_cloud`, model `claude-sonnet-4-5`,
`secret_ref`, lifecycle `ready` and idle status. Setup sent no provider prompt.
The callback-only tunnel again returned 404 for root/API and 401 for an
unauthenticated native-run request. This validates C1's saved setup on the
repaired application; the later Stop receipt repair changes no setup behavior.

Final inspection found one related Stop receipt gap: shutdown could close Node
before Rust consumed its retained terminal batch, blocking a later same-Agent
turn. Retained Node/Rust red controls reproduced it. The repair retains the
batch through the shutdown receipt, persists and acknowledges it before process
exit, avoids double settlement, and retries a matching receipt on attachment.
All 33 native backend integrations and 46 controlled Cloud/proxy/facade cases
passed, as did Node typecheck and unchanged Grok v8 identity. The complete
repaired candidate must be rebuilt before the remaining live cells.

Both recovery findings now have retained red/green controls. Recovery arms the
saved absolute deadline before any read, retries only transient read failures
under that obligation, and aborts pending reads during Stop. Terminal delivery
is persisted privately before publication. Rust imports and deduplicates that
delivery into its durable outbox, saves the receipt, then acknowledges the Node
checkpoint. New work cannot supersede unacknowledged terminal delivery. The
actual Rust regression reproduced the lost-turn failure and then passed crash
before final delivery and partial final delivery with lost acknowledgment. All
32 native backend integrations and 362 selected TypeScript cases passed. Node
typecheck and the existing Grok v8 immutable identity passed; no Grok identity
refresh or new Grok live qualification is asserted.

The selected CI launch fixture now builds a private proxy, because that lane
does not contain a shared dist bundle. Its missing-dist failure and two passing
real-facade controls are retained. The product test roots also preserve short
Darwin socket paths while using the platform temporary directory elsewhere.
Stop qualification now observes the exact native delayed command, joins its
identity to an unfinished Core execution, and checks again immediately before
UI Stop. Retained native traffic showed argument-free running frames followed
by running argument updates for the same call. The observer accepts consistent
updates and rejects completion, changed ownership, stream loss and expiry.
Its original failures and 73 passing focused controls remain recorded.

Evidence impact: the recovery repair changes terminal settlement and the Rust
artifact identity. Rebuild and qualify final settlement through the remaining
two-turn continuation cell. It does not change provider artifact discovery,
download, staging, Core file verification or registration, so retain C6's exact
Sonnet-2 artifact evidence. C2 keeps its original candidate identity; do not
relabel that result as a new run. The Stop prompt and observer changed, so only
the new fixture can establish C4. No live replay or Stop pass exists yet.

`cursor-cloud-local-20261028-artifact-sonnet-2` passed on source `b18b743cd45d`.
The same explicit Sonnet model, omitted parameters, repository/ref, fixture and
deadlines were used after the path repair. All eight ordinary matchers passed:
continuity, exact final marker, task done, run succeeded, native/local execution,
exact registered artifact bytes and MIME, and cleanup. Independent saved state
contains one accepted result with objective satisfied and one registered,
downloadable 24-byte artifact. Its SHA-256 is
`475af2a29ebe3347d92d24efaa58ee6e50a96c1e25297a4410ea12407aa5c1d9`.
The exact owned Cloud Agent and Run each returned 404 after cleanup. The
canonical result SHA-256 is
`eea3414ff54c7de99f4fc533cd4d88d415bc501dc56e95aa73a8c8f7fe09f270`.
This passes C2/C6 for this candidate; vendor cost remains unknown.

The production stager now returns a path relative to the admitted artifact root
for both fresh and repeated staging. The provider's 33 focused controls passed.
The product regression first reproduced the exact rejection through the actual
Core file reader, then passed normal/repeated handoff and post-staging hash
tamper rejection. A static test import initially failed the server TypeScript
root boundary and emitted eight unwanted source-side files. Only those
untracked emitted files were removed; the established dynamic test import fixed
the compile boundary. Full builds then passed in both the serving checkout and
the independent Product PR checkout. The latter also passed full workspace
typecheck, 1,085 focused tests across 18 files, 46 E2E support tests, token gates
and map gates. These do not replace the unresolved full test gate.

The repaired CJS proxy is
`dbb219296765add55e7568c4494885f64b9ca5cd7a09128247929995a5e20aa6`.
Its 1,696-entry private tarball (14,012,533 bytes) has SHA-256
`b25e463011ab6cab7c2b2d9dd53c1b91422025441ab68a66ed0a03880731e551`.
The controlled extracted-package protocol and shutdown proof passed. A first
parity check used the wrong working directory, changing esbuild's source labels;
the unchanged check from the canonical package build directory matched both
shipped bundles exactly. No runtime bytes changed during the live attempt.

Core review at this stage scored 3/5 and identified two recovery defects:
terminal checkpoint persistence can precede durable delivery of terminal events,
and recovery reads can fail before the saved absolute deadline is armed. The
Core owner is repairing both with regressions. Continuation/replay and Stop are
held until the repaired candidate is built and its evidence impact is recorded.
Diagnose any new divergence before another paid attempt.

Campaign 5 (`8e4c587102`, explicit `gpt-5.4-mini`) created the exact expected
24-byte file, but native artifact download metadata was rejected before Core
registration. A separate small native diagnostic observed the actual signed
download host, `agent-stores.s3.us-east-1.amazonaws.com`, and independently
verified six expected bytes. The client now accepts that exact host, retaining
the existing HTTPS and bounded-download restrictions. The original red host
regression and failed product grade remain retained. Both owned native Agent
and Run were independently absent after cleanup.

Campaign 6 (`3050fa41a933`, same Mini model) independently downloaded and verified
the expected native file. Cursor made no semantic task calls and ended with
Paperclip requiring review. The ordinary 600-second fixture deadline graded
the attempt FAIL; its cleanup matcher passed and exact owned native Agent/Run
lookups returned 404. File creation/download alone does not pass C2 or C6.

One explicit model control uses the same runtime, fixture, repository and
deadlines with catalog model `claude-sonnet-4-5`, omitting model parameters.
Official MCP SDK discovery observed 56 tools through the exact owned callback,
including completion, artifact discovery and registration, without invoking a
task tool. Sonnet called the semantic tools and supplied correct file metadata.
The downloaded and staged 24 bytes match the fixture, but Core rejected the
absolute staged reference with `paperclip_runner_file_handoff_path_denied`.
The provider stager must return a reference relative to its admitted artifact
root; Core's existing containment, symlink and hash checks remain authoritative.
This is an observed integration defect. Preserve the original campaign result
and run a real stage-to-Core regression before a new hosted attempt.

The current clean private Runner tarball has 1,696 entries, 14,012,523 bytes,
and SHA-256 `bd7b95a988f2ebebdc4fe2e52f19638d4cfb825d3538b89405c1f861e46818e3`.
Its CJS proxy is `fd6ab6b82b66e5b9bd1a60f70ddca34b7fb44d24c21827c77376931afa52640d`;
its daemon is `ba78c864a2a688e53d82e26a2c048ad1ab803c4715c1b847324e84a074deffec`.
After installing only the declared selected dependency closure in an extracted
consumer, the actual compiled transport, Rust daemon and guarded Node proxy
opened and closed successfully: 175 loaded modules remained inside that
consumer, no vendor request occurred, exit was zero and the owned socket was
removed. A sandboxed listener attempt failed with EPERM; the unchanged check
passed with local-listener permission. This is package-boundary proof, not a
public Paperclip install or a passing live task. Rebuild identity after the
pending stager repair before carrying it forward.

The Core PR uses fixed fetched master `d30c8f42b842` and independent dependencies.
Its full workspace build, 357 focused TypeScript cases, 129 Rust integration
cases and eight bundle/profile checks passed. Its CJS matches the serving
candidate; its independently compiled daemon has different bytes, so binary
equivalence is not claimed. The full repository test gate remains unresolved:
a frozen two-file control passed all 981 native executor cases and the original
chat authority case, but found 21 other chat failures (2,581 passed overall).
Diagnostics and baseline classification are in progress; the failed grade stays
in the record.

Campaign 3 (`cb5cc2493a`) reached private PRP admission, then failed session open
because the outer Runner launch allowlist omitted six private Cloud config/relay
bindings. Its original failure is retained. The corrected regression reproduced
the exact error through transport, sanitized spawn, Rust and the built Node
proxy, then opened/closed that entire chain without any provider request. Four
spawn-boundary controls and the full launch check passed. Reserved configured
environment prefixes remain blocked.

Current master `7f10cc058568` was integrated before the first hosted prompt,
preserving its Stop, recovery, human-input and E2E evidence changes. Only an
additive documentation conflict required resolution. Its declared editor
dependencies were installed with pinned pnpm 9; the resolved dependency lock
was retained privately and the tracked lockfile restored per contribution rules.

Campaign 4 (`5de3610003`) reached real Cloud work and delivered 16 semantic calls
and results to Core. Native discovery emitted some `Invalid arguments` results,
but subsequent dispatch succeeded; those errors do not establish an MCP outage.
The concrete remaining failure was internal `call_api` traffic sent to the
callback-only origin, repeatedly returning 404. The six-minute provider deadline
cancelled the run. The later cleanup readback confirmed its exact owned Agent
and Run absent; this reconciliation does not replace the original failed grade.
No useful artifact or accepted finish was obtained.

Two observed defects are repaired on candidate `8e4c587102`: Core authority now
uses the actual selected private listener for internal HTTP calls, and the
provider facade preserves native tool names, actual status and bounded/redacted
result output. Native calls use the builtin facade without inventing MCP/process
transport or widening raw argument logging. Six Core routing controls and real
Rust/PRP tool projection checks passed. The official MCP SDK also completed exact
discovery and tool calls through the callback route, relay and Unix bridge.
Returning GET 405 instead of 404 removed unsupported-stream error notifications;
this was protocol noise, not a demonstrated cause of the failed task. Cleanup
now independently verifies remote absence and retains authorization failures.
The combined 18 MCP/observer checks and E2E typecheck passed.

The required full build passed on `8e4c587102`. Earlier full test runs that spanned
source changes remain incomplete and are not green qualification. Two failures
in such a run passed individually in fresh processes on this frozen candidate;
cache versus test-order effects remain unresolved pending full-file controls.
One existing Rust receipt-limit check failed under the concurrent target and
passed unchanged in isolation; its exact cause is not asserted. All 31 native
backend checks passed. Keep these original failures in the verification record.

Candidate `2264a82646dda33e159bf1b95c528f4e383b987c` froze the Runner and
product integration in two local commits. The first `task-artifact` campaign,
`cursor-cloud-local-20261028-artifact-1`, found a setup divergence before any
provider prompt: `assertHarnessTestPassed` rejected the successful Cloud
account-catalog receipt because the experimental result has warning status.
The normal saved Test reported its correct informational checks, but lifecycle
verification kept the fresh agent paused, so ordinary task dispatch never
started. The original attempt is retained and was stopped for diagnosis rather
than allowed to consume its task deadline. No Cloud Agent/Run ownership notice
existed at diagnosis. Teardown later observed one local queued run, but no
Cloud checkpoint/create intent existed anywhere in the retained private runtime
tree. Interrupting the waiting browser worker retained its original failed grade
and unconfirmed-cleanup result; its server and database exited. This is not a
passing remote-cleanup observation. C1's connection proof remains valid, but
usable fresh-agent admission is not yet qualified.

The lifecycle regression first failed both listed/unlisted model cases (28 other
cases passed). The fix recognizes the informational Cloud account-ready receipt
for the native Runner adapter while preserving the experimental warning and
all authentication/failure guards. All 30 focused cases then passed. This does
not turn the recommended model catalog into an allowlist or claim a prompt
response. Evidence impact: the Runner/runtime package bytes are unchanged;
repeat fresh-agent setup and the artifact cell against the new application
candidate, retaining the original setup failure.

The second campaign, `cursor-cloud-local-20261028-artifact-2`, used candidate
`c011eb97cf10124b679a0c07779137db5750f320`. Fresh-agent lifecycle reached ready
and ordinary task dispatch reached native Runner. Its first divergence was
local PRP admission: `run.prepare` timed out, with zero control-plane connections
and repeated WebSocket 404/500 responses. Startup had advertised the public
callback-only origin to the local Runner. The narrow proxy correctly refused
that unrelated route. No Cloud checkpoint/create intent or remote ownership
notice existed, and no owned Runner/sidecar process remained after teardown.
The original failed result and cleanup-uncertainty grade remain retained; no
provider prompt or vendor cost is asserted from a local running row. Correct
the server's private PRP listener origin while retaining its public callback
origin, then rerun the same bounded artifact cell.

The startup fix now supplies the actual private HTTP listener host and selected
port to PRP registration. Public auth/runtime URLs retain their existing meaning;
remote transports retain their separate advertised endpoints. Twenty-six focused
runtime-origin, HTTP and PRP tests passed, and server typecheck passed. The next
artifact attempt must verify this boundary through the full product.

A test-only replay injector is ready for C5. Its 28 controlled tests exercise the
actual Driver/Client, one SSE cut after a complete native event, exact saved
Last-Event-ID, ordered withheld-frame recovery and deduplication. It preserves
and restores exact proxy bundle bytes and records only owned identity/cursor
digests. This is supporting proof only. A future live treatment must record both
bundle hashes, require the normal product result and grade real reconnect proof;
it adds no provider prompt to the selected continuation cell.

The local restart also reproduced a test-drive bootstrap bug: it used the public
callback-only `server.apiUrl` and stopped after a 404. Bootstrap API and browser
now derive their local origin from the actual started listener. Both IPv4/IPv6
regressions first failed; all 38 CLI tests and CLI typecheck then passed. The
same saved local instance remains the user-facing test environment. Repository
comment-policy cleanup changed no logic; in-memory CJS/ESM proxy bundles remained
byte-identical and the existing Grok identity check still passed. Rebuild and
record the final Rust artifact identity before carrying package proof forward.

The isolated development instance completed the ordinary Cursor Cloud setup path
through Save & exit, roster, agent overview, and Harness / Runtime reload. The
saved agent retained native Runner, repository, explicit model placeholder, and
organization-secret reference. It stayed paused with no provider session or run.
Missing-model and missing-key checks were visible. Test then reported the missing
public callback, before any provider prompt. These are local configuration
controls, not a successful authenticated Cloud setup or task.

That walkthrough exposed two defects now covered by regressions: shared
normalization injected `codexPermissionMode` after valid Cloud conversion, causing
HTTP 422 on save; the generic runtime form also exposed unsupported Thinking
effort. The fixed route regression executes PATCH, GET, resave and actual provider
parsing. Explicit incompatible user configuration remains rejected. Existing
Codex, Claude, Grok, Dot and Pi cases retain their behavior.

Supporting verification on the current source includes:

- 275 Runner tests across provider, native backend/launch/contracts and the
  existing semantic bridge; this includes the 26 driver-owned cases above and
  12 real loopback Cloud-client cases.
- Eleven executor cases cover actual Cloud admission, selected transport and
  credentials, owned artifact root, relay revocation and unknown accounting.
  Three runtime-helper cases exercise private files and a real Unix HTTP peer;
  three relay cases cover authentication, scope, expiry and revocation.
- Three explicit Product E2E cells are discoverable: task/artifact, same-Agent
  question follow-up and active-run UI Stop. Their 86 supporting cases and
  complete E2E TypeScript check passed. Missing configuration blocks before
  credentials or provider work. The suite refuses public history publication.
- Rust provider lifecycle and shutdown tests passed, including a regression that
  first reproduced process reuse and then proved a fresh sidecar with the same
  durable thread. Per-turn product execution does not retain a warm daemon.
- The Grok immutable profile advanced to v8 because its bound shared Runner
  configuration source changed. The historical v7 identity is preserved and
  remains decodable; this is an identity refresh, not new live qualification.
- `pnpm -r typecheck` and `pnpm build` passed. The first build stopped at the stale
  Grok identity; the next exposed invalid new test fixture types. Both failures
  were corrected. An earlier full test run was interrupted; the final
  `pnpm test:run` run is pending and cannot yet be claimed green.
- Token gates, map structural checks, and generated protocol checks passed.

The clean private Runner candidate tarball contained 1,696 entries and no
`node_modules` or symlinks. Its extracted proxy completed real stdio and Unix MCP
framing, exact synthetic tool input/result, controlled HTTP/SSE terminal lookup,
confirmed shutdown, socket cleanup and exit zero. Both proxy bundles matched
source and referenced only Node builtins. This proves that candidate's runtime
closure, not an ordinary public Paperclip installation or live Cursor work.

| Candidate artifact | SHA-256 |
| --- | --- |
| Private Runner tarball (14,012,694 bytes) | `7d06c80239725b36241db7fb96a6127efc757ae367b0f20843641a0544b9ed3d` |
| Packaged local daemon | `4492f56745b93392b89e016d2907478ebabcf1025099f79222d66a38dfc8f083` |
| Cloud CJS proxy | `2ccfd84f1acd7e2d15b85b1b772e46a6497b1febbe80c0fb85d6b4f59e909687` |
| Cloud ESM proxy | `a582f2b9c1075cfc2185b7d9351072dd06c6d4ae1744f7110873945a10053429` |

The observed controller platform was macOS 26.5.2 build 25F84, arm64, with Node
26.4.0. Node remains an operator-supplied runtime. Its observed 26-file dynamic
library closure digest was
`ce8e6d8d7e9845600a853d7d675810268c29126b6deaafdcc1337a4213c05c48`;
it is not a newly bundled or pinned Node distribution. Retest artifact identity
after a build input changes. No merge, public package install, publication, or
deployment has been performed.

The tarball proof was refreshed after the README's hosted-secret guidance changed.
README.md was the only changed extracted entry; all runtime artifact and Node
closure hashes remained identical. The full controlled packaged round trip and
shutdown proof passed again. The earlier tarball digest
`38bc7632101bdc890591dd58dfb9c75a0956a0c5f1db64c55d963af86c01a1ba`
is retained as historical evidence, not the current candidate archive.

Rollback means disabling fresh experimental admission or selecting the existing
legacy runtime for future work. Do not rewrite persisted run selection or erase
history. Existing native runs still need their cancellation, reconciliation, and
finalization paths. No merge, publication, deployment, or live completion claim
has been made by this plan.