# Cursor built-in skill evidence — real dev-server before and after

Review [#18673](https://git.cafe/pingdotgg/t3code/pulls/18673) ([GitHub mirror #18673](https://github.com/pingdotgg/t3code/pull/18673)).
Before: [3cc31ed27c](https://git.cafe/pingdotgg/t3code/commit/3cc31ed27c8956b36cee35a50509fb7c6869592b). After: [dc550f5935](https://git.cafe/pingdotgg/t3code/commit/dc550f5935bac14d573b3092fe2f311b88f061a5).

This capture fills the first audit's missing baseline server run. Both RPC transcripts come from real dev servers running the full selected revision, not mocked RPCs or a baseline module loaded into the replacement server.

| Matrix row | Before server | After server | Evidence |
|---|---|---|---|
| CLI surface builtin-cli | Omitted | Enabled system skill at synthetic built-in path | before-rpc.json / after-rpc.json, request 2 |
| Unrestricted builtin-default | Omitted | Enabled system skill | request 2 |
| IDE-only builtin-ide | Omitted | Omitted | request 2 plus fixtures.json |
| Project/user/built-in project-wins collision | Project path and LABEL project winner | Same project winner, single result | request 2 |
| User/built-in user-wins collision | User path and LABEL user winner | Same user winner, single result | request 2 |
| Missing built-in root | Existing project/user skills work | Same, no fatal error | request 4 on both real servers |
| No project cwd | User roots only in direct scanner probe | User + system built-ins; user collision winner preserved | before-no-cwd.json / after-no-cwd.json; no-cwd.ts |
| Machine versus workspace representation | Machine skills empty; workspace skills present | Same structure; built-ins in workspace snapshot | requests 2 and 3; no-cwd RPC never promises global skill discovery |
| Read-only discovery | 22 manifest entries equal before/after present-root RPCs; 11 entries equal with root absent | Same | manifest JSON files, equality assertions in capture.mjs and transcripts |
| Existing parser/recursion/mentions | Not rerun as baseline tests | All five focused tests pass, including depth boundary, symlink package boundary and mentions | tests.txt |

Environment: Linux 6.1.102 x86_64, Node v26.12.1, worktree /home/ubuntu/wt/pr-18673. Temporary HOME /tmp/ev-18673/final-capture/home contains labelled synthetic skills. Fresh explicit before-state and after-state directories under the same scratch directory. Both launches pass --home-dir, --no-seed, and T3CODE_DEV_SEED=0. No real ~/.cursor or ~/.t3/userdata was read, copied, seeded, or written. No provider turn was launched.

The isolated Cursor instance is enabled using server.updateSettings. Each request 2 is server.refreshProviders with cwd, fresh:true; this is the real skills listing consumed through provider workspace snapshots. Account/config payloads, credentials, tickets and pairing URLs are excluded. Responses are explicitly projected to Cursor identity/enabled state and labelled synthetic skills. Five unrelated bundled skills discovered in the temporary HOME are counted but omitted. Requests are preserved in full except the HTTP authentication exchange, which is intentionally not recorded.

Preservation manifests include files and directories, modes, sizes, modification times, and SHA-256 for files. Comparison is within each scan interval. The harness temporarily renames the built-in root to test its absence, which intentionally changes the parent directory mtime between intervals; no cross-interval mtime equality is claimed. The missing-root interval has an in-script full manifest equality assertion and transcript result. No-cwd scanner evidence is supplementary to the real before/after server transcripts, since omitting cwd from the RPC only refreshes machine state.

Validation on restored replacement: focused Cursor skills test file 5/5; targeted lint exit 0; @t3tools/provider-cursor typecheck exit 0, with existing Effect suggestions recorded. No repo-wide checks.

Cleanup: baseline ran detached only after checking no other agent occupied this worktree. takeover/pr-18673 restored to exact dc550f5935bac14d573b3092fe2f311b88f061a5, git status --porcelain empty. All three spawned server process groups (including the initial readiness attempt) are absent; both used ports are closed. Server commands, PIDs and exit statuses are in environment.json. No application code changed; only scratch scripts, fixtures, temporary state and evidence were created outside the worktree. No commits, pushes, comments, watches or delegation. The PR was registered with this thread as required by the harness.

Friction: the initial baseline attempt hit HTTP 503 between TCP readiness and app readiness. It was stopped and its state retained privately; the final runs use bounded auth readiness handling and new state. Public transcripts contain only the successful final runs. Servers may inherit ambient provider credentials, but public evidence contains only allowlisted synthetic fields. Private raw server logs and token/state files were not uploaded.

Unverified: browser/composer rendering (optional; no render changes); actual installed Cursor distribution or real user skill contents; mobile/desktop UI, remote/relay/tunnel transport, live provider turns, unreadable/oversized/budget-exhausted built-in runtime cases. The focused existing tests cover the scanner's inherited depth/symlink behavior. This evidence does not claim an exhaustive parser or security audit.

Captured with GPT-6.1-sol through the Codex harness, 2026-10-24 UTC.

## All public artifacts

[after-manifest-after.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/7dcf3c936c669704/after-manifest-after.json)
[after-manifest-before.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/7c35666b4a87df17/after-manifest-before.json)
[after-no-cwd.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/825f9b982ffc25b4/after-no-cwd.json)
[after-rpc.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/76b029e11740031b/after-rpc.json)
[before-manifest-after.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9d5f6bbd0b018992/before-manifest-after.json)
[before-manifest-before.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0d56f02234c031dd/before-manifest-before.json)
[before-no-cwd.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/548bab44a8f915cd/before-no-cwd.json)
[before-rpc.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/08b0cd3a43855b72/before-rpc.json)
[capture.mjs](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/343b8606b5515b5f/capture.mjs)
[coverage.md](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f5f0579ebd50b4e8/coverage.md)
[environment.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/28a49b34470d6bbf/environment.json)
[fixtures.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/cef9a59ab49957ea/fixtures.json)
[fixtures.mjs](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3540b40783d70686/fixtures.mjs)
[lint.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/feebc8aa3626303c/lint.txt)
[no-cwd.ts](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/77c8fd3583500632/no-cwd.ts)
[run.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/2974555d70c14580/run.py)
[startup.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/22ea5dc473df0e49/startup.txt)
[tests.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/2a7122ef6fb1a101/tests.txt)
[typecheck.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/150f836f9c54207a/typecheck.txt)
[evidence-bundle.tar.gz](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6d9e86bbd96cfdb4/evidence-bundle.tar.gz)

The archive includes all scripts, the public evidence files and raw synthetic SKILL.md fixtures. It excludes state, private server logs, token files and node_modules.