# Proof audit pass 2 — Cursor built-in skills

No blocking findings. All ten required matrix rows are sufficiently supported by the delivered full-server before/after evidence and the independent HEAD reproduction. This is a proof-sufficiency verdict for the supplied replacement, not a CI or merge-readiness verdict for the original remote PR.

Reviewed [#18673](https://git.cafe/pingdotgg/t3code/pulls/18673) ([GitHub mirror #18673](https://github.com/pingdotgg/t3code/pull/18673)). Original fork head [936ba6dac6](https://github.com/paynoattn/t3code/commit/936ba6dac687ba9a8189e5a4d254e889757135f2); replacement [dc550f5935](https://git.cafe/pingdotgg/t3code/commit/dc550f5935bac14d573b3092fe2f311b88f061a5); base [3cc31ed27c](https://git.cafe/pingdotgg/t3code/commit/3cc31ed27c8956b36cee35a50509fb7c6869592b).

The checkout `/home/ubuntu/wt/pr-18673` was and remains exactly `dc550f5935bac14d573b3092fe2f311b88f061a5`, branch `takeover/pr-18673`, clean before and after. All three supplied commits exist locally. The complete replacement/base diff is two server files, 19 additions and 3 deletions. Original/replacement production scanner differs only in comment wording. No render paths, contracts, transport handlers, or other providers changed. Live GitCafe metadata still names the original fork head; its description and bot reviews are not proof about the unpublished replacement. Their eight-test claim is distinguished from the replacement's five focused tests.

## Delivered artifacts audited

Read the [matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/75f2e38283c7ad76/proof-matrix.md), [public index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/43a7e9cb5772887f/index.md), and [uploaded bundle](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6d9e86bbd96cfdb4/evidence-bundle.tar.gz). Inspected all 19 bundled public artifacts: before/after RPCs, both pairs of preservation manifests, no-cwd probes, capture script, fixture generator and inventory, launcher, environment record, startup log extract, coverage, tests, lint and typecheck output. Read all eight raw synthetic SKILL.md files. Downloaded every individually linked artifact and verified equality with the bundle/local copies. All bundled public artifacts are byte-identical to `/tmp/ev-18673/final-capture/public`; both manifest pairs are internally equal and each of their eight file hashes matches the raw uploaded fixtures.

The prior matrix's exploratory module-only baseline is superseded by the full-revision server launches in the final index, `run.py`, `environment.json`, startup extract and transcripts. I did not substitute the old exploratory results for those captures. The public launcher checks exact revisions and clean state, starts the full server at base then HEAD, uses distinct fresh state directories, and stops each captured process group. No scratch scanner override is committed or needed for the delivered final capture.

## Row status

| Row | Status | Verified evidence and result |
|---|---|---|
| CLI built-in `builtin-cli` | PASS | Present-root RPC request 2: omitted on base, enabled system skill at the synthetic built-in path on HEAD; reproduced. |
| Unrestricted `builtin-default` | PASS | Same exact addition with system scope; reproduced. |
| IDE-only `builtin-ide` | PASS | Raw fixture has `surfaces: [ide]`; omitted from base/HEAD RPCs and independent rerun; focused test also excludes it. |
| Project/user/built-in collision | PASS | Exactly one `project-wins`, with project path, description and scope preserved before/after; reproduced. |
| User/built-in collision | PASS | Exactly one `user-wins`, with user path, description and scope preserved; reproduced. This runtime fixture supplies coverage masked by the project winner in the committed test. |
| Missing built-in root | PASS | Request 4 on both full servers succeeds with existing project/user winners and no built-ins; identical independent HEAD result. Harness restores the temporarily renamed fixture root in finally. |
| No project cwd | PASS | Supplementary before/after direct scanner probes show user roots plus new system built-ins on HEAD; user collision wins. Independent unmodified no-cwd script matches HEAD JSON. Not misrepresented as machine RPC discovery. |
| Machine/workspace representation | PASS | Machine `skills` stays empty. Request 2 exposes discoveries in `workspaceSnapshots[cwd].skills`; request 3 without cwd preserves that workspace snapshot. Exact independent reproduction. Driver/registry path agrees. |
| Read-only discovery | PASS | Both delivered present-root manifest pairs: 22 entries identical, including modes, sizes, mtimes and file SHA-256. Missing-root interval asserts complete equality for 11 entries in the uploaded capture script, echoed in transcript. Both assertions pass independently. Harness rename occurs outside comparison intervals. |
| Existing parser/recursion/mentions | PASS | All five focused tests pass independently, including an additional run with a new temporary HOME. Depth and symlink package-boundary tests and both mention tests remain passing. Delivered targeted lint/typecheck exit 0; typecheck contains unrelated suggestions only. |

## Independent reproduction and normalized delta

Executed only in the specified worktree, without switching revisions or changing repository files. Used the downloaded bundle's `fixtures.mjs`, `capture.mjs` and `no-cwd.ts` byte-for-byte. The new wrapper only chooses fresh scratch paths, captures the spawned PID and runs HEAD once; it deliberately omits the supplied launcher's revision-switching baseline phase to keep this audit read-only.

Fresh HOME: `/tmp/ev-18673/audit-pass2/rerun/home`. Fresh explicit state: `/tmp/ev-18673/audit-pass2/rerun/state` (asserted absent before launch). `T3CODE_DEV_SEED=0`, `--no-seed`, loopback host, and a generated private dev credential. No real `~/.t3` or `~/.cursor` was read, copied, seeded or written. No provider turn or browser was launched. The capture enables only the isolated Cursor instance through settings before requesting workspace discovery.

Command: `node scripts/dev-runner.ts dev:server --home-dir /tmp/ev-18673/audit-pass2/rerun/state --no-seed --host 127.0.0.1 --port 53307`. Tracked server PID 1286830 stopped with SIGINT, return code 130; wrapper and independent `ss` check confirm port 53307 closed. Worktree remains clean at exact HEAD.

[Independent RPC transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f60f730788937837/after-rpc.json), [environment/cleanup record](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/476c653de2bfed19/audit-environment.json), [normalized comparison](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/dafc0670d6fdf2fe/normalized-comparison.json), and [reproduction bundle](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/976ab1a331852733/audit-reproduction.tar.gz).

Only the absolute fixture prefix is normalized to `<FIXTURE>`. All six RPC records compare exactly, preserving labels, request IDs/tags/payloads, response fields, order and unrelated-skill counts. The no-cwd result also compares exactly. The projected transcripts contain no timestamps requiring removal. Thus the independent HEAD-versus-delivered-base delta equals the delivered HEAD-versus-base delta:

- Added: `builtin-cli`, description `LABEL builtin CLI`, system scope, enabled, path `<FIXTURE>/home/.cursor/skills-cursor/builtin-cli/SKILL.md`.
- Added: `builtin-default`, description `LABEL builtin default`, system scope, enabled, corresponding built-in path.
- Removed: none. Changed existing skills: none.
- Missing-root RPC: no skill delta between revisions. Machine top-level skills remain empty. No-cwd scanner adds the same two system skills.
- Pixel delta: N/A, server-only; no render paths changed.

Independent focused command: `HOME=/tmp/ev-18673/audit-pass2/test-home T3CODE_DEV_SEED=0 vp test run packages/provider-cursor/src/server/skills.test.ts`: 1 file, 5/5 tests passed. An earlier ordinary focused run also passed 5/5. `git diff --check` on the exact supplied diff passes. No repo-wide checks run.

## Gaps and FRICTION

No required proof gaps remain. The base server was not independently rerun during this pass; the supplied full-base server script, exact revision record, startup extract and runtime transcript were inspected, and the required independent affected capture was HEAD. Evidence is a skill-related allowlisted response projection, not the full account/config payload or authentication exchange. Synthetic fixtures establish directory discovery behavior, not what any installed Cursor version ships. Browser/composer rendering, mobile/desktop UI, remote/relay/tunnel modes, live turns and built-in-specific unreadable/oversized/budget-exhaustion cases remain unclaimed. No UI capture is required for this server-only diff. This is not exhaustive parser or security verification.

FRICTION: Python urllib requests returned HTTP 403, while curl retrieved the same public objects. Some concurrent curl requests hit transient DNS failures; bounded retries using the already resolved Cloudflare address succeeded, and every individually linked artifact was ultimately downloaded and compared. No evidence was inferred from inaccessible links.

FRICTION: The supplied full launcher hardcodes its scratch directory and switches the checkout. The audit used a separate temporary HEAD-only wrapper rather than executing that mutating launcher. Uploaded fixture/capture/probe scripts were unmodified. The no-cwd TypeScript probe needs workspace dependencies; a scratch-only node_modules symlink supplies resolution and is excluded from uploads.

FRICTION: Server startup discovers five unrelated bundled skills under synthetic HOME and can inherit ambient provider credentials. The supplied and reproduced public transcripts intentionally retain only labelled fixture skills and the unrelated count, excluding credentials, tickets, account data and private server logs. No live provider turn ran. Fixture preservation checks passed.

No edits, commits, pushes, PR comments, watches or delegation. PR registered with this thread and final registration checked. Report and reproduction artifacts uploaded with ghdrop only. GPT-6.1-sol through Codex, 2026-10-24 UTC.

VERDICT: SUFFICIENT