From 536b5d90fec845f30867c58d6e2ac37bcffa71f6 Mon Sep 17 00:00:00 2001
From: Danil Silantyev <danil@nddev.it.com>
Date: Mon, 14 Sep 2026 15:38:07 +0500
Subject: [PATCH] feat(setup): refresh cursor harness

---
 .gds/bundle.lock.yaml                         |  16 +
 .gds/compiled-policy.json                     | 412 ++++++++++++++++++
 CHANGELOG.md                                  |  25 ++
 Cargo.lock                                    |   8 +-
 Cargo.toml                                    |   8 +-
 README.md                                     |   2 +-
 crates/cursor-setup-system/src/software.rs    |  78 ++--
 crates/cursor-setup-system/tests/lifecycle.rs |  17 +-
 install.ps1                                   |   2 +-
 install.sh                                    |   2 +-
 references/cursor-baseline.json               | 116 ++---
 .../references/authoring-plugins.md           |   6 +-
 setups/nddev-builder/setup.json               |   7 +-
 13 files changed, 581 insertions(+), 118 deletions(-)
 create mode 100644 .gds/bundle.lock.yaml
 create mode 100644 .gds/compiled-policy.json

diff --git a/.gds/bundle.lock.yaml b/.gds/bundle.lock.yaml
new file mode 100644
index 0000000..16a5dd9
--- /dev/null
+++ b/.gds/bundle.lock.yaml
@@ -0,0 +1,16 @@
+# GENERATED FILE - DO NOT EDIT DIRECTLY
+schema_version: 1
+
+bundle:
+  version: "0.9.4-dev"
+  release_sequence: 0
+  channel: "development"
+  source_tree_digest: "sha256:b1c334df899c661304dc45ef29898df24ff4a6ddffd2a6ca4d6f1f795d585189"
+  digest: "sha256:469ac74bf934333ee1fde843ad04a26e002e5b5ec9c782fbe68ec6fe313bfac0"
+
+projection:
+  input_digest: "sha256:91c42f60b686259599cbbb0404071c04803f2f0c4ba24ca489f8b574a89f7100"
+  output_digest: "sha256:ba7414a6a00e36ca884d81b070f19baea45855bb5b40fa42d173764712738d23"
+  files:
+    - path: ".gds/compiled-policy.json"
+      digest: "sha256:4bf5b282d62a36f632d0ff3c20c9c8e3454a6fac87f387646f4e70e1310463a0"
diff --git a/.gds/compiled-policy.json b/.gds/compiled-policy.json
new file mode 100644
index 0000000..e4f1094
--- /dev/null
+++ b/.gds/compiled-policy.json
@@ -0,0 +1,412 @@
+{
+  "schema_version": 1,
+  "compiled_policy": {
+    "repository_id": "repo_01M0QEF397KF93A321G8QNA1ZE",
+    "bundle_version": "0.9.4-dev",
+    "digest": "sha256:8b812eaf8ed551997034e60d25480801e2d5c7ae6bbc0ac8ace5440cc3840639"
+  },
+  "sources": [
+    {
+      "id": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "distribution": "public",
+      "path": "policies/base/repository-default.yaml",
+      "digest": "sha256:0ea560cc2653184e07c6f744455f745a34f764a5c0dcda55f2dc76fa5296f2f0"
+    },
+    {
+      "id": "opennetwork-default",
+      "tier": "owner",
+      "priority": 110,
+      "distribution": "public",
+      "path": "policies/owners/opennetwork-default.yaml",
+      "digest": "sha256:096b9781b05c37fd5b440a171a6e5599cda3ef77983db72bf9c68d3d40b34ab4"
+    }
+  ],
+  "effective": {
+    "agent": {
+      "generated_projection_edit": "forbidden",
+      "profiles": [
+        "core",
+        "drakkars"
+      ]
+    },
+    "context": {
+      "private_parent_persistence": "forbidden"
+    },
+    "git": {
+      "branch_cleanup": "merged-only",
+      "default_branch": "main",
+      "integration": "pull-request"
+    },
+    "github": {
+      "actions": {
+        "allowed_actions": {
+          "management": "observed"
+        },
+        "enabled": {
+          "management": "managed",
+          "value": true
+        },
+        "selected_actions": {
+          "management": "observed"
+        },
+        "sha_pinning_required": {
+          "management": "observed"
+        }
+      },
+      "merge": {
+        "allow_auto_merge": {
+          "management": "observed"
+        },
+        "allow_merge_commit": {
+          "management": "managed",
+          "value": true
+        },
+        "allow_rebase_merge": {
+          "management": "observed"
+        },
+        "allow_squash_merge": {
+          "management": "managed",
+          "value": false
+        },
+        "allow_update_branch": {
+          "management": "managed",
+          "value": true
+        },
+        "delete_branch_on_merge": {
+          "management": "managed",
+          "value": true
+        },
+        "merge_commit_message": {
+          "management": "observed"
+        },
+        "merge_commit_title": {
+          "management": "observed"
+        },
+        "squash_merge_commit_message": {
+          "management": "observed"
+        },
+        "squash_merge_commit_title": {
+          "management": "observed"
+        }
+      },
+      "releases": {
+        "immutable": {
+          "management": "observed"
+        }
+      },
+      "rulesets": {
+        "management": "observed"
+      },
+      "security": {
+        "management": "observed"
+      },
+      "workflow": {
+        "can_approve_pull_request_reviews": {
+          "management": "managed",
+          "value": false
+        },
+        "default_workflow_permissions": {
+          "management": "managed",
+          "value": "read"
+        }
+      }
+    },
+    "package_management": {
+      "mutable_version_resolution": "forbidden",
+      "npm_family_on_managed_path": "allowed",
+      "remote_stream_to_shell": "forbidden"
+    },
+    "rollout": {
+      "mode": "pull-request"
+    },
+    "security": {
+      "external_write_requires_approval": true,
+      "public_projection_scan": "required",
+      "secrets_in_repository": "forbidden"
+    }
+  },
+  "provenance": {
+    "/effective/agent/generated_projection_edit": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/agent/profiles/0": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "append"
+    },
+    "/effective/agent/profiles/1": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "append"
+    },
+    "/effective/context/private_parent_persistence": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/git/branch_cleanup": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/git/default_branch": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/git/integration": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/github/actions/allowed_actions/management": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/github/actions/enabled/management": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/github/actions/enabled/value": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/github/actions/selected_actions/management": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/github/actions/sha_pinning_required/management": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/github/merge/allow_auto_merge/management": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/github/merge/allow_merge_commit/management": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/github/merge/allow_merge_commit/value": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/github/merge/allow_rebase_merge/management": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/github/merge/allow_squash_merge/management": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/github/merge/allow_squash_merge/value": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/github/merge/allow_update_branch/management": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/github/merge/allow_update_branch/value": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/github/merge/delete_branch_on_merge/management": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/github/merge/delete_branch_on_merge/value": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/github/merge/merge_commit_message/management": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/github/merge/merge_commit_title/management": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/github/merge/squash_merge_commit_message/management": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/github/merge/squash_merge_commit_title/management": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/github/releases/immutable/management": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/github/rulesets/management": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/github/security/management": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/github/workflow/can_approve_pull_request_reviews/management": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/github/workflow/can_approve_pull_request_reviews/value": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/github/workflow/default_workflow_permissions/management": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/github/workflow/default_workflow_permissions/value": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/package_management/mutable_version_resolution": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/package_management/npm_family_on_managed_path": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/package_management/remote_stream_to_shell": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/rollout/mode": {
+      "source": "opennetwork-default",
+      "tier": "owner",
+      "priority": 110,
+      "file": "policies/owners/opennetwork-default.yaml",
+      "operation": "set"
+    },
+    "/effective/security/external_write_requires_approval": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/security/public_projection_scan": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    },
+    "/effective/security/secrets_in_repository": {
+      "source": "repository-default",
+      "tier": "base",
+      "priority": 100,
+      "file": "policies/base/repository-default.yaml",
+      "operation": "set"
+    }
+  }
+}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 11ff0cf..6e9f4e8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,6 +15,31 @@ cut and that this clone does not carry.
 
 ## [Unreleased]
 
+## [0.0.71] - 2026-09-13
+
+nddev-builder guidance is refreshed against each harness's current native
+extension model. Codex custom agents now cover inherited session settings and
+project scope; its hook guide includes Interrupt and the limits of asynchronous
+hooks as enforcement. Antigravity plugin and subagent guidance records the
+current manifest minimum, bundled agents, workspace isolation, inherited safety
+boundaries and validation behavior observed in CLI 1.2.2.
+
+Every builder manifest now cites all vendor pages used by its generated
+component guides, including sources beyond the base permission posture. The
+provider protocol, setup ownership and software artifact pins are unchanged.
+
+## [0.0.70] - 2026-09-13
+
+Software artifacts are refreshed from verified vendor bytes: Claude Code
+2.1.270, Codex 0.154.0, Grok Build 1.0.31, OpenCode 1.18.30, Cursor
+2026.09.10-fd3934a and Antigravity CLI 1.2.2. Pi remains at 0.85.1.
+Every published platform digest and rollback pin is transcribed from the same
+verified ledger.
+
+Lifecycle integration tests remain compatible with the pinned Rust 1.98.0
+toolchain by reading Cargo's executable path at runtime. Provider behavior,
+protocol-v3 declarations and setup ownership are unchanged.
+
 ## [0.0.69] - 2026-09-08
 
 Native lifecycle evidence runs every provider command in the same isolated
diff --git a/Cargo.lock b/Cargo.lock
index f81502c..912d192 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -49,7 +49,7 @@ dependencies = [
 
 [[package]]
 name = "cursor-setup-system"
-version = "0.0.69"
+version = "0.0.71"
 dependencies = [
  "harness-runtime",
  "provider-v3",
@@ -76,7 +76,7 @@ checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 
 [[package]]
 name = "harness-runtime"
-version = "0.0.69"
+version = "0.0.71"
 dependencies = [
  "provider-v3",
  "serde",
@@ -147,7 +147,7 @@ dependencies = [
 
 [[package]]
 name = "provider-v3"
-version = "0.0.69"
+version = "0.0.71"
 dependencies = [
  "serde",
  "serde_json",
@@ -209,7 +209,7 @@ dependencies = [
 
 [[package]]
 name = "setup-core"
-version = "0.0.69"
+version = "0.0.71"
 dependencies = [
  "miniz_oxide",
  "serde",
diff --git a/Cargo.toml b/Cargo.toml
index 75c4803..1aed3a5 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -8,7 +8,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.0.69"
+version = "0.0.71"
 edition = "2024"
 rust-version = "1.89"
 license = "AGPL-3.0-or-later"
@@ -23,9 +23,9 @@ sha2 = "0.11"
 # `setup-core::archive`); an inflate loop is not, because its bugs are
 # memory-safety bugs and it is not improved by being hand-written here.
 miniz_oxide = "0.9"
-setup-core = { path = "crates/setup-core", version = "0.0.69" }
-provider-v3 = { path = "crates/provider-v3", version = "0.0.69" }
-harness-runtime = { path = "crates/harness-runtime", version = "0.0.69" }
+setup-core = { path = "crates/setup-core", version = "0.0.71" }
+provider-v3 = { path = "crates/provider-v3", version = "0.0.71" }
+harness-runtime = { path = "crates/harness-runtime", version = "0.0.71" }
 
 [workspace.lints.rust]
 unsafe_code = "forbid"
diff --git a/README.md b/README.md
index 821a1cd..bcc2f61 100644
--- a/README.md
+++ b/README.md
@@ -179,7 +179,7 @@ release is a convenience, not the authorised copy.
 
 ```bash
 docker run --rm -v "$HOME/.config:/config" \
-  ghcr.io/nddev-opennetwork/cursor-setup-system:0.0.69 \
+  ghcr.io/nddev-opennetwork/cursor-setup-system:0.0.71 \
   status --target /config/<dir> --json
 ```
 
diff --git a/crates/cursor-setup-system/src/software.rs b/crates/cursor-setup-system/src/software.rs
index 5ef5e72..02e4475 100644
--- a/crates/cursor-setup-system/src/software.rs
+++ b/crates/cursor-setup-system/src/software.rs
@@ -20,103 +20,103 @@ use harness_runtime::{Artifact, Delivery, Previous, Shape, Software};
 pub(crate) const ARTIFACTS: &[Artifact] = &[
     Artifact {
         platform: "linux/arm64",
-        url: "https://downloads.cursor.com/lab/2026.09.02-c22c1a3/linux/arm64/agent-cli-package.tar.gz",
-        bytes: 177_647_834,
-        sha256: "sha256:fb7bc635be6172ebcf68f907fd9217e3614da51916455c6d7fdb66690997884c",
+        url: "https://downloads.cursor.com/lab/2026.09.10-fd3934a/linux/arm64/agent-cli-package.tar.gz",
+        bytes: 177_655_979,
+        sha256: "sha256:e0494438b01c37bc34848491d1f3478ef469494c56caf020de11796d146db64a",
         shape: Shape::GzipTar,
         member: "dist-package/cursor-agent",
     },
     Artifact {
         platform: "linux/x86_64",
-        url: "https://downloads.cursor.com/lab/2026.09.02-c22c1a3/linux/x64/agent-cli-package.tar.gz",
-        bytes: 179_684_142,
-        sha256: "sha256:b73b59854762535c0fc20d7ccc51c3b5a356a851491088d60a362be48750f53c",
+        url: "https://downloads.cursor.com/lab/2026.09.10-fd3934a/linux/x64/agent-cli-package.tar.gz",
+        bytes: 179_673_253,
+        sha256: "sha256:27997c8391ad853a5a732b1845db8ef82a8ba6afb0f7829cc739464f8966e96e",
         shape: Shape::GzipTar,
         member: "dist-package/cursor-agent",
     },
     Artifact {
         platform: "macos/arm64",
-        url: "https://downloads.cursor.com/lab/2026.09.02-c22c1a3/darwin/arm64/agent-cli-package.tar.gz",
-        bytes: 174_181_041,
-        sha256: "sha256:3d814861be3225fc8c38be320fb22e344d8f711a24279f1f9119e7b313ea51e7",
+        url: "https://downloads.cursor.com/lab/2026.09.10-fd3934a/darwin/arm64/agent-cli-package.tar.gz",
+        bytes: 174_178_929,
+        sha256: "sha256:aec0b01ae056de48a02fe315fbf0580eb91377752d993307499988cbe0285423",
         shape: Shape::GzipTar,
         member: "dist-package/cursor-agent",
     },
     Artifact {
         platform: "macos/x86_64",
-        url: "https://downloads.cursor.com/lab/2026.09.02-c22c1a3/darwin/x64/agent-cli-package.tar.gz",
-        bytes: 181_413_402,
-        sha256: "sha256:59e8afd9b4f5eba44682018b9428c4a94e230d090871eae19e703540aad6ef6a",
+        url: "https://downloads.cursor.com/lab/2026.09.10-fd3934a/darwin/x64/agent-cli-package.tar.gz",
+        bytes: 181_409_095,
+        sha256: "sha256:964cc72e88125c6b48ecaaebef68bf7cb752eb7b9d010a5535cf9f8e677dcf83",
         shape: Shape::GzipTar,
         member: "dist-package/cursor-agent",
     },
     Artifact {
         platform: "windows/arm64",
-        url: "https://downloads.cursor.com/lab/2026.09.02-c22c1a3/windows/arm64/agent-cli-package.zip",
-        bytes: 72_044_862,
-        sha256: "sha256:a503b66a18c175ead4bad2c1dd7abf96161fd03a4fccb7d1372d4a74df1d0b07",
+        url: "https://downloads.cursor.com/lab/2026.09.10-fd3934a/windows/arm64/agent-cli-package.zip",
+        bytes: 72_069_603,
+        sha256: "sha256:acb34343a1915085fd882d392b4d3c35ecf54b15467df6a4cf34c62e065412e8",
         shape: Shape::Zip,
         member: "dist-package/cursor-agent.cmd",
     },
     Artifact {
         platform: "windows/x86_64",
-        url: "https://downloads.cursor.com/lab/2026.09.02-c22c1a3/windows/x64/agent-cli-package.zip",
-        bytes: 74_166_530,
-        sha256: "sha256:2a560a7629828fa00c1d6a67eef5ea9bd3e99609abd45cb02ef2e743e83b9d47",
+        url: "https://downloads.cursor.com/lab/2026.09.10-fd3934a/windows/x64/agent-cli-package.zip",
+        bytes: 74_169_932,
+        sha256: "sha256:cdf0b9b7c2f8892d4c2d2ccbf38226c831a0d56a043e2132d90f1aefac90b846",
         shape: Shape::Zip,
         member: "dist-package/cursor-agent.cmd",
     },
 ];
 
-/// The artifacts 2026.08.31-4057e58 was published as, kept so
+/// The artifacts 2026.09.02-c22c1a3 was published as, kept so
 /// `software_update` has a version to move from and `rollback` a tree to
 /// return to. Measured from bytes when it was the current pin.
 pub(crate) const PREVIOUS_ARTIFACTS: &[Artifact] = &[
     Artifact {
         platform: "linux/arm64",
-        url: "https://downloads.cursor.com/lab/2026.08.31-4057e58/linux/arm64/agent-cli-package.tar.gz",
-        bytes: 83_127_421,
-        sha256: "sha256:cf5db6b5047b3280d8a49471cfd41beb1d5e475774177df5df2851857ab6514a",
+        url: "https://downloads.cursor.com/lab/2026.09.02-c22c1a3/linux/arm64/agent-cli-package.tar.gz",
+        bytes: 177_647_834,
+        sha256: "sha256:fb7bc635be6172ebcf68f907fd9217e3614da51916455c6d7fdb66690997884c",
         shape: Shape::GzipTar,
         member: "dist-package/cursor-agent",
     },
     Artifact {
         platform: "linux/x86_64",
-        url: "https://downloads.cursor.com/lab/2026.08.31-4057e58/linux/x64/agent-cli-package.tar.gz",
-        bytes: 84_537_653,
-        sha256: "sha256:7e306db5750219a99c00ed517fe8b235d3c54e4ca5f77e2ff160cc97ce707798",
+        url: "https://downloads.cursor.com/lab/2026.09.02-c22c1a3/linux/x64/agent-cli-package.tar.gz",
+        bytes: 179_684_142,
+        sha256: "sha256:b73b59854762535c0fc20d7ccc51c3b5a356a851491088d60a362be48750f53c",
         shape: Shape::GzipTar,
         member: "dist-package/cursor-agent",
     },
     Artifact {
         platform: "macos/arm64",
-        url: "https://downloads.cursor.com/lab/2026.08.31-4057e58/darwin/arm64/agent-cli-package.tar.gz",
-        bytes: 74_720_796,
-        sha256: "sha256:a94483cf5a1607bfe12cb34216be0c8f95899f0f698fb85e500ba28d7332fbb0",
+        url: "https://downloads.cursor.com/lab/2026.09.02-c22c1a3/darwin/arm64/agent-cli-package.tar.gz",
+        bytes: 174_181_041,
+        sha256: "sha256:3d814861be3225fc8c38be320fb22e344d8f711a24279f1f9119e7b313ea51e7",
         shape: Shape::GzipTar,
         member: "dist-package/cursor-agent",
     },
     Artifact {
         platform: "macos/x86_64",
-        url: "https://downloads.cursor.com/lab/2026.08.31-4057e58/darwin/x64/agent-cli-package.tar.gz",
-        bytes: 77_618_267,
-        sha256: "sha256:03e6693071036bc4c5259b825edad5ad0be5265ba0d7cd0f6b83004f8664aa6e",
+        url: "https://downloads.cursor.com/lab/2026.09.02-c22c1a3/darwin/x64/agent-cli-package.tar.gz",
+        bytes: 181_413_402,
+        sha256: "sha256:59e8afd9b4f5eba44682018b9428c4a94e230d090871eae19e703540aad6ef6a",
         shape: Shape::GzipTar,
         member: "dist-package/cursor-agent",
     },
     Artifact {
         platform: "windows/arm64",
-        url: "https://downloads.cursor.com/lab/2026.08.31-4057e58/windows/arm64/agent-cli-package.zip",
-        bytes: 71_680_177,
-        sha256: "sha256:d1d859ceaf59ac10d30915dbbe8e5b48eb68c594c8d4e478c5913501920dcf41",
+        url: "https://downloads.cursor.com/lab/2026.09.02-c22c1a3/windows/arm64/agent-cli-package.zip",
+        bytes: 72_044_862,
+        sha256: "sha256:a503b66a18c175ead4bad2c1dd7abf96161fd03a4fccb7d1372d4a74df1d0b07",
         shape: Shape::Zip,
         member: "dist-package/cursor-agent.cmd",
     },
     Artifact {
         platform: "windows/x86_64",
-        url: "https://downloads.cursor.com/lab/2026.08.31-4057e58/windows/x64/agent-cli-package.zip",
-        bytes: 73_782_384,
-        sha256: "sha256:64ac8c45e059893f44ce5802901b4727d3ddd59af42aee3730fa36208e974e05",
+        url: "https://downloads.cursor.com/lab/2026.09.02-c22c1a3/windows/x64/agent-cli-package.zip",
+        bytes: 74_166_530,
+        sha256: "sha256:2a560a7629828fa00c1d6a67eef5ea9bd3e99609abd45cb02ef2e743e83b9d47",
         shape: Shape::Zip,
         member: "dist-package/cursor-agent.cmd",
     },
@@ -124,12 +124,12 @@ pub(crate) const PREVIOUS_ARTIFACTS: &[Artifact] = &[
 
 /// Cursor's program, and where its bytes come from.
 pub(crate) const SOFTWARE: Software = Software {
-    version: "2026.09.02-c22c1a3",
+    version: "2026.09.10-fd3934a",
     command: "agent",
     delivery: Delivery::Artifacts(ARTIFACTS),
     unsupported: &[],
     previous: Some(Previous {
-        version: "2026.08.31-4057e58",
+        version: "2026.09.02-c22c1a3",
         artifacts: PREVIOUS_ARTIFACTS,
     }),
 };
diff --git a/crates/cursor-setup-system/tests/lifecycle.rs b/crates/cursor-setup-system/tests/lifecycle.rs
index 59ca4a6..5a559f2 100644
--- a/crates/cursor-setup-system/tests/lifecycle.rs
+++ b/crates/cursor-setup-system/tests/lifecycle.rs
@@ -10,12 +10,15 @@
 //! runs for all seven systems on all three platforms, and a crate carries only
 //! the one fact that is its own: which binary to run.
 
+#![allow(clippy::expect_used, reason = "tests require Cargo's binary path")]
+
 /// Install, select, back up, hold, restore, restore to a named slot, release,
 /// remove -- and a file this provider does not own, present throughout.
 #[test]
 fn the_documented_round_trip_works_on_this_system() {
-    let exe = std::path::Path::new(env!("CARGO_BIN_EXE_cursor-setup-system"));
-    let problems = harness_runtime::probe::round_trip(exe);
+    let exe = std::env::var("CARGO_BIN_EXE_cursor-setup-system")
+        .expect("Cargo must expose the cursor setup-system binary to integration tests");
+    let problems = harness_runtime::probe::round_trip(std::path::Path::new(&exe));
     assert!(
         problems.is_empty(),
         "the round trip disagreed with what this build documents:\n  {}",
@@ -26,8 +29,9 @@ fn the_documented_round_trip_works_on_this_system() {
 /// A target this provider was never pointed at is refused, never guessed at.
 #[test]
 fn a_target_that_is_not_one_is_refused_on_this_system() {
-    let exe = std::path::Path::new(env!("CARGO_BIN_EXE_cursor-setup-system"));
-    let problems = harness_runtime::probe::refuses_a_target_it_should(exe);
+    let exe = std::env::var("CARGO_BIN_EXE_cursor-setup-system")
+        .expect("Cargo must expose the cursor setup-system binary to integration tests");
+    let problems = harness_runtime::probe::refuses_a_target_it_should(std::path::Path::new(&exe));
     assert!(problems.is_empty(), "{}", problems.join("\n  "));
 }
 
@@ -38,7 +42,8 @@ fn a_target_that_is_not_one_is_refused_on_this_system() {
 /// test in one process cannot reach it, so this drives real ones.
 #[test]
 fn one_process_writes_this_target_at_a_time() {
-    let exe = std::path::Path::new(env!("CARGO_BIN_EXE_cursor-setup-system"));
-    let problems = harness_runtime::probe::one_writer_at_a_time(exe);
+    let exe = std::env::var("CARGO_BIN_EXE_cursor-setup-system")
+        .expect("Cargo must expose the cursor setup-system binary to integration tests");
+    let problems = harness_runtime::probe::one_writer_at_a_time(std::path::Path::new(&exe));
     assert!(problems.is_empty(), "{}", problems.join("\n  "));
 }
diff --git a/install.ps1 b/install.ps1
index f654c49..e3e078d 100644
--- a/install.ps1
+++ b/install.ps1
@@ -7,7 +7,7 @@
 #   powershell -ExecutionPolicy Bypass -File install.ps1 -Version 0.1.0
 [CmdletBinding()]
 param(
-  [string]$Version = "0.0.69",
+  [string]$Version = "0.0.71",
   [string]$InstallDir = "$env:LOCALAPPDATA\Programs\cursor-setup-system"
 )
 $ErrorActionPreference = "Stop"
diff --git a/install.sh b/install.sh
index 0d41c22..fa0f2b8 100644
--- a/install.sh
+++ b/install.sh
@@ -14,7 +14,7 @@ set -eu
 
 REPO="NDDev-OpenNetwork/cursor-setup-system"
 BINARY="cursor-setup-system"
-VERSION="${1:-0.0.69}"
+VERSION="${1:-0.0.71}"
 PREFIX="${CURSOR_INSTALL_DIR:-$HOME/.local/bin}"
 
 case "$(uname -s)" in
diff --git a/references/cursor-baseline.json b/references/cursor-baseline.json
index 2cf057a..a61d3dc 100644
--- a/references/cursor-baseline.json
+++ b/references/cursor-baseline.json
@@ -2,34 +2,34 @@
   "schema_version": 3,
   "verified_ref": "references/cursor-cli-baseline.json",
   "release": {
-    "version": "2026.09.02-c22c1a3",
+    "version": "2026.09.10-fd3934a",
     "installer": "https://cursor.com/install",
-    "installer_sha256": "e3f0427f5391edeb3cf22f78d340281cffb192255496eeeaca8b6c4d0c34330f",
-    "artifact_template": "https://downloads.cursor.com/lab/2026.09.02-c22c1a3/{os}/{arch}/agent-cli-package.{extension}",
+    "installer_sha256": "bb54a2c0c13a936faab47355edd7125ec43a203af5610175ab39f5571df16e74",
+    "artifact_template": "https://downloads.cursor.com/lab/2026.09.10-fd3934a/{os}/{arch}/agent-cli-package.{extension}",
     "artifacts": {
       "darwin/arm64/agent-cli-package.tar.gz": {
-        "sha256": "3d814861be3225fc8c38be320fb22e344d8f711a24279f1f9119e7b313ea51e7",
-        "size": 174181041
+        "sha256": "aec0b01ae056de48a02fe315fbf0580eb91377752d993307499988cbe0285423",
+        "size": 174178929
       },
       "darwin/x64/agent-cli-package.tar.gz": {
-        "sha256": "59e8afd9b4f5eba44682018b9428c4a94e230d090871eae19e703540aad6ef6a",
-        "size": 181413402
+        "sha256": "964cc72e88125c6b48ecaaebef68bf7cb752eb7b9d010a5535cf9f8e677dcf83",
+        "size": 181409095
       },
       "linux/arm64/agent-cli-package.tar.gz": {
-        "sha256": "fb7bc635be6172ebcf68f907fd9217e3614da51916455c6d7fdb66690997884c",
-        "size": 177647834
+        "sha256": "e0494438b01c37bc34848491d1f3478ef469494c56caf020de11796d146db64a",
+        "size": 177655979
       },
       "linux/x64/agent-cli-package.tar.gz": {
-        "sha256": "b73b59854762535c0fc20d7ccc51c3b5a356a851491088d60a362be48750f53c",
-        "size": 179684142
+        "sha256": "27997c8391ad853a5a732b1845db8ef82a8ba6afb0f7829cc739464f8966e96e",
+        "size": 179673253
       },
       "windows/x64/agent-cli-package.zip": {
-        "sha256": "2a560a7629828fa00c1d6a67eef5ea9bd3e99609abd45cb02ef2e743e83b9d47",
-        "size": 74166530
+        "sha256": "cdf0b9b7c2f8892d4c2d2ccbf38226c831a0d56a043e2132d90f1aefac90b846",
+        "size": 74169932
       },
       "windows/arm64/agent-cli-package.zip": {
-        "sha256": "a503b66a18c175ead4bad2c1dd7abf96161fd03a4fccb7d1372d4a74df1d0b07",
-        "size": 72044862
+        "sha256": "acb34343a1915085fd882d392b4d3c35ecf54b15467df6a4cf34c62e065412e8",
+        "size": 72069603
       }
     }
   },
@@ -98,7 +98,7 @@
   "software_install": {
     "mechanism": "official-cursor-agent-artifact",
     "managed_command": "bin/agent",
-    "version": "2026.09.02-c22c1a3",
+    "version": "2026.09.10-fd3934a",
     "npm": null,
     "pip": null
   },
@@ -173,7 +173,7 @@
       "product_projection": "observed-by-manager"
     }
   },
-  "verified_at": "2026-09-07T03:18:13+00:00",
+  "verified_at": "2026-09-13T15:18:55+00:00",
   "native_surfaces": {
     "verified_at": "2026-08-31",
     "config_home": "~/.cursor",
@@ -441,94 +441,94 @@
     "shape": "gzip-tar",
     "platforms": {
       "linux/arm64": {
-        "url": "https://downloads.cursor.com/lab/2026.09.02-c22c1a3/linux/arm64/agent-cli-package.tar.gz",
-        "bytes": 177647834,
-        "sha256": "sha256:fb7bc635be6172ebcf68f907fd9217e3614da51916455c6d7fdb66690997884c",
+        "url": "https://downloads.cursor.com/lab/2026.09.10-fd3934a/linux/arm64/agent-cli-package.tar.gz",
+        "bytes": 177655979,
+        "sha256": "sha256:e0494438b01c37bc34848491d1f3478ef469494c56caf020de11796d146db64a",
         "member": "dist-package/cursor-agent"
       },
       "linux/x86_64": {
-        "url": "https://downloads.cursor.com/lab/2026.09.02-c22c1a3/linux/x64/agent-cli-package.tar.gz",
-        "bytes": 179684142,
-        "sha256": "sha256:b73b59854762535c0fc20d7ccc51c3b5a356a851491088d60a362be48750f53c",
+        "url": "https://downloads.cursor.com/lab/2026.09.10-fd3934a/linux/x64/agent-cli-package.tar.gz",
+        "bytes": 179673253,
+        "sha256": "sha256:27997c8391ad853a5a732b1845db8ef82a8ba6afb0f7829cc739464f8966e96e",
         "member": "dist-package/cursor-agent"
       },
       "macos/arm64": {
-        "url": "https://downloads.cursor.com/lab/2026.09.02-c22c1a3/darwin/arm64/agent-cli-package.tar.gz",
-        "bytes": 174181041,
-        "sha256": "sha256:3d814861be3225fc8c38be320fb22e344d8f711a24279f1f9119e7b313ea51e7",
+        "url": "https://downloads.cursor.com/lab/2026.09.10-fd3934a/darwin/arm64/agent-cli-package.tar.gz",
+        "bytes": 174178929,
+        "sha256": "sha256:aec0b01ae056de48a02fe315fbf0580eb91377752d993307499988cbe0285423",
         "member": "dist-package/cursor-agent"
       },
       "macos/x86_64": {
-        "url": "https://downloads.cursor.com/lab/2026.09.02-c22c1a3/darwin/x64/agent-cli-package.tar.gz",
-        "bytes": 181413402,
-        "sha256": "sha256:59e8afd9b4f5eba44682018b9428c4a94e230d090871eae19e703540aad6ef6a",
+        "url": "https://downloads.cursor.com/lab/2026.09.10-fd3934a/darwin/x64/agent-cli-package.tar.gz",
+        "bytes": 181409095,
+        "sha256": "sha256:964cc72e88125c6b48ecaaebef68bf7cb752eb7b9d010a5535cf9f8e677dcf83",
         "member": "dist-package/cursor-agent"
       },
       "windows/arm64": {
-        "url": "https://downloads.cursor.com/lab/2026.09.02-c22c1a3/windows/arm64/agent-cli-package.zip",
-        "bytes": 72044862,
-        "sha256": "sha256:a503b66a18c175ead4bad2c1dd7abf96161fd03a4fccb7d1372d4a74df1d0b07",
+        "url": "https://downloads.cursor.com/lab/2026.09.10-fd3934a/windows/arm64/agent-cli-package.zip",
+        "bytes": 72069603,
+        "sha256": "sha256:acb34343a1915085fd882d392b4d3c35ecf54b15467df6a4cf34c62e065412e8",
         "shape": "zip",
         "member": "dist-package/cursor-agent.cmd"
       },
       "windows/x86_64": {
-        "url": "https://downloads.cursor.com/lab/2026.09.02-c22c1a3/windows/x64/agent-cli-package.zip",
-        "bytes": 74166530,
-        "sha256": "sha256:2a560a7629828fa00c1d6a67eef5ea9bd3e99609abd45cb02ef2e743e83b9d47",
+        "url": "https://downloads.cursor.com/lab/2026.09.10-fd3934a/windows/x64/agent-cli-package.zip",
+        "bytes": 74169932,
+        "sha256": "sha256:cdf0b9b7c2f8892d4c2d2ccbf38226c831a0d56a043e2132d90f1aefac90b846",
         "shape": "zip",
         "member": "dist-package/cursor-agent.cmd"
       }
     },
-    "version": "2026.09.02-c22c1a3",
-    "verified_at": "2026-09-07T03:18:13+00:00"
+    "version": "2026.09.10-fd3934a",
+    "verified_at": "2026-09-13T15:18:55+00:00"
   },
   "previous_software_artifacts": {
     "command": "agent",
     "shape": "gzip-tar",
     "platforms": {
       "linux/arm64": {
-        "url": "https://downloads.cursor.com/lab/2026.08.31-4057e58/linux/arm64/agent-cli-package.tar.gz",
-        "bytes": 83127421,
-        "sha256": "sha256:cf5db6b5047b3280d8a49471cfd41beb1d5e475774177df5df2851857ab6514a",
+        "url": "https://downloads.cursor.com/lab/2026.09.02-c22c1a3/linux/arm64/agent-cli-package.tar.gz",
+        "bytes": 177647834,
+        "sha256": "sha256:fb7bc635be6172ebcf68f907fd9217e3614da51916455c6d7fdb66690997884c",
         "member": "dist-package/cursor-agent"
       },
       "linux/x86_64": {
-        "url": "https://downloads.cursor.com/lab/2026.08.31-4057e58/linux/x64/agent-cli-package.tar.gz",
-        "bytes": 84537653,
-        "sha256": "sha256:7e306db5750219a99c00ed517fe8b235d3c54e4ca5f77e2ff160cc97ce707798",
+        "url": "https://downloads.cursor.com/lab/2026.09.02-c22c1a3/linux/x64/agent-cli-package.tar.gz",
+        "bytes": 179684142,
+        "sha256": "sha256:b73b59854762535c0fc20d7ccc51c3b5a356a851491088d60a362be48750f53c",
         "member": "dist-package/cursor-agent"
       },
       "macos/arm64": {
-        "url": "https://downloads.cursor.com/lab/2026.08.31-4057e58/darwin/arm64/agent-cli-package.tar.gz",
-        "bytes": 74720796,
-        "sha256": "sha256:a94483cf5a1607bfe12cb34216be0c8f95899f0f698fb85e500ba28d7332fbb0",
+        "url": "https://downloads.cursor.com/lab/2026.09.02-c22c1a3/darwin/arm64/agent-cli-package.tar.gz",
+        "bytes": 174181041,
+        "sha256": "sha256:3d814861be3225fc8c38be320fb22e344d8f711a24279f1f9119e7b313ea51e7",
         "member": "dist-package/cursor-agent"
       },
       "macos/x86_64": {
-        "url": "https://downloads.cursor.com/lab/2026.08.31-4057e58/darwin/x64/agent-cli-package.tar.gz",
-        "bytes": 77618267,
-        "sha256": "sha256:03e6693071036bc4c5259b825edad5ad0be5265ba0d7cd0f6b83004f8664aa6e",
+        "url": "https://downloads.cursor.com/lab/2026.09.02-c22c1a3/darwin/x64/agent-cli-package.tar.gz",
+        "bytes": 181413402,
+        "sha256": "sha256:59e8afd9b4f5eba44682018b9428c4a94e230d090871eae19e703540aad6ef6a",
         "member": "dist-package/cursor-agent"
       },
       "windows/arm64": {
-        "url": "https://downloads.cursor.com/lab/2026.08.31-4057e58/windows/arm64/agent-cli-package.zip",
-        "bytes": 71680177,
-        "sha256": "sha256:d1d859ceaf59ac10d30915dbbe8e5b48eb68c594c8d4e478c5913501920dcf41",
+        "url": "https://downloads.cursor.com/lab/2026.09.02-c22c1a3/windows/arm64/agent-cli-package.zip",
+        "bytes": 72044862,
+        "sha256": "sha256:a503b66a18c175ead4bad2c1dd7abf96161fd03a4fccb7d1372d4a74df1d0b07",
         "shape": "zip",
         "member": "dist-package/cursor-agent.cmd"
       },
       "windows/x86_64": {
-        "url": "https://downloads.cursor.com/lab/2026.08.31-4057e58/windows/x64/agent-cli-package.zip",
-        "bytes": 73782384,
-        "sha256": "sha256:64ac8c45e059893f44ce5802901b4727d3ddd59af42aee3730fa36208e974e05",
+        "url": "https://downloads.cursor.com/lab/2026.09.02-c22c1a3/windows/x64/agent-cli-package.zip",
+        "bytes": 74166530,
+        "sha256": "sha256:2a560a7629828fa00c1d6a67eef5ea9bd3e99609abd45cb02ef2e743e83b9d47",
         "shape": "zip",
         "member": "dist-package/cursor-agent.cmd"
       }
     },
-    "version": "2026.08.31-4057e58",
-    "verified_at": "2026-09-02T00:41:54+00:00"
+    "version": "2026.09.02-c22c1a3",
+    "verified_at": "2026-09-07T03:18:13+00:00"
   },
-  "setup_catalogue_digest": "sha256:2339c03bbb648890de5d7f15aaa8e8a7ba262f38ae5d5e9179f127e0833ea9a6",
+  "setup_catalogue_digest": "sha256:66ac79e522c9cbe5a592bff3c08a63696879a3e16cbdf675a267b742b25bf907",
   "previous_pin_recovery": {
     "measured_at": "2026-08-31",
     "note": "The vendor exposes no release index, but this repository had already measured the immediately preceding release before the pin moved: exact version plus the four Unix URLs, lengths and digests. All six derived immutable URLs still answer; the two Windows archives were downloaded and hashed now, and their command-script members were read from the ZIPs. This is recovered measurement, not a second independently moving pin, and the next ordinary refresh replaces it through the same outgoing-current rotation as every other harness."
diff --git a/setups/nddev-builder/home/plugins/local/nddev-builder/skills/nddev-builder/references/authoring-plugins.md b/setups/nddev-builder/home/plugins/local/nddev-builder/skills/nddev-builder/references/authoring-plugins.md
index 0c3ffc4..3b630c2 100644
--- a/setups/nddev-builder/home/plugins/local/nddev-builder/skills/nddev-builder/references/authoring-plugins.md
+++ b/setups/nddev-builder/home/plugins/local/nddev-builder/skills/nddev-builder/references/authoring-plugins.md
@@ -41,9 +41,9 @@ Generated from the same rows as the section above, for every harness in this est
 
 | field | `claude` | `grok` | `cursor` | `antigravity` |
 |---|---|---|---|---|
-| `name` | **required** | yes | **required** | yes |
+| `name` | **required** | yes | **required** | **required** |
 | `displayName` | yes | — | — | — |
-| `description` | yes | yes | yes | — |
+| `description` | yes | yes | yes | yes |
 | `version` | yes | — | yes | — |
 | `author` | yes | — | yes | — |
 | `skills` | yes | yes | yes | — |
@@ -65,7 +65,7 @@ Generated from the same rows as the section above, for every harness in this est
 | `rules` | — | — | yes | — |
 | `variables` | — | — | yes | — |
 
-**The part that travels**: `name`. Everything else is a bet on one product.
+**The part that travels**: `name`, `description`. Everything else is a bet on one product.
 
 **The part that does not, and says nothing when it does not**: a field absent from a column is not rejected there -- it is read past. Nothing warns, no run fails, and the component behaves differently with the same bytes. Where the field was carrying a restriction, the restriction is simply gone. Check the column before relying on one.
 
diff --git a/setups/nddev-builder/setup.json b/setups/nddev-builder/setup.json
index 85c9649..02856de 100644
--- a/setups/nddev-builder/setup.json
+++ b/setups/nddev-builder/setup.json
@@ -5,7 +5,12 @@
   "sources": [
     "https://cursor.com/docs/cli/reference/configuration",
     "https://cursor.com/docs/cli/reference/permissions",
-    "https://cursor.com/docs/reference/plugins"
+    "https://cursor.com/docs/hooks",
+    "https://cursor.com/docs/mcp",
+    "https://cursor.com/docs/plugins",
+    "https://cursor.com/docs/reference/plugins",
+    "https://cursor.com/docs/rules",
+    "https://cursor.com/docs/skills"
   ],
   "setup_stable_id": "setup_01M15ENRBHRMHPE7XP20T1R1R1",
   "setup_version": "1.5",