CU-1: reproduce the Cursor write-gate allow on a Windows runner (diagnostic)

[jothimani-rajendran]

What

CU-1 follow-up. On the owner's Windows machine, the Cursor preToolUse pin hook answers allow to the witnessed payload when the hook process starts in the user's home folder, and deny when it starts in the repo.

This PR adds a temporary workflow, cu1-diag.yml, plus .github/cu1-diag/. The job, on windows-latest with Python 3.14.3:

1. builds the witness selection (chock-catalog f23cb0e: block-no-verify and pin-github-actions) for Cursor into the runner's home, at ~/.cursor/plugins/local/chock-witness;
2. creates ~/witness-repo-cursor with git init only;
3. traces the owner's captured payload (ids redacted, paths rewritten to the runner's home) from home and from the repo:
   • the read-only diagnostic chock_diag.py;
   • the pin hook command, verbatim from hooks.json, under Git Bash;
   • the diagnostic again under pwsh.

If the runner reproduces the bug, the fix, a regression test and 3.14.3 in the windows-paths matrix land here, and the temporary job is removed. If it does not, both outputs are posted here and the work stops.

Definition of done

• Diagnostic run read and outcome recorded here
• Temporary workflow and .github/cu1-diag/ removed before ready
• actionlint and zizmor --offline clean; actions pinned by SHA; contents: read; persist-credentials: false

🤖 Generated with Claude Code

---

Generated by Claude Code

[jothimani-rajendran]

Result: does not reproduce on windows-latest. Run 38061466227, head 3272d38, Python 3.14.3, the witness selection built with chock install --client cursor into C:\Users\runneradmin\.cursor\plugins\local\chock-witness, and ~/witness-repo-cursor created with git init only. The payload is the owner's capture, with paths rewritten to the runner home.

Both outputs, with the long gate message elided (…). The two cwds print identical lines except cwd:

######## diag, cwd = C:/Users/runneradmin          | ######## diag, cwd = C:/Users/runneradmin/witness-repo-cursor
python          '3.14.3'                          | same
os.name         'nt'                              | same
cwd             'C:\\Users\\runneradmin'          | 'C:\\Users\\runneradmin\\witness-repo-cursor'
GIT_* env       {}                                | same
event           ('pre_tool', 'Write', 'C:\\Users\\runneradmin\\witness-repo-cursor\\.github\\workflows\\witness.yml', None)
workspace_root  'C:/Users/runneradmin/witness-repo-cursor'
root_for(gate)  None
repo_root_for   'C:\\Users\\runneradmin\\witness-repo-cursor'
judged keys     ['.github/workflows/witness.yml']
run_gate        ('blocked', "Unpinned GitHub Action detected: … - .github/workflows/witness.yml: content pattern")
evaluate_gate   ('deny', …)
toggle source   (None, None)
wrapper argv    [...\scripts\cursor.py, '--gate', ...\scripts\pin-github-actions\gate.json]
pin hook as Cursor runs it (git -c alias… under Git Bash): {"permission": "deny", …}   (both cwds)
pwsh diag: identical to the above, both cwds

So on a clean Windows host, the root comes from workspace_roots whatever the cwd, and the pin hook refuses. The difference is on the owner's machine (toggle state, home contents, or Cursor itself). No code change; stopping here per the plan. The temporary workflow and .github/cu1-diag/ stay until the orchestrator decides.

---

Generated by Claude Code