[matdev83]

Standalone Cursor SDK plugin: v2 credential registration, enforced end to end

What this does

The host now requires a versioned credential contract on a static export (credential_contract v2: class: api_key, source: host_env, env_root: CURSOR_API_KEY, slot: api_key, selection: session_admission, quota_domain: cursor). A host built from current main refuses a manifest without it — backendplugins/catalog: enabled kind unresolved — while the published host v0.1.0 refuses a manifest that has it, so the two dialects are mutually exclusive.

This PR declares the contract, makes the connector behave exactly as the declaration says, and stops the release metadata from claiming a certification the changed manifest no longer has.

Changes

1. Manifest registration. The contract is declared in the manifest template, the packager's renderer, both package verifiers, and the certification gate, so a built archive cannot describe a registration the source does not declare.

2. Credential ingress, enforced (F1, R2-F2). internal/service/credentials.go ports the host-side invariants: strict YAML decode with the forbidden secret-field scan (same field list and normalization as the host), ordered api_key/api_key_2..N decode with the host's budgets, exactly one admitted slot, and that slot must be named exactly api_key — the environment root has no numbered form, so a lone api_key_2 is rejected rather than treated as a synonym. No YAML key material, no environment or file fallback, no rotation, no pooling. The regression suite deleted with the in-tree module is restored here: absent, duplicate, numbered, unknown, valid single slot, per-session binding, no replay after effects.

3. Certification harness, host-secret path (F2). The harness now binds a fixed synthetic key through backend_discovery.instances.secret_refs and forwards CURSOR_API_KEY in the host process environment; the inline api_key line is gone, so every enabled-backend case proves the declared path. A real-host negative case asserts a literal api_key is rejected — and it asserts each command independently: doctor and serve must each fail with the connector's forbidden-field classification, name the approved root, and carry neither the rejected value nor the bound secret. Pooled output would let one command fail correctly while the other died of something else.

4. Release provenance and version identity (F5). release.yaml declares host_certification: uncertified with a reason naming the blocker, and the release workflow refuses to publish an uncertified revision — so this source cannot be published by accident, and the old v0.1.0 certificate is not carried forward as coverage for the v2 manifest. The source is versioned 0.2.0 (release.yaml, manifest template, compiled descriptor) with the private bridge package bumped in lockstep; cursorsdk-v0.1.0 is already published with the v1 registration, and two different ABIs must not share a version. Packaging fixtures now read the declared version instead of hardcoding one.

5. PowerShell verifier. The renderer writes host_certification_platforms as JSON null for an uncertified record; the PowerShell verifier treated a present-but-null value as a present list and failed under Set-StrictMode. It now reads null as absent, matching the shell verifier.

Evidence

• CI at b7c6878: all 7 lanes pass — Go (released contracts only), Go race, native Windows full suite, macOS development evidence, both native package lanes, Node bridge.
• Real-host certification gate: 14/14, against a host binary built from main@bc0ddabf plus the extracted Configure-rejection fix (#1403, host revision 39287274, binary sha256 b1b4b1a9b53b785290f7ed5063747db351b36eceb64837ad3139224c7480c716), against a tree rendered from this branch at b7c6878 (manifest 0.2.0, contract v2). The run includes discovery, trust, manifest identity, inactive discovery, negotiation, inventory, canonical execution, explicit refusal, multi-user denial, all three prerequisite failures, the per-command inline-key rejection, the companion contract, and the unchanged-tree check. This is linux/amd64 evidence on this machine; Windows is covered by the release workflow's own leg.
• Earlier run corrected: the previously reported pass used this repository's host-removal branch tip ef784ffb (sha256 4baa163f…), not main. That host contained the fix, which is exactly why the fix was extracted into #1403 before a release is cut from main.
• Local go test ./... green; go vet ./... clean.

Not in this PR

• The host panic fix — extracted to #1403 so the release line can carry it independently of the blocked removal PR.
• Host provisioning behavior (F3) — secret_refs remains the explicit binding an operator writes; the docs, config sample, and example now say so. Auto-provisioning agent runtimes from the manifest would change shared composition and billing-adjacent secret flow; that needs its own decision.
• ARM64 — the in-tree manifest declared it and no assembled or certified standalone artifact ever covered it. The host spec records it as a withdrawn unverified claim needing owner sign-off, not an approved reduction.
• Publication — blocked until a host release carrying the v2 ABI exists; the gate is then re-run against those exact published binaries on both declared platforms.

Ordering

Merge this (it publishes nothing) → merge #1403 → release the v2-capable host from main with the in-tree Cursor fallback retained → certify and publish plugin 0.2.0 against those artifacts → the host removal merges and task 6.3 closes.

Watch item: the shared-conformance cancellation case (transport_death) failed twice and passed twice on identical code across earlier runs; the path is the pinned rc.1 adapter and the untouched run stream, and it is green at this head.