feat: add agent surfaces for Cursor, Windsurf, Gemini CLI

.agentrust/cursor-baseline.json

@@ -0,0 +1,12 @@
+{
+  "captured_at": "2026-08-16T06:22:53Z",
+  "scope": 1,
+  "observed": [
+    "rules",
+    "skills",
+    "mcp"
+  ],
+  "rules": {},
+  "skills": {},
+  "mcp": {}
+}

.agentrust/gemini-cli-baseline.json

@@ -0,0 +1,12 @@
+{
+  "captured_at": "2026-08-16T06:22:53Z",
+  "scope": 1,
+  "observed": [
+    "context",
+    "skills",
+    "mcp"
+  ],
+  "context": {},
+  "skills": {},
+  "mcp": {}
+}

.agentrust/windsurf-baseline.json

@@ -0,0 +1,10 @@
+{
+  "captured_at": "2026-08-16T06:22:53Z",
+  "scope": 1,
+  "observed": [
+    "rules",
+    "skills"
+  ],
+  "rules": {},
+  "skills": {}
+}

.github/workflows/cursor-integrity.yml

@@ -0,0 +1,25 @@
+name: Cursor integrity
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+      - name: Verify the approved Cursor composition
+        uses: ./cursor
+        with:
+          # Keep fork pull requests read-only. The job summary carries the same
+          # result without requiring pull-requests: write.
+          comment: "false"
+          fail-on-drift: "true"

.github/workflows/cursor-tests.yml

@@ -0,0 +1,50 @@
+name: cursor tests
+
+on:
+  pull_request:
+    paths:
+      - "cursor/**"
+      - ".github/workflows/cursor-tests.yml"
+  push:
+    branches: [main]
+    paths:
+      - "cursor/**"
+      - ".github/workflows/cursor-tests.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  tests:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.9", "3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Run the suite against the core in this checkout
+        run: |
+          pip install ./packages/agentrust-capture-core pytest
+          cd cursor
+          python -m pytest tests -q
+
+  self-check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+      - name: Install the core from this checkout
+        run: pip install ./packages/agentrust-capture-core
+      - name: Snapshot this repository's Cursor composition
+        run: python cursor/engine/capture.py snapshot
+      - name: Verify against the committed baseline
+        run: python cursor/engine/capture.py verify

.github/workflows/gemini-cli-integrity.yml

@@ -0,0 +1,25 @@
+name: Gemini CLI integrity
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+      - name: Verify the approved Gemini CLI composition
+        uses: ./gemini-cli
+        with:
+          # Keep fork pull requests read-only. The job summary carries the same
+          # result without requiring pull-requests: write.
+          comment: "false"
+          fail-on-drift: "true"

.github/workflows/gemini-cli-tests.yml

@@ -0,0 +1,50 @@
+name: gemini-cli tests
+
+on:
+  pull_request:
+    paths:
+      - "gemini-cli/**"
+      - ".github/workflows/gemini-cli-tests.yml"
+  push:
+    branches: [main]
+    paths:
+      - "gemini-cli/**"
+      - ".github/workflows/gemini-cli-tests.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  tests:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.9", "3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Run the suite against the core in this checkout
+        run: |
+          pip install ./packages/agentrust-capture-core pytest
+          cd gemini-cli
+          python -m pytest tests -q
+
+  self-check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+      - name: Install the core from this checkout
+        run: pip install ./packages/agentrust-capture-core
+      - name: Snapshot this repository's Gemini CLI composition
+        run: python gemini-cli/engine/capture.py snapshot
+      - name: Verify against the committed baseline
+        run: python gemini-cli/engine/capture.py verify

.github/workflows/windsurf-integrity.yml

@@ -0,0 +1,25 @@
+name: Windsurf integrity
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+      - name: Verify the approved Windsurf composition
+        uses: ./windsurf
+        with:
+          # Keep fork pull requests read-only. The job summary carries the same
+          # result without requiring pull-requests: write.
+          comment: "false"
+          fail-on-drift: "true"

.github/workflows/windsurf-tests.yml

@@ -0,0 +1,50 @@
+name: windsurf tests
+
+on:
+  pull_request:
+    paths:
+      - "windsurf/**"
+      - ".github/workflows/windsurf-tests.yml"
+  push:
+    branches: [main]
+    paths:
+      - "windsurf/**"
+      - ".github/workflows/windsurf-tests.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  tests:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.9", "3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Run the suite against the core in this checkout
+        run: |
+          pip install ./packages/agentrust-capture-core pytest
+          cd windsurf
+          python -m pytest tests -q
+
+  self-check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+      - name: Install the core from this checkout
+        run: pip install ./packages/agentrust-capture-core
+      - name: Snapshot this repository's Windsurf composition
+        run: python windsurf/engine/capture.py snapshot
+      - name: Verify against the committed baseline
+        run: python windsurf/engine/capture.py verify

README.md

@@ -49,11 +49,12 @@ TRACE only works as a standard if it is genuinely neutral. Integrations are list
 | [scheduled-agents](scheduled-agents/) | agentrust-io | trace | community |
 <!-- integration-index:end -->
 
-The [Copilot drift check](copilot/) is intentionally outside this manifest index:
-it emits neither TRACE nor Agent Manifest today, so it cannot truthfully select
-an `integrates_with` value from the current schema. See the note below.
+The [Copilot](copilot/), [Cursor](cursor/), [Windsurf](windsurf/) and
+[Gemini CLI](gemini-cli/) drift checks are intentionally outside this manifest
+index: none of them emit TRACE or Agent Manifest today, so none can truthfully
+select an `integrates_with` value from the current schema. See the note below.
 
-All four engines share [`agentrust-capture-core`](packages/agentrust-capture-core),
+All seven engines share [`agentrust-capture-core`](packages/agentrust-capture-core),
 which owns fingerprinting, comparison, baseline sealing and the report honesty rules.
 
 Adapters that build a Trust Record from evidence **another system produced** share
@@ -62,22 +63,24 @@ carry `origin.kind: third-party-control-plane`, `runtime.platform: software-only
 `appraisal.status: none`, so the assurance downgrade is something a consumer reads from
 the record rather than from a README. None of the three is a parameter.
 
-**Note on the Copilot entry.** It is a pull-request status check rather than a
-session hook, because Copilot's composition lives in the repository. It emits no
-TRACE record and no Agent Manifest, so it claims neither: `integrates_with` offers
-only `cmcp`, `trace` and `agent-manifest`, and asserting one today would be an
-unverifiable claim.
+**Note on the Copilot, Cursor, Windsurf and Gemini CLI entries.** Each is a
+pull-request status check rather than a session hook, because all four agents'
+composition lives in the repository rather than a developer's home directory.
+Each emits no TRACE record and no Agent Manifest, so each claims neither:
+`integrates_with` offers only `cmcp`, `trace` and `agent-manifest`, and asserting
+one today would be an unverifiable claim.
 
 That is currently blocked on a spec question rather than on implementation, tracked
 in [agent-manifest#256](https://github.com/agentrust-io/agent-manifest/issues/256).
-TRACE describes an execution and this check describes a composition, so a TRACE
+TRACE describes an execution and these checks describe a composition, so a TRACE
 record is the wrong artifact. Agent Manifest is the right one, but every level
-requires `artifacts.model_identity`, and a repository cannot know the model: Copilot
-picks it at session time from the user's plan and settings. The same repository
-serves every model, with an identical contributed composition. Manufacturing a
-model to satisfy the field would be exactly the kind of unverifiable claim
-`CONTRIBUTING.md` rules out, so the integration ships without one until the spec
-has a way to express a composition whose model is unknowable at authoring time.
+requires `artifacts.model_identity`, and a repository cannot know the model: each
+of these agents picks it at session time from the user's own plan and settings.
+The same repository serves every model, with an identical contributed composition.
+Manufacturing a model to satisfy the field would be exactly the kind of
+unverifiable claim `CONTRIBUTING.md` rules out, so all four integrations ship
+without one until the spec has a way to express a composition whose model is
+unknowable at authoring time.
 
 ## Community
 

cursor/CHANGELOG.md

@@ -0,0 +1,14 @@
+# Changelog
+
+All notable changes to the AgenTrust Cursor drift check.
+
+## Unreleased
+
+### Added
+- Initial release. Measures Cursor rules (`.cursor/rules/**/*.mdc` including
+  nested folders, `AGENTS.md` anywhere in the tree, `.cursorrules` legacy),
+  skills (`.cursor/skills/`, `.agents/skills/`, `.claude/skills/`,
+  `.codex/skills/`, anywhere in the tree, category subfolders included), and
+  MCP configuration (`.cursor/mcp.json`), verified against cursor.com/docs
+  (Customize > Rules, Customize > Skills, Customize > MCP) rather than
+  assumed from a general path table. See #78.