Evidence record / cursor

A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.

2026-10-13-cursor-origin-cli-has-versioned-channels-and-verifies-vendor-hashes-before-extraction

Origin CLI has versioned channels and verifies vendor hashes before extraction. The corrected Origin install snapshot contains distinct stable and latest version-addressed artifacts with vendor hashes. Its installer verifies the downloaded archive before extraction. The stable artifact is newer than the latest artifact in this observation. Neither the first introduction of checksum verification nor the exact pointer-selection time is established.

Channel: tagged-release (version-addressed Origin artifacts); docs-only (moving channel-pointer observation). Half: capability. Date: 2026-10-13 artifacts; installer pointers independently observed 2026-10-14.

Operator consequence: Keep Origin CLI pinning separate from agent-CLI pinning. Record channel, build and hash; do not rank builds by the latest label. Use the vendor verification mechanism without converting an October 14 pointer read into an October 13 end-of-day guarantee.

Receipt

Finding metadata

Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0

Finding ID: 2026-10-13-cursor-origin-cli-has-versioned-channels-and-verifies-vendor-hashes-before-extraction

Profile citations

  • cursor / claim / origin-cli-verified-artifacts

Source links

Primary links, including exact changelog lines when available.

Versioned source: run artifact