Implement via cursor-agent

A paid-pool write leg whose family is whatever model you pin — a
cursor-served Codex tier produces GPT-family work, a cursor-served Sonnet
produces Claude-family work. The cross-family rule reads the served model's
family: the reviewer for this leg's output must come from a different family
than the one you pinned here, and auto/composer-* output (family
unknown/undisclosed) must be reviewed by TWO named families to be safe —
cheaper to just pin a named model when the work will need a gate.

Before the first run of a session

Read `references/cursor-runtime.md`.
What bites the write role: bare -p already has full write and shell access
(measured — no --force needed, and none of --force/--yolo/
--approve-mcps may appear anyway), the prompt rides argv with an
unverified size cliff, and quota exhaustion is loud (ActionRequiredError,
exit 1) so a dead dispatch tells you immediately.

Worktree, snapshot, then dispatch

Every write leg gets its own worktree, without exception — same rule, same
helpers, same reasons as the other families (the CLI's own --worktree
under ~/.cursor/worktrees is not used; the suite's helpers own directory
lifecycle):

RUN_DIR=$(mktemp -d "${TMPDIR:-/tmp}/cursor-implement.XXXXXX")   # FIRST — the snapshot lands here
BASE=$(git rev-parse HEAD)   # from a clean checkout, recorded before anything
WORKTREE=../<repo>-cursor-<short-task-slug>
git worktree add -b cursor/<short-task-slug> "$WORKTREE" "$BASE"
# The helper lives in the SUITE's tree, cwd is the TARGET repo — a bare
# `scripts/…` resolves against the target and exits 127.
DEV_LEAD=${DEV_LEAD_ROOT:-$(ls -d "$HOME"/.claude/plugins/cache/dev-lead/dev-lead/* 2>/dev/null | sort -V | tail -1)}
[ -x "$DEV_LEAD/scripts/snapshot-refs.sh" ] || { echo "dev-lead root unresolved — set DEV_LEAD_ROOT to your checkout"; exit 1; }
"$DEV_LEAD/scripts/snapshot-refs.sh" save "$WORKTREE" "$RUN_DIR/remote-refs.before"   # push-detection baseline

The snapshot is the no-push evidence on this adapter: the shell tool is
fully available in the write posture, so the rule is instruction level —
state it in the task prompt, then let the fail-closed ref check at handoff
prove what happened either way.

Launch

# Write the task prompt to "$RUN_DIR/task.md" in its own FOREGROUND step.
cd "$WORKTREE" && \
  cursor-agent -p --trust \
    --model '<family-pinned-model>' \
    --output-format json \
    "$(cat "$RUN_DIR/task.md")" > "$RUN_DIR/impl.json" 2> "$RUN_DIR/impl.err"

• Bare -p IS the write posture (measured: creates files, runs shell, no
  prompting) — that is exactly why this launch happens only inside a
  dedicated worktree, and why the review leg never uses it.
• --model pinned and recorded — the run log must name adapter, model
  flag, and the request_id returned in $RUN_DIR/impl.json; the
  reviewer-family decision downstream depends on it.
• JSON audit output — preserve the whole impl.json: its result is the
  delegate's report and its session_id/request_id bind that report to the
  dispatch. On failure, inspect impl.err; never fabricate an id from mixed
  stdout/stderr.
• Task prompt must state: local commits only, never push, list what was not
  finished rather than improvising around it.

Handoff

"$DEV_LEAD/scripts/snapshot-refs.sh" check "$WORKTREE" "$RUN_DIR/remote-refs.before" || exit 1
git -C "$WORKTREE" status --porcelain=v1
git -C "$WORKTREE" diff "$BASE" --stat

The helper exits nonzero on a remote-ref delta, and || exit 1 makes that
failure terminal for this handoff. Do not replace it with a second snapshot
and a raw diff, which can be noticed but accidentally continued past.

Whether cursor-agent leaves the worktree committed or dirty is UNVERIFIED —
expect either; the lead's own verification pass (build, tests, real code
path) is the merge gate regardless, followed by a reviewer from a
different model family than the one pinned above.