Cursor Origin setup

OpenReview uses an Origin App rather than a personal access token. Origin is in early beta; verify its current API reference when configuring the app.

1. A Cursor namespace administrator creates an OpenReview App with an Ed25519 public key. Keep the corresponding PKCS8 private key server-only. Register the exact installation redirect URI https://<openreview-origin>/api/origin/callback and webhook URL https://<openreview-origin>/api/origin/webhook.
2. Set ORIGIN_APP_ID and ORIGIN_APP_PRIVATE_KEY on the Next.js server. Set the same ORIGIN_APP_ID on Convex; it binds signed deliveries to your app. Provider credentials are encrypted using the existing CREDENTIAL_ENCRYPTION_KEY, so preserve that key for backup/restore. The Convex backend must be able to reach Origin's APIs and signing-key endpoint.
3. Subscribe the App to repository.pushed, pull_request.created, pull_request.published, pull_request.reopened, pull_request.closed, pull_request.merged, pull_request.metadata.updated, pull_request.head_ref.pushed, pull_request.base_ref.updated, pull_request.stack_parent.updated, and pull_request.comment.created. Origin automatically delivers installation lifecycle events.
4. In OpenReview Settings → Code Providers, select Connect Cursor Origin. The workspace admin approves metadata read, contents read, pull requests read, review read, review write, checks read, and namespace:user_tokens:write, then selects the repositories on Cursor's consent page. Grant repository:pull_requests:reviews:read explicitly, including for existing installations: it is required for native review and comment readback. OpenReview verifies the signed, five-minute installation receipt, cookie state, and workspace admin membership. Receipt identifiers are consumed atomically; an installation cannot be transferred to another workspace by repeating a callback.
5. Select authorized repositories in OpenReview, enable indexing, inspect its progress, and enable automatic reviews only after live webhook and publishing acceptance. Origin's public keys verify the exact raw body, delivery ID, timestamp and configured app identity. A durable lease prevents concurrent processing; interrupted processing retries within a bounded window. Installations that Origin suspends fail closed. Uninstalling clears credentials and disables connected repositories.

Origin's native installation tokens are short-lived and minted as needed. Repository and comment IDs remain opaque; PR version numbers are retained separately from Git commits, including base-only updates. Publishing verifies repository/PR identity and the current open version before and after submission. A concurrent provider update fails the job, though an already submitted native review may remain on its recorded older version. API errors, truncated trees and omitted diffs are failures, not complete reviews.

Review retries require the installed App's actor, exact body, verdict and native version, with no dismissal. Human, other-App and service-account copies of markers cannot establish publication receipts. Finding receipts additionally require the exact version, commit, file, side and line range. Native atomic review submissions support at most 50 findings; larger submissions fail visibly.

Mirrored repositories permit metadata and contents reads but reject pull requests, checks and every write. Treat Origin's 403 as authoritative. This integration cannot review a mirrored repository through Origin; connect its source provider instead.

Comments from human users mentioning @openreview route to the shared conversation engine. The actual question, author and body are read back inside the selected PR before queueing, processing, learning preferences and publishing. Native collaborator permissions require write or admin access and are checked again when processing and publishing a reply. @openreview review again queues a review of the current version; @openreview review security requests the security specialty. Both inline and general answers retain their native thread ID. Reply retries require the installed App and exact body, thread, version and anchor. Finding-pattern preferences are learned only from a verified finding thread and a user who still has write access.

Current validation covers native signing/token/discovery contracts, forged receipts, tenant isolation, replay, suspension/uninstall, durable event leases, collaborator permissions, publication identity/anchors, edited questions and version changes. The disposable scoped installation has live indexing, signed-event and inline publication evidence. Follow-up authorization, personal linking and human-pushed resolution remain incomplete. Do not claim live provider parity from contract tests.

Personal author identity and cross-repository context

Register https://YOUR_OPENREVIEW_HOST/api/origin/identity/callback in the App's installation redirect allowlist alongside the installation callback. In Settings → Personal settings, writers with access to a connected Origin repository select Confirm Cursor identity. The native confirmation screen shares identity and namespace membership; it does not grant repository access. OpenReview validates Origin's Ed25519 receipt type, issuer, audience, expiry, immutable user ID, installation, namespace and signed state against a five-minute account-bound cookie. Receipt IDs are consumed atomically. A callback for another workspace account, changed connection, or reused receipt fails. Cancelled confirmation has no callback; restart from Personal settings.

The verified identity link lasts 24 hours and is revocable. It stores an encrypted immutable identity assertion, not the confirmation receipt, email or delegated access token. Current native PR ingestion supplies the human author ID; App/service-account/mixed actor payloads cannot select a personal identity. Cross-repository context matches that ID on the exact installation and checks workspace/team access to every selected source.

The installation admin must approve namespace:user_tokens:write (reconnect an existing installation to add it). Origin's scope permits minting for active namespace members; OpenReview uses it only after personal signed confirmation. Before linking and before context/cache/model/publication validation, OpenReview freshly mints a read-only token scoped to the primary repository's immutable ID and metadata/contents/PR read, then verifies the native repository and namespace. Tokens are opaque, never persisted, never given write scopes, and expire no later than the five-minute App JWT. Membership removal, missing delegation scope, revoked installation, inaccessible repository, changed connection and disconnected personal link fail closed. Disconnect deletes the saved assertion and invalidates context receipts.

See the official Origin user confirmation and delegated-token flow. Automated checks cover the signed/native response contracts and shared authorization path. The App installation is live on the selected acceptance repository; personal signed confirmation is now persisted and current exact-repository delegated reads pass. See personal acceptance for live evidence and remaining authorization boundaries.

Exact-revision runtime source

The Origin adapter implements the current Get Repo Tarball contract. It accepts full lowercase 40- or 64-character commit IDs and requires a selected immutable repository ID. Native repository and Git commit identities are checked before and after download. It never uses a branch, abbreviated ref or default-branch fallback.

Origin streams the first archive for a commit, then responds with a short-lived signed download URL on subsequent requests. OpenReview follows only a single native 302. Configure ORIGIN_ARCHIVE_ALLOWED_HOSTS on Convex (and local CLI if used) with the exact HTTPS CDN hostname observed from a native Origin response. This is operator configuration, never PR-controlled; wildcards are not supported. The Origin API hostname is allowed by default. HTTPS, no user info/fragment/nonstandard port, and exact approved hostname are required. The signed URL is used without the App Bearer token; further redirects fail. URLs/signatures and App credentials are not included in diagnostics. An unapproved host creates an actionable failed source-preparation job; approve the actual host and re-review.

Responses are streamed with a 20 MB compressed limit, strict declared-size validation, gzip header checking and cancelled readers on failures. Native empty/missing revisions, denied responses, malformed URLs, unapproved hosts, changed repository/commit identities, missing bodies and size/format mismatches fail visibly. The current API documents one top-level archive directory, matching the sandbox worker's single-component extraction. Origin's earlier beta changelog described root entries; native layout/compatibility must be verified for the installed version before accepting runtime execution. Bytes are retained as a leased source snapshot and extracted only inside the separate, bounded, no-network Docker worker. Download success does not mean any command ran. Runtime remains disabled by default.

Node/native-response and durable Convex worker-source contracts pass. Actual first/cached archives and wrapper layout now have native readback, and the exact archive reproduces the seeded integer-cent failure in the existing Docker sandbox. The observed CDN host is artifacts.origin.cursor.com; see native runtime evidence. A hosted durable job, corrected pushed revision and full recovery remain unverified.

Opt-in native approval

Origin now implements native approval and dismissal through its version-bound review API. The shared policy remains disabled by default and requires the same complete review, exact revision, maximum confidence, risk, findings, runtime and human-objection gates as other supported providers. Durable approval jobs retain Origin opaque review IDs without converting them to numbers.

Fresh mergeability is queried with expectedHeadSha and checked against immutable repository and change identities. Native required-check owners/attempts are evaluated by Origin. Unknown verdicts or blocker kinds, failed/missing required checks, conflicts, codeowner requirements and ruleset errors block approval. The only permitted unmet native merge condition is required_approvals for this PR. Unreviewed stack ancestors block approval because the single-PR review does not cover their revisions; a complete stack review is not implemented. Additional configured checks must also pass; a GitHub numeric App ID cannot be satisfied by an Origin App identity.

Approval uses verdict approve plus explicit versionNumber. Replay requires the same App, exact body/operation marker, submitted active review, head, base and native version. Own-PR approvals are rejected. The durable coordinator rechecks policy/version after publication and dismisses the exact bot-owned review on a race. Dismissal uses the native PUT endpoint, validates returned identity and re-reads persisted dismissal; unrelated human/App reviews are never dismissed. Errors remain visible and retryable. No merge API is called.

See the official Origin review and mergeability APIs. Three Node native-response regressions and a durable Convex test cover positive publication/replay, opaque IDs, revision invalidation, required/unknown blockers, human objections, duplicate/wrong identities and dismissal. They do not establish live native approval; registration/selected-repository installation and full native acceptance remain pending.

Approval event rechecks and comparison bases

Subscribe to pull_request.review.submitted, pull_request.review.dismissed and repository.check_run.created/updated/completed alongside the existing PR lifecycle events. Verified, durable deliveries trigger fresh approval validation for only the selected connection/repository/change or matching check head. The handler validates native repository, suite and SHA consistency; a payload schedules validation but cannot itself approve or dismiss. Disabled repositories, foreign connections/repositories, completed duplicate deliveries and invalidated jobs do not dispatch new approval work. The five-minute sweep remains a recovery path.

Origin commit check listings include attempts for every comparison base. Configured OpenReview checks use only native runs whose repository and head match the reviewed PR, and whose base is either absent (base-agnostic) or exactly the reviewed version base. Passing runs from another base cannot satisfy policy. Native required-check owner/attempt logic is still evaluated by mergeability. See the official Origin check and webhook contracts. Native-response and durable event tests pass; real event delivery and native approval invalidation remain live acceptance requirements.

Live acceptance found that native PR DTOs omit repository: reads bind them to authenticated immutable metadata rather than requiring a nonexistent nested field. Native r_ repository IDs and mixed-case user IDs are accepted. Portal links use cursor.com/codebase. Source context is numbered for precise evidence without relaxing grounding. Failed verified deliveries can be retried by workspace admins in Settings → Providers; the same body/delivery ID is retained.

The disposable native repo has proven indexing, signed events, inline finding publication and macOS Claude Fix launch with a passing local regression. Human push/resolution remains pending. Native collaborator permission currently returns 404 for the installation token even though existing user CLI auth returns admin; follow-ups fail closed and this does not establish live follow-up support. See acceptance-matrix.md for evidence and remaining checks.

Native personal identity persistence correction (October 4)

The installed acceptance PR author uses a case-sensitive mixed-case user_… ID. Receipt verification and the native personal access probe already accepted that shape, but durable identity persistence incorrectly required lowercase. Persistence now preserves the full native ID and uses the same allowed shape. The signed-confirmation integration regression reproduces the old failure, then verifies linking, exact selected-repository token attenuation, non-persistence of delegated tokens, account binding, receipt replay rejection, native access denial, revision/installation authority and revocation using the mixed-case ID. Full 270-test suite, lint/typecheck and local/production build checks pass.

A fresh actual installation token read the selected repository and PR successfully, but both immutable and named repository collaborator permission endpoints still returned 404. The seeded PR head remains unchanged; no user token, grant change, follow-up reply, or agent relaunch was performed. Browser personal setup reaches native identity confirmation and displays the correct OpenReview app, account and namespace. Final confirmation awaits the user's action-time approval. This is preparation for live personal linking, not accepted follow-up support. See Origin's user confirmation contract: the native receipt proves identity/membership and does not itself grant repository access.

Current personal confirmation state — October 4, 2026

The earlier pending status above is superseded: the hosted identity is linked through October 5 at 16:01:01 UTC, and a fresh scoped native repository read succeeds. No delegated access token is persisted. This does not establish successful follow-up write authorization or full cross-repository review acceptance. See personal acceptance.

Personal authority during context retrieval

Origin primary authors and every selected Origin source now require fresh exact-repository delegated read checks before and after App source retrieval and before publication. A missing source link produces a coverage omission; legacy receipts without personal source authority fail validation. Actual bidirectional GitHub/Origin retrieval and publication-guard validation passed without inference. See context authorization acceptance. Follow-up write permission and native revocation through Cursor UI remain separate acceptance requirements.

Confirmed-author follow-up recovery

App-token collaborator 404 now invokes an exact-repository confirmed-identity fallback. A short-lived read-only delegated token checks the same immutable author’s native write/admin grants, then current local authority is rechecked. Other App errors, missing/expired/revoked links, mismatched IDs and read/custom roles remain denied. Actual native authorization and question readback pass without inference; a newly published answer and event retry still need acceptance. The App remains the publisher. See follow-up personal acceptance.