test(evals): pin secure confirmation and team warning repairs (#19333)

## Thinking Path

> - Paperclip manages AI agents and human approval for work.
> - The chat catalog measures real user journeys through TestOps.
> - The last personal-secret journey reached a valid secure-save
confirmation that its observer rejected.
> - The team journey reported a missing named skill with a typographic
apostrophe that its observer rejected.
> - A company-secret request returned body validation before the
required agent authorization denial.
> - This PR pins one reviewed source that addresses these boundaries
without changing the requests, models, or time limits.
> - New native measurements must establish the result. Existing failures
remain failures.

## Linked Issues or Issue Description

Refs: #19084
Refs: #19112
Refs: #19325
Refs: #19261

This is the single successor pin for the reviewed personal confirmation,
team warning, and company authorization changes. It does not merge those
core or full-catalog branches into master.

## What Changed

- Pin immutable source `ab0f5246f765058af702b93d9b6637f2ef5b83cd`, tree
`6cf28980b0ab6d1dd8e54efda3996708c53aeb98`.
- Bind the exact descriptor snapshot
`0b57bba133a5c15860ca77b804f7282b5314d7feb8efbfd6f11fca42cdbdee49` and
matching target test.
- Advance personal-secret v9 to v10 and team-install v4 to v5. Record
the personal confirmation helper and its existing contract/flow inputs
in source provenance.
- Disclose the unmerged company-secret authorization fix from #19325. It
denies scoped agent creation before body validation and gives safe human
entry guidance. Board creation remains unchanged.
- Retain the original query history, including the single previously
approved multipart-form clarification. Preserve all 244 identities, the
196/244 gate, model, clocks, native and human bounds, SDK registry,
launcher, and private evidence protocol.

## Verification

- Pin-local checks: all **38** manifest, adapter, and reconcile controls
passed with `node --test
tests/runner-e2e/chat-full-catalog-testops-manifest.test.mjs
tests/runner-e2e/chat-full-catalog-testops-adapter.test.mjs
tests/runner-e2e/chat-full-catalog-testops-reconcile.test.mjs`.
- Exact source qualification: the combined domain run passed 328
controls and skipped one optional canary. Its two local listener
failures were sandbox EPERM setup failures. The same two controls then
passed with the authorized local listener, in a 73-control run. The
eight new route authorization controls also passed. These local runs do
not prove native completion.
- Full E2E TypeScript passed on exact source ab0 after reuse of the
healthy, same-source workspace graph. Earlier missing-alias graph
failures are retained. A full local server build or repository-wide
suite was not run; #19325 has its own core checks.
- The source SDK guard verified all **506** registered input Git blobs
unchanged, registry
`efa70621e9fb42aa185f7ee616a1a726aa3eccb367e67e28817cedf26ef2ade8`. No
SDK build or qualification renewal was needed.
- Actual anchored controller dependency check: `prepare-report-lock.mjs`
returned `already-reviewed`, then pnpm **9.15.4** completed the frozen,
ignore-scripts install in 17 seconds. This exercised the current
upstream Claude ACP patch and reporting output
`dd5934060dd06b8e731e3beeed49daf918d1a0b2a6c32d3da7815f2e7f0b3691`. It
made no tracked lock or policy change. Earlier source-lock and
controller-lock evidence remain separate.
- Existing failed personal/team attempts remain failed. The company
initial noncompletion remains uncorrected as an outcome claim; the
authorization fix addresses one proven error boundary only. Team
repeat/link checks were not reached in the failed measurement and remain
required. No uniform-ten PASS or new native feature PASS is claimed.
- Next validation is a controlled TestOps measurement after normal pin
merge and fresh actual-controller proof. Any later whole-ten regression
is separate. All attempts remain recorded; there is no retry-until-green
policy.
- Exact head `58d4a9b2d3c90be725e8877873010295122fb9c0`: required CI
aggregates `ci / e2e` and `ci / verify` passed in run 42099871883.
Windows passed in run 42099871391. Genuine Greptile review is 5/5 on
that exact head, with zero unresolved threads. The complete rollup has
56 successes, three configured skips, and one neutral check; no pending
or adverse check remains. No native measurement ran as part of these
checks.

## Risks

- Personal v10 accepts two logical human inputs: the original chat
request and a separately verified same-human secure-save confirmation.
The raw chat count remains one. This is a disclosed fixture variant, not
proof from a new native journey.
- The new confirmation fields do not change the trusted publisher schema
or its closed enums. Existing private helper and launcher bytes remain
unchanged.
- Team v5 only normalizes the apostrophe in its warning predicate. Saved
state, named-skill truth, repeat idempotency, links, and
contradictory-success guards still apply.
- The authorization fix is present only in the pinned source. #19325
remains unmerged; its effect on the unfinished native turn is unproven.

## Model Used

OpenAI `gpt-6.1-sol` through Codex, with reasoning, repository tools,
and local code execution. The context window size is not reported by
this runtime. No model inference was used for local tests.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` /
`Closes: #` / `Refs: #` OR (b) described the issue in-PR following the
relevant issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

Co-authored-by: Paperclip <noreply@paperclip.ing>

tests/runner-e2e/chat-full-catalog-testops-manifest.json

@@ -1,6 +1,6 @@
 {
   "schema": "paperclip.chat-full-catalog-testops-manifest/v1",
-  "targetSha": "6773b1c128a2e7efa7571ff04b38238f00d06117",
+  "targetSha": "ab0f5246f765058af702b93d9b6637f2ef5b83cd",
   "metadataSourceSha": "de0941835cc8f0d01c982574ee258e110babdbeb",
   "profile": "runner-opencode",
   "model": "openrouter/deepseek/deepseek-v4.1-flash-1017",
@@ -172,7 +172,7 @@
       "baseTargetSha": "3b66c3c144360ddf32714a0742fd774b8ceafb16",
       "previousTargetSha": "ab2019e976076ec0eb60b026844f3d9211cb0208",
       "definitionSourceSha": "de0941835cc8f0d01c982574ee258e110babdbeb",
-      "candidateDescriptorSha256": "aaf15ca6755fcfe550daa98bca1ed263e3d625159b53cd1e1f52fefbf9474778",
+      "candidateDescriptorSha256": "0b57bba133a5c15860ca77b804f7282b5314d7feb8efbfd6f11fca42cdbdee49",
       "changedDefinitionFiles": [
         {
           "path": "tests/runner-e2e/chat-scenarios/companies.yaml",
@@ -199,7 +199,7 @@
           "sha256": "91a9ddc4f5357f19a2cdc73ff8a090c741d14780e4ed502c856ebd557986f7e1"
         }
       ],
-      "conditions": "Historical qualification conditions (retained; statements that all requests or sourceFiles remain fixed refer to those earlier successors): New candidate measurements only. Original definitions, prior failed attempts and source6 ab201 remain historical. This target retains that catalog and integrates merged runtime fixes #18711, #18713 and #18718, with the prior-run restoration condition adapted to its existing owner. It adds the reviewed previous-question locator, attributed human-only denial and conditional-outcome oracle, and actor-sensitive timeline narrative/recorded-reassignment fixes. Closed finish diagnostics retain an effective schema digest, hashed call correlation and bounded type/category enums only. Historical MCP timeout and continuation-shape causes remain unresolved; no new all-ten PASS is claimed. Queries, model, human/native counts and original clocks remain fixed; the earlier Studio144 explicit 2..3 accounting stays. Core PRs18717/18734/18742 are now merged. SDK115 completion remains UNKNOWN and the other five SDK cases remain held. Full244 runtime catalog is not merged to master and the196/244 gate is unchanged. This successor binds the seven reviewed scenario repairs plus framework evidence: canonical skill navigation, original announcement phase clock, attributed timeline context, bound hire revision history, credential warning and configuration-question admission, completed team visibility, and canonical private framework evidence. Twelve declaration fields across eleven cases change only oracle versions and skill source-file provenance. All original requests, setup, human/native bounds, model and clocks remain fixed. Historical failed attempts and missing-original UNKNOWN grades remain unchanged; no uniform-ten PASS is claimed. The existing SDK506/efa qualification is reused only for byte-identical registered source inputs. This next successor adds reviewed question-surface observation, grounded scenario grading and safe credential-guidance boundaries after the retained uniform attempt. Eleven existing oracle-version leaves advance; all sourceFiles declarations, requests, setup, counts, clocks, model, launcher and private protocol helpers remain fixed. Component qualification does not attest a new uniform-ten pass.\n\nCurrent successor conditions: This successor measures five reviewed repairs at the retained original model and bounds. Exactly one request is clarified: multipart53 now explicitly asks to walk through the visible form; its original broad request and failures4623/4717 remain historical. The previous inventory0cf530 is retained and the disclosed clarified inventory is814bb363. Other243 catalog requests are unchanged. The company-secret second human message now references the actual saved non-secret metadata instead of repeating the initial request; native continuation must remain attributed to the actual agent. Five oracle-version leaves and four source-file additions change; launcher, private helpers, SDK506/efa, identities, counts, clocks and the196/244 gate remain fixed. All five successor journeys remain unrun; component proof is not a PASS. For Team610, independently saved canonical skill/version/member proof establishes recovery; no required recovery-success phrase is imposed. A contradictory current denial still fails. If the required skill remains missing, truthful disclosure of that condition remains required.",
+      "conditions": "Historical qualification conditions (retained; statements that all requests or sourceFiles remain fixed refer to those earlier successors): New candidate measurements only. Original definitions, prior failed attempts and source6 ab201 remain historical. This target retains that catalog and integrates merged runtime fixes #18711, #18713 and #18718, with the prior-run restoration condition adapted to its existing owner. It adds the reviewed previous-question locator, attributed human-only denial and conditional-outcome oracle, and actor-sensitive timeline narrative/recorded-reassignment fixes. Closed finish diagnostics retain an effective schema digest, hashed call correlation and bounded type/category enums only. Historical MCP timeout and continuation-shape causes remain unresolved; no new all-ten PASS is claimed. Queries, model, human/native counts and original clocks remain fixed; the earlier Studio144 explicit 2..3 accounting stays. Core PRs18717/18734/18742 are now merged. SDK115 completion remains UNKNOWN and the other five SDK cases remain held. Full244 runtime catalog is not merged to master and the196/244 gate is unchanged. This successor binds the seven reviewed scenario repairs plus framework evidence: canonical skill navigation, original announcement phase clock, attributed timeline context, bound hire revision history, credential warning and configuration-question admission, completed team visibility, and canonical private framework evidence. Twelve declaration fields across eleven cases change only oracle versions and skill source-file provenance. All original requests, setup, human/native bounds, model and clocks remain fixed. Historical failed attempts and missing-original UNKNOWN grades remain unchanged; no uniform-ten PASS is claimed. The existing SDK506/efa qualification is reused only for byte-identical registered source inputs. This next successor adds reviewed question-surface observation, grounded scenario grading and safe credential-guidance boundaries after the retained uniform attempt. Eleven existing oracle-version leaves advance; all sourceFiles declarations, requests, setup, counts, clocks, model, launcher and private protocol helpers remain fixed. Component qualification does not attest a new uniform-ten pass.\n\nPrevious successor conditions (retained): This successor measures five reviewed repairs at the retained original model and bounds. Exactly one request is clarified: multipart53 now explicitly asks to walk through the visible form; its original broad request and failures4623/4717 remain historical. The previous inventory0cf530 is retained and the disclosed clarified inventory is814bb363. Other243 catalog requests are unchanged. The company-secret second human message now references the actual saved non-secret metadata instead of repeating the initial request; native continuation must remain attributed to the actual agent. Five oracle-version leaves and four source-file additions change; launcher, private helpers, SDK506/efa, identities, counts, clocks and the196/244 gate remain fixed. All five successor journeys remain unrun; component proof is not a PASS. For Team610, independently saved canonical skill/version/member proof establishes recovery; no required recovery-success phrase is imposed. A contradictory current denial still fails. If the required skill remains missing, truthful disclosure of that condition remains required.\n\nCurrent successor conditions: This target adds the reviewed personal secure-entry confirmation handoff, the typographic team partial-warning observer correction, and the company-secret authorization fix from unmerged core PR #19325. Personal v10 retains two declared logical human actions: one canonical chat request plus one independently verified same-human secure-save confirmation handoff. Raw chat comments remain one. Team v5 accepts the actual named-skill warning with a typographic apostrophe; saved-state, repeat, runtime, link, and false-success checks remain required. The company route returns scoped 403 guidance before malformed-body validation and preserves board-only creation. Its effect on the unfinished native turn is unproven. The three affected journeys are unrun on this target. Existing failed attempts remain failed. All queries, expected outcomes, native and human bounds, clocks, profile, model, launcher, private protocol, SDK506/efa, and the 196/244 admission gate remain fixed, including the recorded case53 query clarification. Local component proof is not native feature qualification or main/core merge credit.",
       "changedFields": [
         {
           "key": "activity.work-timeline",
@@ -673,6 +673,9 @@
           ],
           "current": [
             "chat-catalog-domains/external-personal-secret.ts",
+            "chat-catalog-domains/external-personal-secret-confirmation.ts",
+            "chat-catalog-contract.ts",
+            "chat-catalog-flow.ts",
             "chat-catalog-domains/external-secret-question.ts",
             "chat-catalog-domains/external-secret-route.ts",
             "chat-catalog-domains/external-secret-endpoint.ts",
@@ -702,7 +705,7 @@
           "key": "secrets.personal-secret",
           "field": "oracleVersion",
           "previous": "paperclip.chat-catalog.external.v1",
-          "current": "paperclip.chat-catalog.personal-secret.v9"
+          "current": "paperclip.chat-catalog.personal-secret.v10"
         },
         {
           "key": "skills.author-skill",
@@ -938,7 +941,7 @@
           "key": "teams.install-team",
           "field": "oracleVersion",
           "previous": "paperclip.chat-catalog.external.v1",
-          "current": "paperclip.chat-catalog.team-install.v4"
+          "current": "paperclip.chat-catalog.team-install.v5"
         },
         {
           "key": "questions-and-approvals.multi-part-question",
@@ -1391,6 +1394,9 @@
           ],
           "current": [
             "chat-catalog-domains/external-personal-secret.ts",
+            "chat-catalog-domains/external-personal-secret-confirmation.ts",
+            "chat-catalog-contract.ts",
+            "chat-catalog-flow.ts",
             "chat-catalog-domains/external-secret-question.ts",
             "chat-catalog-domains/external-secret-route.ts",
             "chat-catalog-domains/external-secret-endpoint.ts",
@@ -1431,7 +1437,7 @@
           "key": "secrets.personal-secret",
           "field": "oracleVersion",
           "previous": "paperclip.chat-catalog.external.v1",
-          "current": "paperclip.chat-catalog.personal-secret.v9"
+          "current": "paperclip.chat-catalog.personal-secret.v10"
         },
         {
           "key": "skills.author-skill",
@@ -1711,7 +1717,7 @@
           "key": "teams.install-team",
           "field": "oracleVersion",
           "previous": "paperclip.chat-catalog.external.v1",
-          "current": "paperclip.chat-catalog.team-install.v4"
+          "current": "paperclip.chat-catalog.team-install.v5"
         }
       ],
       "runtimeConditions": {
@@ -1845,7 +1851,7 @@
       },
       "candidateLauncherSnapshot": {
         "path": "fixtures/chat-repair-candidate-launcher.txt",
-        "targetSha": "6773b1c128a2e7efa7571ff04b38238f00d06117",
+        "targetSha": "ab0f5246f765058af702b93d9b6637f2ef5b83cd",
         "sourcePath": "tests/runner-e2e/launch.ts",
         "gitBlobOid": "c88df15f509b2ac8638af826647a97d45f16bd1f"
       }
@@ -11299,9 +11305,12 @@
         "secrets/user-secrets"
       ],
       "checks": null,
-      "oracleVersion": "paperclip.chat-catalog.personal-secret.v9",
+      "oracleVersion": "paperclip.chat-catalog.personal-secret.v10",
       "sourceFiles": [
         "chat-catalog-domains/external-personal-secret.ts",
+        "chat-catalog-domains/external-personal-secret-confirmation.ts",
+        "chat-catalog-contract.ts",
+        "chat-catalog-flow.ts",
         "chat-catalog-domains/external-secret-question.ts",
         "chat-catalog-domains/external-secret-route.ts",
         "chat-catalog-domains/external-secret-endpoint.ts",
@@ -13280,7 +13289,7 @@
         "agents/hire"
       ],
       "checks": null,
-      "oracleVersion": "paperclip.chat-catalog.team-install.v4",
+      "oracleVersion": "paperclip.chat-catalog.team-install.v5",
       "sourceFiles": [
         "chat-catalog-domains/external-team-install.ts",
         "chat-catalog-domains/external-team-conditional.ts",

tests/runner-e2e/chat-full-catalog-testops-manifest.test.mjs

@@ -103,7 +103,7 @@ test('repair source metadata binds the corrected candidate and explicit changed
   const repair = manifest.source.repairMetadata;
   assert.equal(repair.baseTargetSha, '3b66c3c144360ddf32714a0742fd774b8ceafb16');
   assert.equal(repair.previousTargetSha, 'ab2019e976076ec0eb60b026844f3d9211cb0208');
-  assert.equal(manifest.targetSha, '6773b1c128a2e7efa7571ff04b38238f00d06117');
+  assert.equal(manifest.targetSha, 'ab0f5246f765058af702b93d9b6637f2ef5b83cd');
   assert.equal(repair.definitionSourceSha, manifest.metadataSourceSha);
   assert.equal(repair.candidateDescriptorSnapshot, 'fixtures/chat-repair-candidate-descriptors.json');
   const descriptorBytes = readFileSync(new URL(repair.candidateDescriptorSnapshot, import.meta.url));

tests/runner-e2e/fixtures/chat-repair-candidate-descriptors.json

@@ -4961,6 +4961,9 @@
     "scenarioId": "secrets.personal-secret",
     "sourceFiles": [
       "chat-catalog-domains/external-personal-secret.ts",
+      "chat-catalog-domains/external-personal-secret-confirmation.ts",
+      "chat-catalog-contract.ts",
+      "chat-catalog-flow.ts",
       "chat-catalog-domains/external-secret-question.ts",
       "chat-catalog-domains/external-secret-route.ts",
       "chat-catalog-domains/external-secret-endpoint.ts",
@@ -4985,7 +4988,7 @@
       "../../ui/src/pages/secrets/SetMyUserSecretDialog.tsx",
       "chat-scenarios/secrets.yaml"
     ],
-    "oracleVersion": "paperclip.chat-catalog.personal-secret.v9",
+    "oracleVersion": "paperclip.chat-catalog.personal-secret.v10",
     "expectedRunCount": 3,
     "expectedHumanMessageCount": 2,
     "minimumRunCount": 3,
@@ -6019,7 +6022,7 @@
       "chat-flow.ts",
       "chat-scenarios/teams.yaml"
     ],
-    "oracleVersion": "paperclip.chat-catalog.team-install.v4",
+    "oracleVersion": "paperclip.chat-catalog.team-install.v5",
     "expectedRunCount": 2,
     "expectedHumanMessageCount": 2,
     "turnTimeoutMs": 120000,