Merge remote-tracking branch 'origin/master' into runner/integration

* origin/master: (83 commits)
  fix(adapters): restore Paperclip skill for legacy runners (#12225)
  fix(dev): honor --data-dir isolation (#12193)
  refactor(adapter-utils): extract the shared workspace-restore teardown factory (#12196)
  fix(setup-token): pin the start guard to the served adapter (#12179)
  fix(ui): keep the installed service worker fresh on parked tabs (#12198)
  feat: hideable company settings pages, with import floored on cloud-managed instances (#12199)
  fix(adapter-utils): repair referenced-source ignore resolution type break and symlink descendant check (#12201)
  perf(gateway): remove the whole-body string round trip on the HTTP/2 send path (#12189)
  build(deps-dev): bump typescript from 5.9.3 to 7.0.2 (#11880)
  refactor(adapter-utils): delete the dead duplex body-chunk protocol code (#12186)
  fix(adapter-utils): move the workspace-restore merge lock to an instance-scoped root and surface restore failures on the run (#12187)
  fix(adapter-utils): report real transferred bytes for project sync, git-history export, and workspace restore (#12180)
  fix(adapter-utils): honor .gitignore for referenced-project staging (#12184)
  feat(ui): dashboard banner for paused imported agents with Resume all (#12142)
  feat(runner): add flagged Codex execution adapter (#12188)
  feat: agents see the company skill library at runtime (#12147)
  fix(server): surface skill materialization failures instead of dropping the skill (#12146)
  feat(server): de-duplicate imported company names (#12145)
  feat: already-imported transfer error names the landed company (#12144)
  feat(ui): post-import landing CTAs on every outcome branch (#12143)
  ...

.github/workflows/docker.yml

@@ -194,6 +194,25 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
 
+      # PID 1 must be an init that reaps adopted orphans. With node there, the
+      # orphans agent runs leave behind are never wait()ed and pin as zombies
+      # until the cgroup pid limit is exhausted and every fork() in the
+      # container fails. Run against the pushed image rather than a local
+      # build: the step above is multi-arch with `push: true`, so nothing is
+      # loaded into the runner's daemon. The cloud variant is FROM production
+      # and inherits the same ENTRYPOINT, so checking this image covers both.
+      - name: Verify PID 1 reaps orphaned processes
+        env:
+          # Through the environment, not interpolated into the script body, so
+          # the tag text is data rather than shell.
+          IMAGE_TAGS: ${{ steps.meta.outputs.tags }}
+        run: |
+          set -euo pipefail
+          image="$(printf '%s\n' "$IMAGE_TAGS" | head -n 1)"
+          test -n "$image"
+          echo "Verifying orphan reaping in $image"
+          docker run --rm -i --pull always "$image" sh -s < scripts/assert-orphan-reaping.sh
+
   # The cloud variant carries built bundled plugins for managed deployments
   # (see the `cloud` stage in the Dockerfile). It runs as its own job with no
   # `needs:` on the stock publish above, so the two builds run in parallel and

.github/workflows/pr.yml

@@ -327,6 +327,9 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Verify Paperclip Runner
+        run: pnpm --filter @paperclipai/paperclip-runner check:all
+
       - name: Build
         run: pnpm build
 

.github/workflows/release-smoke.yml

@@ -38,6 +38,65 @@ on:
         type: string
 
 jobs:
+  # The Docker smoke below can never exercise the background-service leg of
+  # onboarding: containers have no service manager, so v2026.824.0 shipped a
+  # service install that crash-looped on a missing shim while every
+  # golden-path check stayed green. Run the same published artifact directly
+  # on the runner VM's systemd and require the installed service to end up
+  # serving.
+  smoke_service:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: 24
+
+      - name: Start a user systemd session
+        # The hosted runner has no login session for the runner user, so
+        # `systemctl --user` cannot reach a user manager until lingering
+        # starts one. Export the session address for the steps below.
+        run: |
+          sudo loginctl enable-linger "$(id -un)"
+          uid="$(id -u)"
+          for _ in $(seq 1 30); do
+            [[ -S "/run/user/$uid/bus" ]] && break
+            sleep 1
+          done
+          [[ -S "/run/user/$uid/bus" ]]
+          {
+            echo "XDG_RUNTIME_DIR=/run/user/$uid"
+            echo "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/$uid/bus"
+          } >> "$GITHUB_ENV"
+
+      - name: Onboard with the background service
+        env:
+          PAPERCLIPAI_VERSION: ${{ inputs.paperclip_version }}
+          DATA_DIR: ${{ runner.temp }}/service-smoke-data
+          SMOKE_CLEANUP: "false"
+        run: ./scripts/service-onboard-smoke.sh
+
+      - name: Capture service diagnostics
+        if: always()
+        run: |
+          {
+            systemctl --user --no-pager status paperclipai.service || true
+            journalctl --user -u paperclipai.service --no-pager || true
+          } > "$RUNNER_TEMP/paperclipai-service.log" 2>&1
+
+      - name: Upload service diagnostics
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: ${{ inputs.artifact_name }}-service
+          path: ${{ runner.temp }}/paperclipai-service.log
+          retention-days: 14
+
   smoke:
     runs-on: ubuntu-latest
     timeout-minutes: 45

.github/workflows/release-verify.yml

@@ -229,5 +229,8 @@ jobs:
       - name: Install dependencies
         run: pnpm install --no-frozen-lockfile
 
+      - name: Verify Paperclip Runner
+        run: pnpm --filter @paperclipai/paperclip-runner check:all
+
       - name: Build
         run: pnpm build

.github/workflows/release.yml

@@ -647,6 +647,9 @@ jobs:
     timeout-minutes: 10
     permissions:
       contents: write
+      # gh pr view needs PR read for the skeleton's nested summaries;
+      # without it the enrichment silently degrades to bare subjects.
+      pull-requests: read
     steps:
       - name: Checkout repository
         uses: actions/checkout@v7
@@ -661,6 +664,9 @@ jobs:
 
       - name: Draft stable notes from the published beta
         env:
+          # gh needs a token so the generator can nest each PR's summary
+          # under its subject line (best-effort thoroughness).
+          GH_TOKEN: ${{ github.token }}
           BETA_VERSION: ${{ needs.publish_beta.outputs.beta_version }}
           SOURCE_SHA: ${{ needs.select_beta.outputs.sha }}
         run: |