From 6f179780e22437b4903a05ca3c37a22d407569ad Mon Sep 17 00:00:00 2001 From: Dotta Date: Sat, 8 Aug 2026 00:39:54 +0000 Subject: [PATCH] docs(runner): authorize phase 4 work --- .../paperclip-native-runner-implementation-plan.md | 12 ++++++++++++ .../spec/paperclip-native-runner-spike-spec.md | 2 +- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/packages/paperclip-runner/spec/paperclip-native-runner-implementation-plan.md b/packages/paperclip-runner/spec/paperclip-native-runner-implementation-plan.md index 499821666a5..a13d0e200cf 100644 --- a/packages/paperclip-runner/spec/paperclip-native-runner-implementation-plan.md +++ b/packages/paperclip-runner/spec/paperclip-native-runner-implementation-plan.md @@ -223,6 +223,18 @@ to the package index and cumulative end-to-end tutorial. **Human checkpoint:** run a small Codex task, inspect the exact model envelope, steer or interrupt it, and verify the structured result and replay. +**Authorization and execution state (2026-08-08):** the human checkpoint for +Phase 3 is accepted, and the board has authorized Phase 4. Create one Phase 4 +checkpoint issue with ordered implementation, security review, CTO contract +review, and QA tutorial children. Implementation remains entirely inside +`packages/paperclip-runner/` and uses the mock core; it must not modify or +import `server/`, `ui/`, `packages/db/`, or production control-plane behavior. +Security and CTO review start only after the runnable driver tracer is complete. +QA starts only after implementation and both reviews pass. Keep Phase 5 tasks +uncreated until the Phase 4 runnable demo, tests, package-local documentation, +tutorial, OKF journal entry, review gates, QA evidence, and human checkpoint are +complete. + ## Phase 5 — Browser reference console and reusable SDK surface **Purpose:** turn the proven protocol into a reference implementation that package users can adopt without the Paperclip app. diff --git a/packages/paperclip-runner/spec/paperclip-native-runner-spike-spec.md b/packages/paperclip-runner/spec/paperclip-native-runner-spike-spec.md index 81ba677faa4..c9e94008109 100644 --- a/packages/paperclip-runner/spec/paperclip-native-runner-spike-spec.md +++ b/packages/paperclip-runner/spec/paperclip-native-runner-spike-spec.md @@ -6575,7 +6575,7 @@ Never change an active run from native to legacy mid-session. The implementation phases, dependency policy, package-local documentation layout, human checkpoints, and retained future backlog now live in [`paperclip-native-runner-implementation-plan.md`](./paperclip-native-runner-implementation-plan.md). -The spike specification remains the normative contract. Keep it updated when implementation evidence changes architecture, protocol, security, persistence, API, UI, performance, or exit criteria. Keep sequencing and task-creation details in the implementation plan. Phase 0, Phase 1, and Phase 2 are complete. The Phase 3 tracer now implements package-local outbound WebSocket authentication, private durable state, cumulative acknowledgement replay, command deduplication, bounded P0-preserving storage, drain, revoke, and redacted CLI/browser diagnostics. Security, UX, QA, and human acceptance remain open. Keep Phase 4 and later tasks deferred until the Phase 3 human checkpoint is complete. +The spike specification remains the normative contract. Keep it updated when implementation evidence changes architecture, protocol, security, persistence, API, UI, performance, or exit criteria. Keep sequencing and task-creation details in the implementation plan. Phase 0, Phase 1, Phase 2, and Phase 3 are complete, including the Phase 3 implementation, security, UX, QA, documentation, tutorial, journal, and human checkpoint gates. On 2026-08-08, the board authorized Phase 4. Phase 4 must implement the skillless Codex reference driver entirely inside `packages/paperclip-runner/` against the mock core, with no changes or imports from `server/`, `ui/`, `packages/db/`, or production control-plane behavior. Keep Phase 5 and later tasks deferred until the Phase 4 implementation, security review, CTO contract review, QA tutorial evidence, package-local documentation, OKF journal entry, and human checkpoint are complete. ## 30. Dependency sequencing