docs: Pi core production readiness evidence (5/5) (#14956)

## Thinking Path

> - Paperclip manages AI agents and their work.
> - The experimental Runner owns provider processes and durable
sessions.
> - Pi needs working task execution and human controls.
> - The five-PR stack must preserve changes already on master.
> - The runtime implementation has merged in #14921; this layer carries
the next documentation changes.
> - This PR belongs to native GitHub stack #15602, ending at #14956.

## Linked Issues or Issue Description

Refs #14436, #14631, #14743 and #14956.

Ship Pi 1.0 through the experimental Paperclip Runner. The five PRs are
#14921, #14922, #14923, #14924 and #14956. The user authorized the
complete merge after checks pass. Existing `pi_local` execution is
unchanged. Accounting and wider provider/platform qualification remain
deferred.

## What Changed

- Record the seven source-bound Pi core passes and retained
failed-attempt provenance.
- Document agent-file artifacts, warm instruction-root recovery, final
task replies, and installed Runner verification.

## Verification

- Full local `pnpm -r typecheck` passes, including Runner Rust, server
and UI. Focused integration checks pass: 194 Runner
admission/environment tests, 63 profile/credential tests with one
expected skip, 152 Dot/UI configuration tests, and Pi transcript/notice
tests.
- Full local `pnpm build` passes on the final source.
- Fresh final-source checks pass: all 698 Rust workspace tests (32
binaries), 156 credential/profile/controller tests with one expected
skip, Runner TypeScript typecheck, and 20 package/setup/sandbox tests.
- The profile-21 Pi materializer passes on the native host with the
official pinned Node 24.21.0 and its npm. It verifies all 150 locked
packages, the patched dependency and the exact closure. Setup/package
bundle tests and UI token gates pass.
- The old hashes were reproduced for all three supported targets before
calculating the patched graph. New closure hashes are darwin-arm64
`282022db10150c6632b3444df421342e7d534bdf5d5fb1097a2e79d0625a2bcf`,
darwin-x64
`64e251e19009f755c0b04f73ce2138246faab71a961b0f13d75ebfcc34bef12e`, and
linux-x64
`713b1fdff42fb56a1518bdc084f181d70bee8ebadc3e4b1d76321ed9108c8410`.
Independent native platform execution is separate from graph identity
reproduction.
- Historical cloud qualification remains unchanged: all seven core cases
pass on shipping source `10dc43c9ec65d88c2f782d62afb296d09494f215`,
harness `1a4408a48cfb5a1f094a311141c257c92cd7a893`, image
`sha256:5b3a775b383591bda1b0c1889e509acc70ce7f37c53f09733c81d59037f02280`,
and accepted Sonnet 4.6/low fixture. All 215 canonical files and all
seven cleanup checks pass independent verification. These are profile-19
results and are not relabeled as fresh profile-22 runs.
- Current Pi digest:
`sha256:e92078bee3c23bec4100aa589013a44613d054cd686826534025d8019e9f39a9`.
[The readiness
plan](https://github.com/paperclipai/paperclip/blob/codex/pi-production-readiness/doc/plans/2026-10-02-pi-production-readiness.md)
preserves campaign and failed-attempt provenance.
- Merge only after every PR's current-head CI and fresh review pass.
Linux CI covers the full suites, build and browser tests. The local
embedded Postgres API-authority suite cannot start on this macOS/Node 26
host, so Linux CI must confirm that suite.

### Fresh profile-22 core qualification — 2026-10-08

All seven accepted core cases pass canonically on Pi profile 22, with
`openrouter/anthropic/claude-sonnet-4.6` and native-confirmed low
thinking. This model is a fixture; production accepts the caller's
explicit Pi provider/model.

Runtime/install source: `3241a992f2a7703e59e97ed0fd3e5d6405de4401`.
Frozen accepted harness: `1a4408a48cfb5a1f094a311141c257c92cd7a893`.
Immutable cloud image:
`ghcr.io/paperclipai/paperclip-daytona-runner@sha256:506f22db7edd78f37c0c40bec1cc084af1850455026dbf467194bfbb8fcef141`.
Pi digest:
`sha256:e92078bee3c23bec4100aa589013a44613d054cd686826534025d8019e9f39a9`.

[Hosted Linux image and clean-install
verification](https://github.com/paperclipai/paperclip/actions/runs/37868328023)
passes, including all 20 source-bound archives, normal CLI/Pi setup,
companion import and the production pack reader. This exact installation
source includes the latest master integration and the corrected Pi warm
instruction-root fence. Full local typecheck/build and current-head
hosted CI verify the final stack. All 13 focused real-root regressions
pass. The full local executor suite passed 662 tests; 15 database tests
could not start the Mac embedded PostgreSQL service. Hosted Linux CI
passes the full required verification and E2E checks. These fresh
results keep their own source identity; profile-19 results remain
historical.

| Core path | Canonical campaign | Retained archive SHA-256 |
| --- | --- | --- |
| File edit, validation, download and Done |
`pi-core22-replyfix-0-1791511228` | 23 files;
`a473e8603a3dd4737863291f8d3d1e392391f0b16d433c3e0e0e9d8baf7a97b0` |
| Pending question and controller restart |
`pi-core22-replyfix-1-1791511376` | 33 files;
`6b829c4eb74e1f32a89c692a4ae7130dbfc1c6d3cf13915effe2103d9e242c8e` |
| Three-turn session/process/workspace continuity |
`pi-core22-replyfix-2-1791511587` | 23 files;
`7a87021f8f9a3fdd3c58bb4467f8d82c635e3ea4795d6e75f144d9aa14818df8` |
| Four typed questions and browser reconnects |
`pi-core22-replyfix-3-1791511881` | 42 files;
`9e31755252be1f4f9cb0626c984c142d4d1ae5f5bee3a7af08444db8d12c280a` |
| Plan approval and completion | `pi-core22-replyfix-4-1791512031` | 22
files;
`a0383ce1aab38e7b5a25ce0e9dd3bebea5c037ebd96ae6b29dae19015da2ae2c` |
| Same-turn steering and permission denial |
`pi-core22-replyfix-5-1791512261` | 39 files;
`c929b8c7070f0b66aedc17e65ca46e6beab1e363926ac9f7e2a75fb250f05949` |
| Stop during pending permission | `pi-core22-replyfix-6-1791512390` |
33 files;
`7f0a58ae0f4d5bfc76149435f4e322537089c5bd16e7ffe9b5ad71f10a621a07` |

All 215 canonical files (28714587 bytes) are independently
hash-verified. All seven cleanup grades pass, with no owned runtime
process or temporary root after each case. Automatic retries are zero.
The owned cloud host stopped normally after retention. The prior
profile-22 warm attempt remains failed and separately retained: archive
SHA-256
`1e54eba5ec72b50cee1534b23d1d1d4f21a090006b8a64501ba70db972abfde5`. Its
original canonical classification is preserved. Diagnosis reproduced a
product bug comparing an agent-files root against an unset
checkpoint-only field. The fix stores the admitted physical root
separately from the adopted per-run collection capability. The real-root
regression fails before the fix and passes afterward, including
rejection of a changed physical root. Fixture, grader, model and all
seven accepted case IDs are unchanged; this fresh campaign tests
final-reply publication after file registration first. The intermediate
restart attempt also remains failed and retained: archive SHA-256
`5dcaefdf1d17cf4cd54fd4cf810f45e736667392339b8ce7caf08bb4e225277f`. Its
original canonical classification is preserved. Pi resumed, wrote the
verified answer and completed its task; exact runner suspension was
proven, but idle stop consumed about 5.2s and left under 3s for the
drain acknowledgement. The Pi-only default shutdown grace is now 15s,
preserving a full 5s drain round trip and a finite suspension reserve.
Explicit caller deadlines, other provider defaults, literal drain
receipts and exact suspension identity checks remain unchanged. The
timing regression fails before this correction and passes afterward; all
18 focused settlement tests and Runner typecheck pass. The final-source
file attempt is also preserved as failed (`candidate_failure`), archive
SHA-256
`db6767b6773ea618997927ac77bdb005a5ac81492c7b9c0ffbc900449f829bc9`.
Native edit, validation, exact downloadable artifact and Done/succeeded
all passed, and the exact final reply was durably recorded. A workspace
recovery owner completed before the live heartbeat reached presentation,
leaving that reply absent from task chat. Recovery now materializes only
a completed final reply from the accepted turn of an ordinary internal
Done task, preserving issue/run/contract binding, suppression,
external-chat authorization and same-run deduplication. The database
regression covers the generated file-preparation receipt, suppression,
unapproved external continuation and replay. Server typecheck and all 49
response-selection tests pass; hosted Linux verifies the database
regression because embedded PostgreSQL cannot start on this Mac.

The delayed-final-answer database regression passes on [the final
root-source Linux server
shard](https://github.com/paperclipai/paperclip/actions/runs/37868262553/job/113628594152),
alongside 1,108 passing tests. The first root Runner shard had one
unchanged durable-resume test exceed its 5-second timeout; the identical
top-source shard and the isolated exact test passed. One rerun of that
failed job and its required aggregate passed without source or test
changes. The original failed job log and the single-rerun receipt remain
retained.

### October 9 merge verification

Current merge head: `e77273aa0fce5991a5b5dd193734fd6b0a6542d3`. All
current-head checks pass, including `ci / verify` and `ci / e2e`;
exact-head Greptile review is 5/5 with no unresolved threads. Current
master conflicts are resolved. The user authorized the maintainer
override of the code-owner review gate after these checks. The seven
retained live core cases remain bound to source
`3241a992f2a7703e59e97ed0fd3e5d6405de4401` and its recorded cloud image.

## Risks

- The security correction changes the dependency closure and profile
identity. Old sessions must reopen on the new profile. Exact identities
and credential bindings fail closed.
- The runner remains experimental and requires explicit selection.
Legacy Pi Local is unchanged. Caller model IDs pass through; the E2E
model is a fixture.
- Accounting and the broad platform/provider matrix remain deferred.
This merge does not publish a release or deploy a service.

## Model Used

OpenAI GPT-6 through Codex assisted with reasoning, repository
inspection, editing and tool use. The exact serving ID and context
window are not exposed in this session. Final live qualification uses Pi
1.0.0 with `openrouter/anthropic/claude-sonnet-4.6` and native-confirmed
low thinking.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

doc/AGENT-ARTIFACTS.md

@@ -13,6 +13,17 @@ remote workspace. Supply a workspace-relative `contentRef`, basename `filename`,
 The tool verifies the file, stores an attachment and artifact work product, and
 binds it to the response. Generic API tools and a legacy API key are unnecessary.
 
+The completion gate permits a narrow sentence-bound exception for one requested
+file when the following sentence explicitly qualifies it, for example:
+`Write memory.txt. This is personal memory, not a task deliverable.` or
+`Write internal-proof.txt. This is an internal verification file, not a deliverable.`
+Each qualifier applies to one file in the immediately preceding request sentence.
+Separate file requests can each qualify when each has its own following qualifier.
+Multiple files requested in one sentence, unqualified report requests, and explicit
+attachment/download requests still need verified accessible publication evidence. Saying only “for internal verification”
+does not establish this exception. Expected denied native writes in a negative
+test are separately recognized as denied attempts, not requested deliverables.
+
 Wait for the receipt. It includes `attachmentId`, `contentPath`, and
 `downloadPath`, along with the existing command, revision, entity references,
 and disposition. Reuse the original key after an ambiguous result. A receipt

doc/agent-files.md

@@ -37,6 +37,16 @@ workspace: their independent agent copy therefore lives under the excluded
 `.paperclip-runtime/agent-files/<agent>/<run>/` area. It is not included in task
 workspace sync, Git staging, or task deliverables.
 
+Sandbox transfer scratch lives separately under
+`.paperclip-runtime/paperclip-runner/agent-file-transfers/<agent>/<run>/`.
+Workspace-staging transfer scratch stays outside `AGENT_HOME`, including
+recovery after controller restart. Remote warm Codex checkpoints may temporarily
+stage changed-file payloads under `AGENT_HOME/.paperclip-runtime/checkpoint-*`;
+these are checkpoint scratch, not managed personal files. Cleanup removes
+only the original materialization's agent directory and transfer scratch
+through its owned lease. A later warm turn keeps that original materialization
+identity; it does not grant collection or cleanup of another run's files.
+
 Claude CLI runs keep the working-copy location in each run's prompt, separate
 from the cached system instructions. A new copy path alone does not reset the
 task session. Each turn names the current copy for relative file references;

doc/architecture/runner-pi-capabilities.md

@@ -22,6 +22,28 @@ for the exact source/image evidence and merge status.
 All dated checkpoints below describe historical qualification attempts. Their
 failures and profile numbers are retained; they are not current release gates.
 
+## User-selected models (2026-10-06)
+
+Native Pi accepts any explicit provider/model ID. The settings builder, server,
+release profile, and Rust runner do not restrict selection to a qualification
+model. Pi must acknowledge the exact selection before a prompt and on recovery;
+unavailable models fail clearly without selecting a substitute. Runtime package,
+version, command, permission, and process-ownership checks remain enforced.
+
+Bind the selected provider's credentials in the agent environment, for example
+`OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, `GEMINI_API_KEY`, or `OPENROUTER_API_KEY`.
+Custom models use `PAPERCLIP_PI_PROVIDERS`, an explicit JSON object in Pi's
+`models.json` providers format. The runner writes it into the private Pi home,
+forwards explicitly bound credential references, and includes its digest in
+recovery identity. Credential commands and control-plane credential references
+are rejected. General AWS IAM keys are excluded; Bedrock uses `AWS_BEARER_TOKEN_BEDROCK`. Choose a thinking level supported by the selected model (`off`
+for a model without reasoning).
+
+The DeepSeek model IDs throughout the historical qualification results below
+identify those attempts; they are not a product allowlist. Those results do not
+qualify this merge or additional models.
+
+
 ## Historical Pi 1.0 candidate (2026-10-02, profile v13)
 
 Pi remains pinned to **`@earendil-works/pi-coding-agent@1.0.0`**, with
@@ -30,8 +52,9 @@ reasoning-mode selection and rejects previous profile identities. It is a new
 qualification candidate; profile-12 results below remain historical evidence.
 
 Pi's new field also changes four shared files covered by Copilot's source
-identity. Copilot therefore advances to a still-unqualified profile v13 without
-changing its executable or model. Pi's profile-13 identity and native closure
+identity. The subsequent live callback snapshot changes the shared sidecar again,
+so Copilot now uses still-unqualified profile v14 without changing its executable
+or model. Pi's profile-13 identity and native closure
 remain unchanged. Final artifacts must bind the corrected source; the initial
 ARM startup and 61 contract passes alone do not establish production readiness.
 
@@ -1174,3 +1197,28 @@ separately built and verified Linux provider pack in its runner image; running
 local setup does not install or qualify a remote image. Published-tar local and
 Daytona startup evidence must bind the final installation candidate, with no
 candidate qualification flags, before a production-readiness claim.
+
+
+## Cold process admission budget
+
+Pi cold `session.open`, including process replacement and durable reopen, has a
+60-second admission budget. The controller shares one deadline across its cold
+open/recovery command and provider identity barriers (`session.open`, replacement
+`run.attach`, and replacement `runner.drain`). A live adopted runner keeps the
+ordinary 30-second waits. Rust gives only Pi's sidecar `session.open` request the
+60-second budget; initialize, attach, turn start and other sidecar commands stay
+at 30 seconds. Inner ACP handshake (30 seconds), post-admission verification
+(8 seconds), cancellation (2 seconds), and close (7 seconds) are unchanged.
+
+Timeout still poisons and retires the Rust sidecar process group. Closing the
+controller during its startup wait rejects that wait and uses the existing owned
+process cleanup. Callers must await transport close in their cleanup path.
+This is trusted controller timing policy, outside the immutable Pi wrapper/profile
+closure; it does not change profile 13, runtime 1.0.0, or the explicit model.
+
+The credential-free closed-startup regression requires the real
+`session_ensure_failed` rejection within 60 seconds, with no prompt, no provider
+identity and confirmed cleanup. Its child watchdog is 80 seconds (20 seconds for
+cleanup after admission), inside a 90-second test timeout. Failed evidence stays
+in its reported temporary directory. These margins do not extend production
+command deadlines or qualify a target platform without a fresh run.

doc/grok-native-runner.md

@@ -110,7 +110,7 @@ single successful browser task do not establish that qualification.
 ## Remote verification
 
 Do not run Docker on a developer laptop when using remote verification. The
-`Docker Runner check` workflow offers maintainer-authorized manual EC2 image
+`Docker Runner check` workflow offers maintainer-authorized manual Linux image
 builds and broad source checks without provider credentials. It records the
 source revision, resolved lock digest and immutable image reference. Paid
 Product E2E remains behind the protected default-branch workflow and environment.