Retain Pi pack proof after provider and runtime review fixes

Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
DottaandPaperclip committed 2026-09-28 15:14:57 -05:00
1 parent 89644566f6
commit 74641130bd
3 files changed
+176 -33

No files matched your search

+22 -17
View File
@@ -239,26 +239,31 @@ helper discards failed-attempt usage, so any retry or missing compaction receipt
invalidates complete-turn token/cost totals instead of inventing complete coverage.
The retained [macOS ARM64 provider-pack admission proof](../../packages/paperclip-runner/test-fixtures/pi-acp/offline-provider-pack-proof.darwin-arm64.json)
records the exact source revision, pack/runtime hashes, declared model, and
missing-credential result. It contains no credentials or provider session IDs and
records zero paid calls. The pack was built at
`f58cfa1cbf4503b93a0be4480f51b492d8203b7c`, after the final foundation rebase and
retry-status repair. Its manifest digest is
`sha256:3de76fb7d3902d29285e3da51e36d2ba4654c29bab0c867a6209fadea77c2181`.
The probe used the integrated installation registry and immutable snapshot. Every
advertised capability in this record was read and asserted from that actual
initialize response. Session creation rejected the missing bound credential;
no model prompt was submitted. The record includes the focused checks performed
at this source. It precedes only the evidence-retention/report commit and proves
o authenticated interaction, model, or Daytona qualification.
records source `d039e1b7b072862b4c326ba7194dc42617fa5984`, after the assigned
HTTPS gateway repair and shared failed-turn receipt and credential-provenance
fixes. Its manifest digest is
`sha256:5a47fc67b886c1e05d0f630ed89c1b9f5324610b649d1db020a3e036e36fc85d`.
The clean tracked-lock resolution matched Docker's reviewed
`650e23d20e967bcfbfced888e131199b9a06e66a1ba4f64cfb68383b59def4a8` digest
before a frozen install and pack build. The probe used the deployed generic
installation registry and immutable snapshot. Every advertised capability was
read and asserted from its actual initialize response. Session creation rejected
the missing bound credential; no model prompt was submitted. The record contains
no credentials or provider session IDs and records zero paid calls. It includes
focused verification and the cleanup-timeout retry history, and precedes only
this evidence-retention/report commit. It proves no authenticated interaction,
reported model ID, or Daytona qualification.
The [previous integrated proof](../../packages/paperclip-runner/test-fixtures/pi-acp/offline-provider-pack-proof.f58cfa1cb.darwin-arm64.json)
retains source `f58cfa1cbf4503b93a0be4480f51b492d8203b7c` and manifest
`sha256:3de76fb7d3902d29285e3da51e36d2ba4654c29bab0c867a6209fadea77c2181`.
It covers the retry-status repair before the HTTPS and shared runtime fixes.
The [earlier integrated proof](../../packages/paperclip-runner/test-fixtures/pi-acp/offline-provider-pack-proof.1e0d11c48.darwin-arm64.json)
retains source `1e0d11c482f8ef50b6afc1430cb736579114b266` and manifest
`sha256:f859e30e51326ff875d616e2bb3fd4c0246ce1f58a5988968b91bae176a68281` as
historical evidence. It has the previous wrapper/closure identity and explicitly
records its narrower capability assertions. It is not evidence for the current
retry-status repair. Later runtime or foundation changes require a new pack build
and source-pinned admission record.
`sha256:f859e30e51326ff875d616e2bb3fd4c0246ce1f58a5988968b91bae176a68281`
with its narrower capability assertions. Both files are historical evidence,
not proof of the current executable bytes. Later runtime or foundation changes
require a new pack build and source-pinned admission record.
## Remaining event and qualification work
@@ -1,13 +1,13 @@
{
"schema": "paperclip.pi-provider-pack-offline-proof.v1",
"recordedAt": "2026-09-28T17:33:47.419Z",
"recordedAt": "2026-09-28T18:05:21.044Z",
"classification": "offline_candidate_admission",
"source": {
"runnerRevision": "f58cfa1cbf4503b93a0be4480f51b492d8203b7c",
"distDigest": "sha256:c7f250e0fbe0b6a6357bacb2d1487675d74a32f96b42922d7739ef86ddb9b6e0",
"bridgeDigest": "sha256:431b2400f13a20249b2d4383188e496f071f7d009a1835873561711f567f55b3",
"productionLockDigest": "sha256:b89a0f0a647b77f61b231bcdd95e1fc26eaf9e9b8010d53a16428fae49b96f26",
"note": "Built after the final foundation rebase and Pi retry-outcome repair. This probe executed the deployed generic installation registry and immutable snapshot. Every capability field below was read and asserted from this actual initialize response. No prompt was sent."
"runnerRevision": "d039e1b7b072862b4c326ba7194dc42617fa5984",
"distDigest": "sha256:4a06098b322bb2c92db66c99d51e9eac7009f442d53077982a88ede937fea044",
"bridgeDigest": "sha256:d2fb33ed3ca0f42bbc6c33486f4ff34a8e29aa2cebf94c64d1747b1ce4089eb1",
"productionLockDigest": "sha256:650e23d20e967bcfbfced888e131199b9a06e66a1ba4f64cfb68383b59def4a8",
"note": "Built after the assigned HTTPS gateway repair and the shared failed-turn receipt and credential-provenance fixes. This probe executed the deployed generic installation registry and immutable snapshot. Every capability field below was read and asserted from this actual initialize response. No prompt was sent."
},
"environment": {
"platform": "darwin",
@@ -25,19 +25,19 @@
"modelVerification": "not_performed_authentication_missing",
"wrapperVersion": "0.0.33",
"runtimeVersion": "0.84.2",
"profileDigest": "sha256:5ed73f923b24bf203cf39d6c5dedd5dfd21e94efcb2c2580b4adf53f1b91fd2f",
"closureDigest": "sha256:c79fa33fd134e860fd777cd467873438b17b80b0b462a89e95cc63fbaa46bada",
"assetTreeDigest": "sha256:ceb81538aff1d04bff44505aa1e08ace869039c8055ed82667fab64e21f05ab1",
"distributionManifestDigest": "sha256:cc56a2bd75d56de01982a731e7d43b0b5e96fd3f7e06cdbbd1bc858bf2ffcd05",
"profileDigest": "sha256:c577a771778febe24b920388da77f6143971b8eec29e1ba9a433dac5b76de3cd",
"closureDigest": "sha256:a26e98fe3f4d3d93c13beffdb4e8b778d438dd1b3bca8a9b1610154342382681",
"assetTreeDigest": "sha256:44b058bf5a10b82d355351e8034d82e0a82d8de3236c80ccd586922953a4de4a",
"distributionManifestDigest": "sha256:bd46c419b3a9c56332eda72dfc5fbd7621d8f0a271be8fb6202b005a39ee4c7a",
"wrapperDigest": "sha256:2eb201c3a931177490a8e18f4a8392f00cbcf21847e9cc171de528da5e253935",
"helperDigest": "sha256:4333d284ff06ab1195e49630041f0b03a486a92fc678100525ad107e0982dba1",
"extensionDigest": "sha256:87f5348be5da3fb505baea1208de7b62e88ec714adcf0ac0a16a51952f57e2da"
"extensionDigest": "sha256:0a2ca138d6d87a85498bd982ee64543ea8b14f2ecceded96cfc27b0836cc4254"
},
"providerPack": {
"manifestDigest": "sha256:3de76fb7d3902d29285e3da51e36d2ba4654c29bab0c867a6209fadea77c2181",
"manifestDigest": "sha256:5a47fc67b886c1e05d0f630ed89c1b9f5324610b649d1db020a3e036e36fc85d",
"portableNodeDigest": "sha256:27db838bb204ef7c21df2931f5656e4c8fb32e6e947f363a402b49714d32b5b1",
"piNodeDigest": "sha256:27db838bb204ef7c21df2931f5656e4c8fb32e6e947f363a402b49714d32b5b1",
"acpxSidecarDigest": "sha256:ee85322a4947f21fe079cc22ed1c7282a38fb84016ae28b56cde4f58b9001d5e"
"acpxSidecarDigest": "sha256:9416ff4c0d87ae343b6af4354b7b871ece77d86799f0daaf866915647ae44eb5"
},
"observed": {
"closedSnapshotLaunch": true,
@@ -81,15 +81,46 @@
"Production qualification remains pending."
],
"verification": {
"sourceRevision": "f58cfa1cbf4503b93a0be4480f51b492d8203b7c",
"sourceRevision": "d039e1b7b072862b4c326ba7194dc42617fa5984",
"resolvedSourceLockDigest": "sha256:650e23d20e967bcfbfced888e131199b9a06e66a1ba4f64cfb68383b59def4a8",
"lockResolution": "clean tracked input, full workspace resolution, matched reviewed Docker pin before frozen filtered install",
"typescriptBuild": "passed",
"providerPackBuild": "passed",
"vitest": {
"files": 4,
"passed": 30,
"passed": 31,
"failed": 0,
"actualDistributionInstallation": "enabled; same pinned runtime closure"
"maxWorkers": 1,
"hookTimeoutMs": 10000,
"actualDistributionInstallation": "enabled; current provider-pack assets",
"durationSeconds": 12.22
},
"verificationHistory": [
{
"suite": "four Pi Vitest files",
"passed": 30,
"failed": 1,
"failurePhase": "afterEach cleanup",
"failure": "Hook timed out in 10000ms while deleting the large immutable snapshot during concurrent pack builds; launch assertions completed",
"durationSeconds": 41.63
},
{
"suite": "four Pi Vitest files",
"passed": 31,
"failed": 0,
"hookTimeoutMs": 60000,
"durationSeconds": 42.07
},
{
"suite": "four Pi Vitest files",
"passed": 31,
"failed": 0,
"hookTimeoutMs": 10000,
"maxWorkers": 1,
"durationSeconds": 12.22,
"note": "Repeated after pack/probe IO settled, with unchanged source and default cleanup timeout."
}
],
"nodeTests": {
"files": 3,
"passed": 17,
@@ -0,0 +1,107 @@
{
"schema": "paperclip.pi-provider-pack-offline-proof.v1",
"recordedAt": "2026-09-28T17:33:47.419Z",
"classification": "offline_candidate_admission",
"source": {
"runnerRevision": "f58cfa1cbf4503b93a0be4480f51b492d8203b7c",
"distDigest": "sha256:c7f250e0fbe0b6a6357bacb2d1487675d74a32f96b42922d7739ef86ddb9b6e0",
"bridgeDigest": "sha256:431b2400f13a20249b2d4383188e496f071f7d009a1835873561711f567f55b3",
"productionLockDigest": "sha256:b89a0f0a647b77f61b231bcdd95e1fc26eaf9e9b8010d53a16428fae49b96f26",
"note": "Built after the final foundation rebase and Pi retry-outcome repair. This probe executed the deployed generic installation registry and immutable snapshot. Every capability field below was read and asserted from this actual initialize response. No prompt was sent."
},
"environment": {
"platform": "darwin",
"architecture": "arm64",
"nodeVersion": "24.19.0",
"execution": "local macOS ARM64; immutable guarded provider snapshot",
"packageManager": "pnpm@9.15.4"
},
"candidate": {
"agent": "pi",
"qualification": "pending",
"agentProfileVersion": 2,
"declaredModel": "openrouter/deepseek/deepseek-v4-flash-0731",
"reportedModelId": null,
"modelVerification": "not_performed_authentication_missing",
"wrapperVersion": "0.0.33",
"runtimeVersion": "0.84.2",
"profileDigest": "sha256:5ed73f923b24bf203cf39d6c5dedd5dfd21e94efcb2c2580b4adf53f1b91fd2f",
"closureDigest": "sha256:c79fa33fd134e860fd777cd467873438b17b80b0b462a89e95cc63fbaa46bada",
"assetTreeDigest": "sha256:ceb81538aff1d04bff44505aa1e08ace869039c8055ed82667fab64e21f05ab1",
"distributionManifestDigest": "sha256:cc56a2bd75d56de01982a731e7d43b0b5e96fd3f7e06cdbbd1bc858bf2ffcd05",
"wrapperDigest": "sha256:2eb201c3a931177490a8e18f4a8392f00cbcf21847e9cc171de528da5e253935",
"helperDigest": "sha256:4333d284ff06ab1195e49630041f0b03a486a92fc678100525ad107e0982dba1",
"extensionDigest": "sha256:87f5348be5da3fb505baea1208de7b62e88ec714adcf0ac0a16a51952f57e2da"
},
"providerPack": {
"manifestDigest": "sha256:3de76fb7d3902d29285e3da51e36d2ba4654c29bab0c867a6209fadea77c2181",
"portableNodeDigest": "sha256:27db838bb204ef7c21df2931f5656e4c8fb32e6e947f363a402b49714d32b5b1",
"piNodeDigest": "sha256:27db838bb204ef7c21df2931f5656e4c8fb32e6e947f363a402b49714d32b5b1",
"acpxSidecarDigest": "sha256:ee85322a4947f21fe079cc22ed1c7282a38fb84016ae28b56cde4f58b9001d5e"
},
"observed": {
"closedSnapshotLaunch": true,
"acpInitialize": "passed",
"authMethods": [],
"capabilities": {
"version": 1,
"steering": true,
"queuedFollowUp": true,
"questions": [
"select",
"confirm",
"input",
"editor"
],
"nativePermissions": true,
"promptUsage": true,
"nativePlan": false,
"pendingRequestRecovery": "live-process-only"
},
"sessionNew": "rejected_authentication_missing",
"expectedError": "Bind the configured OpenRouter API credential to this Paperclip runtime.",
"missingCredentialRejected": true,
"capabilityProvenance": "Read and asserted in full from this pack launch.",
"rpcMethods": [
"initialize",
"session/new"
]
},
"usage": {
"providerCalls": 0,
"promptRequests": 0,
"paidProviderCalls": 0,
"credentials": "none",
"spentUsd": 0
},
"limitations": [
"No provider authentication, model prompt, or reported currentModelId was verified.",
"Native tool execution, permissions, questions, and semantic MCP calls were not exercised by this pack-launch probe.",
"Linux x64, macOS x64, and Daytona execution were not exercised.",
"Production qualification remains pending."
],
"verification": {
"sourceRevision": "f58cfa1cbf4503b93a0be4480f51b492d8203b7c",
"typescriptBuild": "passed",
"providerPackBuild": "passed",
"vitest": {
"files": 4,
"passed": 30,
"failed": 0,
"actualDistributionInstallation": "enabled; same pinned runtime closure"
},
"nodeTests": {
"files": 3,
"passed": 17,
"failed": 0,
"skipped": 0,
"actualPackages": "fresh provider-pack assets"
},
"notRun": [
"full repository typecheck, build, and tests for this provider branch",
"credentialed model evaluation",
"Linux x64 or macOS x64 execution",
"Daytona deployment"
]
}
}