Record reproduced Boat package link transition

Publish bounded tool-output, controller topology, and cleanup evidence. Preserve the original Claude failure and the pending independent-file control. Record source-bound workspace checks and the reviewed computer route correction.

Co-authored-by: Codex <noreply@openai.com>
This commit is contained in:
DottaandCodex committed 2026-10-11 08:24:16 -05:00
1 parent 869a304c62
commit 7d377bb93a
4 files changed
+251 -6

No files matched your search

+18 -6
View File
@@ -4,23 +4,35 @@
Historical screenshots and receipts are preserved on the [fixed evidence branch](https://github.com/paperclipai/paperclip/tree/5909bfac9fa41405beb3fe8a65253dc28ba52835/doc/plans/assets/2026-10-10-boat). Historical links below use that exact commit; the implementation PR keeps a bounded set of current proofs.
## Current source boundary (2026-10-11 13:02 UTC)
## Current source boundary (2026-10-11 13:24 UTC)
| Surface | Source and evidence |
| --- | --- |
| Combined implementation | The feature branch includes core `51db2ab6`, prerequisite `ab1e8acc` and marker correction `1f66cac0`; full checks for the new head remain pending. Earlier fully checked head `4d2a2394bc` includes the reviewed closed module-fence diagnostic and committed live evidence; its CI is green: 54 passed, fresh review 5/5 and no unresolved threads at 11:16 UTC. Previous head `dc6ac92f7e` had 53 successful checks, fresh review 5/5 and no unresolved threads at 10:09 UTC. |
| Core branch | Current core `51db2ab62f365642e3d8476dc7ff7d41d138471e` includes upstream `e733bddc45`, prerequisite `ab1e8acc` and the reviewed credential/workspace fixes below. The preceding fixture correction `7634c65d` passed all 835 executor tests; the later corrections passed their focused integration checks. Full current-head CI is pending. Prior fully checked `8f62eef8f13e199f7a98d8a9ec27d617385e6fde` adds closed module-fence diagnostics; focused checks passed and full CI is green: 54 passed, four skips, fresh review 5/5 and no unresolved threads at 11:16 UTC. Previous head `8e8999d681` had 54 successful checks, four skips, fresh review 5/5 and no unresolved threads. Its serialized invite test passed one rerun with unchanged source and timeout. |
| Combined implementation | Merge `869a304c62` includes the reviewed Kubernetes Computer-route correction from core `3223e57b74`. Both combined route suites passed, 28/28 with zero skips. Full workspace typecheck and build passed on preceding `bcd94e340ada5e62145b9a2bee26745d60dc3d99`; this is not a claim that the historical full local test command was rerun. At 13:15 UTC, `bcd94e` had 44 successful checks, eight pending and exact-head review 5/5 with no unresolved threads. Latest merge/evidence CI is pending. |
| Core branch | Current core `3223e57b747844834d57d3915d8e7c60b119c723` uses heartbeat's canonical forced-Kubernetes policy before exposing Boat connection, presence or preview. Four regressions failed before the correction; 27 focused cases and server typecheck passed with independent review. Exact-owner disconnect remains available. Preceding `51db2ab6` had 53 successful checks and the one review finding corrected by this commit; new-head CI is pending. Runtime prerequisite `ab1e8acc68` has 54 successful checks, two skips, exact-head review 5/5 and no unresolved threads. Fixture `e318850909` has 53 successful checks, two skips and exact-head review 5/5. |
| Verified staging source | Deployment29 verified `05f3725af838b5a074707df1d6ed1e193bdfe49e` at 12:23:23.944 UTC. Its cold turn succeeded at 12:39:57.782; warm succeeded at 12:42:09.943; saved post-idle continuation failed with a specific module `link_count` rejection, followed by automatic recovery failure. Deployment28 verified `70fb0988c0aa760f9c84818aaf3fabbc339854b7` at 11:26:28.642 UTC; its cold and warm turns passed; after natural archive, its saved post-idle continuation failed before task work. Both owners retired and Boat archived automatically. Deployment27 verified `2605a03f00bc3d7decc8b8d5549ee06f8d77ae85` at 10:19:12.318 UTC. Saved Codex execution, agent computer use, generated preview, state-preserving warm HMR and natural process cleanup passed. Claude cold and warm passed; its saved post-idle continuation failed before provider task work. |
| Local corrected-package qualification | Local51 also passed the full lifecycle with the same Node, sidecar and production-lock bytes as staging28, although the package closure differs. Its final archive completed at 11:38:23.197. Earlier compatible controller `049c57f64c9addb1ae45132626cf800d1ea41a95` and immutable pack `sha256:f6fbd13c71cdaf93060a7c240cbce1c8dfce2aefe5669db27d254b3b95dfb0a0` passed cold, warm, natural archive, first-attempt saved-session continuation and final natural archive. |
| Carried source-specific evidence | Deployment26 passed simultaneous legacy admission from archive. Deployment25 passed embedded human mouse/keyboard control in Chrome and exact Codex child cancellation while its Claude sibling remained alive and completed. Earlier local checks cover file editing, detach/reconnect and company boundaries. Orderly restart has bounded observations, not a successful crash-recovery journey. These were not rerun for the later dependency-loader and viewer-warning changes. |
Final-source staging acceptance remains incomplete because the saved Claude post-idle continuation failed, now narrowed to a module link-count transition. The numeric transition and cause are not yet known. Previous failed immutable packages and saved authority remain intact. The historical Darwin full-suite command reported **34,914 passed, 24 failed, 338 skipped**; every suite responsible for those 24 failures subsequently executed and passed in Linux CI on exact core `8e8999`. The original local command was not rerun, and its 338 skips remain unreclassified. A separate invite-URL timing failure passed its one rerun without source or timeout changes; its original failure is retained. [Failure disposition](assets/2026-10-10-boat/evidence/full-local-failure-disposition.json).
Final-source staging acceptance remains incomplete because the saved Claude post-idle continuation failed, now narrowed to a module link-count transition. A later scoped read-only probe reproduced **nlink 1→2 on the same 102-byte inode**. Its content hash matches two hardlinked SDK files in the controller package. This establishes the failing metadata transition and preexisting package topology; the proposed independent-file packaging correction still needs a live archive/resume control and full saved-session qualification. Previous failed immutable packages and saved authority remain intact. The historical Darwin full-suite command reported **34,914 passed, 24 failed, 338 skipped**; every suite responsible for those 24 failures subsequently executed and passed in Linux CI on exact core `8e8999`. The original local command was not rerun, and its 338 skips remain unreclassified. A separate invite-URL timing failure passed its one rerun without source or timeout changes; its original failure is retained. [Failure disposition](assets/2026-10-10-boat/evidence/full-local-failure-disposition.json).
[Current green CI and review receipt](assets/2026-10-10-boat/evidence/ci-8f62ee-4d2a23-passed.json), [verified deployment27](https://github.com/paperclipai/paperclip/blob/5909bfac9fa41405beb3fe8a65253dc28ba52835/doc/plans/assets/2026-10-10-boat/evidence/staging27-deployment.json), [staging28 failure receipt](assets/2026-10-10-boat/evidence/staging28-post-idle-failure.json), [preceding staging27 live receipt](assets/2026-10-10-boat/evidence/staging27-live-evidence.json). The historical chronology below preserves earlier observations and failures; its then-pending statements are superseded by later dated results. No provider stop was forced or cancelled, no quarantine was cleared, and no database history was reset or rewritten.
[Earlier green CI and review receipt](assets/2026-10-10-boat/evidence/ci-8f62ee-4d2a23-passed.json), [verified deployment27](https://github.com/paperclipai/paperclip/blob/5909bfac9fa41405beb3fe8a65253dc28ba52835/doc/plans/assets/2026-10-10-boat/evidence/staging27-deployment.json), [staging28 failure receipt](assets/2026-10-10-boat/evidence/staging28-post-idle-failure.json), [preceding staging27 live receipt](assets/2026-10-10-boat/evidence/staging27-live-evidence.json). The historical chronology below preserves earlier observations and failures; its then-pending statements are superseded by later dated results. No provider stop was forced or cancelled, no quarantine was cleared, and no database history was reset or rewritten.
## Reproduced link transition and reviewed route correction (2026-10-11 13:24 UTC)
An ordinary saved Codex task ran the bounded read-only probe against the exact retained Claude production pack `eee8609e`. The actual `tool.execution.completed` output, sequence 97, independently records the first failing read at 13:09:10: link count changed **1→2**, while device/inode, mode, uid/gid, size and mtime stayed equal. The descriptor and named-file identity checks remained true; ctime changed. The file was 102 bytes, with SHA-256 `42ce37809e7b25a8a04da912f303e3e2991a8d525ccb62d1008ed05172b24e5f`. A separate controller-only projection found two SDK module names sharing one inode and link count 2, with that same content hash. The published receipt uses relative-path hashes, not full guest paths.
This later probe reproduces the same `LINK_COUNT` fence; it does not recover the numeric values from the original failed Claude attempt. Nor does one read hash establish the guard's later two-pass continuity checks. The probe stopped at its first failure after 81 files and 3,394,381 bytes. The Codex run itself succeeded at 13:10:01.821 with the original saved identities; its owner was later observed retired. A provider-only read at 13:20:33.693 found archived/healthy state and normal stop completion at 13:10:28.588. No old pack, saved authority or integrity predicate was changed. [Sanitized tool, controller, run and archive evidence](assets/2026-10-10-boat/evidence/staging29-link-count-evidence.json).
The proposed packaging correction would materialize independent regular files inside a new unpublished package, preserve bytes, executable modes and symlinks, and bind that layout policy into the package digest. Existing caches and saved launch identities would remain untouched. This is still a proposal pending the independent-file versus hardlink archive/resume control; no staging deployment or final Claude lifecycle pass follows from this evidence.
Core `3223e57b74` separately fixes the reviewed Computer-route policy mismatch. A Kubernetes-only instance can no longer show or wake an agent/default Boat through Computer, presence or preview. The route uses the same execution-mode guard as heartbeat and refuses Boat even when managed Kubernetes configuration is missing. Former viewers can still disconnect their exact owner. Four actual-route regressions failed before the change; 27 focused route/policy cases passed with zero skips, server typecheck passed, and independent review found no remaining issue. Combined merge `869a304c62` preserves its separate mocked and real-database suites; both passed, **28/28**. [Correction verification](assets/2026-10-10-boat/evidence/computer-kubernetes-selection-verification.json).
Full workspace `pnpm -r typecheck` and `pnpm build` passed on combined `bcd94e340a`. The first typecheck attempt failed on sandbox registry access; its failure remains preserved alongside the successful authorized network-enabled attempt. These checks precede the route-only correction, which has the focused validation above. The full historical local test command was not rerun. [Source-bound build/typecheck receipt](assets/2026-10-10-boat/evidence/stack-bcd94-typecheck-build.json).
## Four-part draft stack and staging29 (2026-10-11 12:42 UTC)
The changes are split into [test fixtures #15878](https://github.com/paperclipai/paperclip/pull/15878), [shared runtime #15880](https://github.com/paperclipai/paperclip/pull/15880), [Boat core #15813](https://github.com/paperclipai/paperclip/pull/15813), and [UI #15804](https://github.com/paperclipai/paperclip/pull/15804). The intended base chain is master → fixtures → runtime → core → UI. All four branches are pushed and the remote base chain is set. Their diffs contain 5, 63, 97 and 75 files respectively including this evidence update, meeting the fewer-than-100-files limit. The four runtime review findings were reproduced and corrected in `96db0624874f484be1fd8c38b15c8e46cfa9edef` with 188 passing tests, six existing platform skips, affected typechecks and independent review passing. The two Boat core findings are corrected in `c9ae885fd9` with atomic credential attachment and explicit existing-branch intent, with 267 integration, 7 contract and 15 preparation tests passing plus server typecheck and independent review. Generic contract `6ce1d17e96` is included in the runtime prerequisite as `ab1e8acc68`. These fixes are integrated locally; latest-head CI and fresh remote review remain pending. [Boat correction proof](assets/2026-10-10-boat/evidence/boat-credential-workspace-review-verification.json). [Runtime correction proof](assets/2026-10-10-boat/evidence/pr15880-review-verification.json). Historical evidence remains accessible at the fixed commit linked above.
The changes are split into [test fixtures #15878](https://github.com/paperclipai/paperclip/pull/15878), [shared runtime #15880](https://github.com/paperclipai/paperclip/pull/15880), [Boat core #15813](https://github.com/paperclipai/paperclip/pull/15813), and [UI #15804](https://github.com/paperclipai/paperclip/pull/15804). The intended base chain is master → fixtures → runtime → core → UI. All four branches are pushed and the remote base chain is set. At that stack snapshot their diffs contained 5, 63, 97 and 75 files respectively. The later bounded evidence additions remain below the fewer-than-100-files limit. The four runtime review findings were reproduced and corrected in `96db0624874f484be1fd8c38b15c8e46cfa9edef` with 188 passing tests, six existing platform skips, affected typechecks and independent review passing. The two Boat core findings are corrected in `c9ae885fd9` with atomic credential attachment and explicit existing-branch intent, with 267 integration, 7 contract and 15 preparation tests passing plus server typecheck and independent review. Generic contract `6ce1d17e96` is included in the runtime prerequisite as `ab1e8acc68`. These fixes are integrated locally; latest-head CI and fresh remote review remain pending. [Boat correction proof](assets/2026-10-10-boat/evidence/boat-credential-workspace-review-verification.json). [Runtime correction proof](assets/2026-10-10-boat/evidence/pr15880-review-verification.json). Historical evidence remains accessible at the fixed commit linked above.
The isolated prerequisite workspace passed build and typecheck. Six legacy browser cases were blocked before assertions by local embedded-Postgres setup. All six subsequently passed in browser shard 8 on both exact prerequisite heads (20/20 cases per shard at 12:38 UTC); the original local setup failures remain recorded. Other prerequisite checks remain pending. [Exact-head browser CI proof](assets/2026-10-10-boat/evidence/prerequisite-legacy-browser-ci-proof.json). Four identity fixtures passed on the prerequisite but initially failed when integrated with Boat because their mock lacked lifecycle callbacks. The corrected typed fixture preserves identity checks and adds retention/retirement assertions; the complete executor suite passed **835/835, zero skips**, with server typecheck and independent review passing. [Integration verification](assets/2026-10-10-boat/evidence/prerequisite-identity-integration-verification.json).
@@ -0,0 +1,35 @@
{
"baseHead": "51db2ab62f365642e3d8476dc7ff7d41d138471e",
"scope": [
"server/src/routes/computers.ts",
"server/src/__tests__/computer-routes.test.ts"
],
"regression": {
"failedBefore": 4,
"passedBaseline": 8,
"log": "computer-kubernetes-selection-red.log"
},
"verification": {
"passed": 27,
"skipped": 0,
"files": 2,
"log": "computer-kubernetes-selection-green.log",
"serverTypecheckExit": 0,
"typecheckLog": "computer-kubernetes-selection-tsc.log",
"diffCheck": "passed"
},
"authority": "Same execution-policy helper as heartbeat; rejects Boat GET/connect/preview/presence under forced Kubernetes before provider access; keeps scoped former-viewer disconnect. No provisioning, remote calls, or product database access.",
"database": "Disposable UUID database on existing task-owned PostgreSQL, exact database dropped by harness.",
"prPathsAgainstPushedRuntimeAb1": 97,
"commit": "3223e57b747844834d57d3915d8e7c60b119c723",
"independentReview": "Approved by claude_bootstrap_root_cause; no actionable findings.",
"workingTree": "clean",
"combinedMerge": "869a304c62835e0143864fed012d10cf0751818e",
"combinedVerification": {
"passed": 28,
"skipped": 0,
"files": 2,
"logSha256": "b2049be88ba6cd588f90be9ddc69c86f6e8b5558d0abd3c2d33c0523e2642ae7",
"testMapping": "Preserve existing mocked computer-routes suite; map core selection suite to existing computer-route-selection path."
}
}
@@ -0,0 +1,21 @@
{
"schema": "paperclip/boat-stack-build-verification/v1",
"source": "bcd94e340ada5e62145b9a2bee26745d60dc3d99",
"checks": [
{
"command": "pnpm -r typecheck",
"result": "passed",
"exitCode": 0,
"logSha256": "a51d076b8f194b281b2272cecca50e1471d804bed194e1df83457db0e9aeab52"
},
{
"command": "pnpm build",
"result": "passed",
"exitCode": 0,
"logSha256": "c4156d5022133055f8b3166a6507ef523e4914b79a5e8857e7320b521ba4ea43"
}
],
"initialAttempt": "Initial sandbox typecheck attempt failed on package-manager registry access; the authorized network-enabled attempt passed. Original failure retained.",
"scope": "These full checks precede the two-file Kubernetes route correction. That correction has focused checks and server typecheck; combined merge has both route suites passing.",
"fullLocalSuite": "Not rerun; historical Darwin 34914 passed/24 failed/338 skipped and later Linux disposition remain separately recorded."
}
@@ -0,0 +1,177 @@
{
"schema": "paperclip/boat-link-count-evidence/v1",
"source": "05f3725af838b5a074707df1d6ed1e193bdfe49e",
"status": "positive diagnostic reproduction; package correction not yet qualified",
"rawToolEvidence": {
"observedAt": "2026-10-11T13:13:23.059Z",
"runId": "b492651b-f616-4b43-aa9d-f35a2ccdeb24",
"eventType": "tool.execution.completed",
"eventSeq": 97,
"probeSha256": "b78c70e4cdc6818dc1dd000c4b0a592a401eb396a735ecb6c2cda1e21f765463",
"probe": {
"schema": "paperclip/boat-module-link-probe/v1",
"startedAt": "2026-10-11T13:09:09.933Z",
"packDigest": "eee8609e9377e24a4588f27816834f15a665d22e23521edc1cf498f9c35f7fff",
"files": 81,
"entries": 256,
"bytes": 3394381,
"skipped": 164,
"readPasses": 160,
"complete": false,
"stop": "LINK_COUNT",
"firstFailure": {
"package": "@agentclientprotocol/sdk",
"relativePathSha256": "0116f85e60a1150012e83ebc56420360b586e0d10ac23611c222c158d3680f1a",
"moduleFence": "LINK_COUNT",
"probeCode": null,
"initialDescriptor": {
"nlink": "1",
"dev": "100",
"ino": "6589",
"mode": "33152",
"uid": "1000",
"gid": "1000",
"size": "102",
"mtimeNs": "1791720469000000000",
"ctimeNs": "1791720469000000000"
},
"lastDescriptor": {
"nlink": "2",
"dev": "100",
"ino": "6589",
"mode": "33152",
"uid": "1000",
"gid": "1000",
"size": "102",
"mtimeNs": "1791720469000000000",
"ctimeNs": "1791724150000000000"
},
"failingRead": {
"attempt": 1,
"nlinkBefore": "1",
"nlinkAfter": "2",
"direction": "increase",
"equal": {
"dev": true,
"ino": true,
"mode": true,
"uid": true,
"gid": true,
"size": true,
"mtime": true,
"ctime": false
}
},
"pathEqual": true,
"namedEqual": true,
"readHashes": [
"42ce37809e7b25a8a04da912f303e3e2991a8d525ccb62d1008ed05172b24e5f"
]
},
"finishedAt": "2026-10-11T13:09:10.008Z",
"elapsedMs": 75
}
},
"controllerProjection": {
"observedAt": "2026-10-11T13:13:52.323Z",
"guestReads": false,
"package": "@agentclientprotocol/sdk@1.4.0",
"files": [
{
"relativePathSha256": "eb0848fa83c746c9a1ee9db2470b2bd56187e30a58e260581b1815502f07f06a",
"sha256": "42ce37809e7b25a8a04da912f303e3e2991a8d525ccb62d1008ed05172b24e5f",
"metadata": {
"dev": "197",
"ino": "144460094",
"nlink": "2",
"mode": "33188",
"uid": "0",
"gid": "0",
"size": "102",
"mtimeNs": "1791720469000000000",
"ctimeNs": "1791721327370129733"
}
},
{
"relativePathSha256": "0116f85e60a1150012e83ebc56420360b586e0d10ac23611c222c158d3680f1a",
"sha256": "42ce37809e7b25a8a04da912f303e3e2991a8d525ccb62d1008ed05172b24e5f",
"metadata": {
"dev": "197",
"ino": "144460094",
"nlink": "2",
"mode": "33188",
"uid": "0",
"gid": "0",
"size": "102",
"mtimeNs": "1791720469000000000",
"ctimeNs": "1791721327370129733"
}
}
],
"sameDeviceAndInode": true
},
"probeRunFinalState": {
"observedAt": "2026-10-11T13:20:25.957Z",
"guestReads": false,
"runs": [
{
"id": "b492651b-f616-4b43-aa9d-f35a2ccdeb24",
"providerBefore": "01a12881-5d3b-72a0-b4c3-d993f5b089e1",
"providerAfter": "01a12881-5d3b-72a0-b4c3-d993f5b089e1",
"recoveryPresent": false,
"status": "succeeded",
"startedAt": "2026-10-11T13:06:30.450Z",
"finishedAt": "2026-10-11T13:10:01.821Z",
"nativeSessionId": "06496696-b312-4268-ac40-66770aaa6f1a",
"runnerInstanceId": "0005a613-101d-475f-9409-8b8e8b87e9ce",
"matchesOriginalNativeSession": true,
"matchesOriginalLogicalRunner": true,
"moduleFences": [],
"knownErrorCodes": []
}
],
"owners": [
{
"id": "227d3de1-3004-4e61-a480-a112fc9a3115",
"phase": "retired",
"deadline": null,
"boot": "8e9dc331-2f03-48cb-8a82-6be19ef26776",
"launch": 1
}
]
},
"providerAfterProbe": {
"observedAt": "2026-10-11T13:20:33.693Z",
"guestRead": false,
"state": "archived",
"health": "ok",
"stop": {
"id": "stop_e8a59be259342af9",
"status": "completed",
"timestamps": {
"endedAt": "2026-10-11T13:10:28.588Z"
},
"errorPresent": false
}
},
"interpretation": {
"proven": [
"The probe reproduced a first-pass link-count increase from 1 to 2 on the same 102-byte descriptor, with matching device/inode/mode/uid/gid/size/mtime and retained canonical/named identity.",
"The read SHA-256 equals both projected controller SDK twins; those two controller files share one device/inode with link count 2.",
"The ordinary Codex probe run succeeded with its saved session, its owner retired, and a later provider-only read found archive complete."
],
"limits": [
"This later probe does not recover numeric before/after values for the original failed Claude read. It reproduces the same closed fence in that pinned production package.",
"The exact guard rejected before later continuity checks; one read digest is not proof of two-pass byte continuity.",
"The evidence does not yet prove that independently materialized equal-byte files survive Boat archive/resume without a link transition.",
"Packaging normalization and a digest-bound layout policy remain proposed; no guard, existing immutable pack, saved session, or deployment was changed for this probe."
]
},
"provenance": {
"staging29-probe-raw-tool-output.json": "cf196eaec73a1753b703eb136cd01e4743b8e5246b7a05baae52568c2c043722",
"staging29-link-count-probe.mjs": "b78c70e4cdc6818dc1dd000c4b0a592a401eb396a735ecb6c2cda1e21f765463",
"staging29-controller-sdk-twins.json": "4b84fb0c9e129f0b711b4ea24dc2364bdd7fe9d80ccc6edb8c79f37113d0f545",
"staging29-codex-probe-final-state.json": "f21eea8da36007b885efcfa0bf74067f6a78a41f5c7a3977ed3487e339743ef1",
"retry-staging-25-provider-after-link-probe.json": "2aa60ec26f876902c54ff0075df1f6d97a9df2b4be340b96d07263c8ab123852"
}
}