Jannik/PaperClipAI
1
0 Fork 0
mirror of https://github.com/paperclipai/paperclip.git synced 2026-10-31 22:24:16 +01:00
Code Issues Packages Projects Releases Wiki Activity

feat(runner): prepare held Pi 1 production admission

Browse Source 
Replay the inactive Pi-only admission patch on the frozen Pi 1.0.0 source, preserving profile 11, its exact digest and all native closure inputs. Cursor and Copilot remain gated. This local preparation requires complete qualification and rebuilt normal-mode acceptance before activation.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
DottaandPaperclip committed 2026-10-01 15:45:57 -05:00
1 parent 5eba61ece9
commit 89284e2905
27 files changed
+191 -52
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

server/src/services/native-runtime/native-session-executor.test.ts
+20 -5
View File
@@ -1163,22 +1163,32 @@ describe("remote provider pack manifest", () => {
const candidatePath = "provider-assets/pi/linux-x64";
await mkdir(join(root, candidatePath), { recursive: true });
await writeFile(join(root, candidatePath, "runtime"), "pinned runtime");
const candidates = { pi: { version: "0.0.33", profileDigest: digest("profile"),
closureDigest: digest("closure"), qualification: "pending", path: candidatePath,
const candidates = { pi: { version: "1.0.0", profileDigest: digest("profile"),
closureDigest: digest("closure"), qualification: "qualified", path: candidatePath,
sha256: sha256DirectoryTree(join(root, candidatePath)) } };
Object.assign(payload, { candidateProviders: candidates });
await writeManifest();
expect(readRemoteProviderPackManifest(root).payload.candidateProviders?.pi?.qualification).toBe("pending");
expect(readRemoteProviderPackManifest(root).payload.candidateProviders?.pi?.qualification).toBe("qualified");
await writeFile(join(root, candidatePath, "runtime"), "substitute runtime");
expect(() => readRemoteProviderPackManifest(root)).toThrow("candidate asset tree digest mismatch");
await writeFile(join(root, candidatePath, "runtime"), "pinned runtime");
for (const invalid of [{ path: "../outside" }, { qualification: "qualified" }]) {
candidates.pi.qualification = "pending";
await writeManifest();
expect(readRemoteProviderPackManifest(root).payload.candidateProviders?.pi?.qualification).toBe("pending");
candidates.pi.qualification = "qualified";
for (const invalid of [{ path: "../outside" }, { qualification: "unknown" }]) {
const original = { ...candidates.pi };
Object.assign(candidates.pi, invalid);
await writeManifest();
expect(() => readRemoteProviderPackManifest(root)).toThrow("invalid candidate identity");
candidates.pi = original;
}
for (const provider of ["cursor", "copilot"]) {
Object.assign(candidates, { [provider]: { ...candidates.pi, path: `provider-assets/${provider}/linux-x64` } });
await writeManifest();
expect(() => readRemoteProviderPackManifest(root)).toThrow("invalid candidate identity");
delete (candidates as Record<string, unknown>)[provider];
}
await writeManifest();
for (const [artifactName, substituteName] of [
["nodeCommand", "productionLock"],
@@ -8769,6 +8779,11 @@ describe("native process ownership", () => {
},
"acpx_runtime",
],
[
"Pi ACPX without candidate authorization",
{ kind: "acpx", agent: "pi", model: "openrouter/deepseek/deepseek-v4-flash-0731", permissionMode: "approve-reads" },
"acpx_runtime",
],
])(
"admits the qualified %s provider",
async (_name, provider, driverKind) => {
@@ -8807,7 +8822,7 @@ describe("native process ownership", () => {
},
);
it.each(["pi", "cursor", "copilot"])("rejects ACPX candidate %s without host authorization before constructing a backend", async (agent) => {
it.each(["cursor", "copilot"])("rejects ACPX candidate %s without host authorization before constructing a backend", async (agent) => {
const piExecution = {
...execution,
binding: { ...execution.binding, runId: "run-acpx-pi-rejected" },