chore: follow source comment contribution rules

Co-Authored-By: Paperclip <noreply@paperclip.ing>

scripts/__tests__/grok-public-install-sandbox.test.mjs

@@ -133,7 +133,6 @@ test('verification never elevates PR-controlled provisioning or cleanup on the h
 
 test('the image and Grok downloads start before staging and join without weakening the npm checks', () => {
   const source = readFileSync(new URL('../verify-grok-npm-install.mjs', import.meta.url), 'utf8');
-  // The optional Mac consumer owns separate scratch and no Linux prefetches.
   const linuxSource = source.slice(source.indexOf("assert.equal(process.platform, 'linux'"));
   const position = fragment => { const index = linuxSource.indexOf(fragment); assert.notEqual(index, -1, `verifier must contain ${fragment}`); return index; };
   // Exactly the pinned consumer image is pulled, for the platform the probes run on.
@@ -332,8 +331,6 @@ test('the installed Codex probe exercises the public export and rejects incomple
     writeFileSync(legacyCommand, '#!/bin/sh\nexit 0\n', { mode: 0o755 });
     writeFileSync(index, `export const resolvePinnedCodexCommand = () => ${JSON.stringify(legacyCommand)};`);
     result = run(); assert.notEqual(result.status, 0); assert.match(result.stderr, /Selected Codex platform version must match the qualified pin/);
-    // Native Codex uses protocol compatibility, not the ACPX version allowlist.
-    // Keep exact official-npm host provenance and the selected resource boundary.
     mkdirSync(join(legacy, 'vendor'));
     const legacyNative = join(legacy, 'vendor', triple, 'codex', process.platform === 'win32' ? 'codex.exe' : 'codex');
     mkdirSync(join(legacy, 'vendor', triple, 'codex'), { recursive: true }); writeFileSync(legacyNative, nativeBytes, { mode: 0o755 });

scripts/__tests__/release-verify-workflow.test.mjs

@@ -838,9 +838,6 @@ const waitForFixture = async (predicate, label) => {
   assert.fail(label);
 };
 
-// Execute the workflow's actual coordinator with two tiny local Node commands.
-// Both must cross the start barrier before either can finish; no pnpm, Cargo,
-// provider, registry, or Docker build runs in these fixtures.
 async function withNativePreparationFixture(mode, check) {
   const root = realpathSync(mkdtempSync(path.join(tmpdir(), 'native-preparation-')));
   let controller;
@@ -1007,7 +1004,6 @@ test("ARM qualification binds separate product and reusable-workflow revisions e
         TOOLING_WORKFLOW_REF: "paperclipai/paperclip/.github/workflows/release-smoke.yml@refs/heads/qualification",
         TOOLING_WORKFLOW_PATH: ".github/workflows/release-smoke.yml",
         FIXTURE_PRODUCT_HEAD: productHead, FIXTURE_TOOLING_HEAD: toolingHead, FIXTURE_PREPARED: prepared,
-        // Reusable calls retain the caller context; it must not select tooling.
         GITHUB_REPOSITORY: "different/caller", GITHUB_SHA: "d".repeat(40),
       } });
       assert.equal(result.status, expectedStatus, result.stderr);

scripts/dev-runner-native-binary.mjs

@@ -50,9 +50,6 @@ export function resolveNativeRunnerDevBinary({
   const flat = path.join(packageRoot, "dist", "bin", executable);
   const targetStat = statSync(target, { throwIfNoEntry: false });
   const flatStat = statSync(flat, { throwIfNoEntry: false });
-  // Release targets remain authoritative unless a newer source build matches
-  // this host. In particular, a build-host flat artifact cannot mask a remotely
-  // staged Mac target or force a local Cargo build.
   if (flatStat?.isFile() && (!targetStat?.isFile() || flatStat.mtimeMs > targetStat.mtimeMs)
     && runnerBinaryTarget(readFileSync(flat)) === `${platform}-${architecture}`) {
     return { binary: flat, sourceBuild: true };

scripts/dev-runner.ts

@@ -172,8 +172,6 @@ const env: NodeJS.ProcessEnv = {
   ...process.env,
   PAPERCLIP_UI_DEV_MIDDLEWARE: explicitUiDevMiddleware ?? (serveBuiltUiForManagedRuntime ? "false" : "true"),
 };
-// An automatic source-build override must not hide subsequent Rust edits from
-// the watcher. Keep the operator's original choice separate from server env.
 const configuredRunnerBinary = env.PAPERCLIP_RUNNER_BINARY;
 
 if (mode === "dev") {

scripts/grok-public-install-sandbox.mjs

@@ -11,8 +11,6 @@ export const GROK_PUBLIC_INSTALL_LIFECYCLE = [
   'npm', 'rebuild', '--offline', '--ignore-scripts=false', '--dangerously-allow-all-scripts',
 ];
 
-// setup-node provides its matching SDK alongside the executing Node binary.
-// Deferred lifecycle scripts may read that SDK, but may never download headers.
 export function macNodeHeadersDirectory(nodeExecutable, nodeVersion) {
   assert.match(nodeVersion, /^\d+\.\d+\.\d+$/, 'Executing Node must have an exact release version');
   const executable = realpathSync(nodeExecutable);
@@ -200,7 +198,6 @@ export function installedCodexProbeSource(indexPath, consumerRoot, expectedVersi
   `;
 }
 
-/** Installed bytes and consumer resolution must survive host protocol startup. */
 export function assertInstalledNativeConsumerContinuity(before, after) {
   for (const field of ['lockSha256', 'runnerSha256', 'codexCommandSha256', 'codexNativeExecutableSha256']) {
     if (!/^[a-f0-9]{64}$/.test(before[field]) || before[field] !== after[field]) {
@@ -209,7 +206,6 @@ export function assertInstalledNativeConsumerContinuity(before, after) {
   }
 }
 
-/** The installed consumer must select its packaged host daemon, never PATH. */
 export function installedDaemonProbeSource(outputRoot, consumerRoot, sourceRevision) {
   return `
     import assert from 'node:assert/strict';
@@ -254,8 +250,6 @@ export function installedDaemonProbeSource(outputRoot, consumerRoot, sourceRevis
   `;
 }
 
-// Hosted, credential-free Mac consumers defer only npm lifecycle execution.
-// Offline npm flags are not an OS network boundary; sandbox-exec supplies it.
 export function macPublicInstallLifecycleProfile(ownedRoot) {
   if (!ownedRoot.startsWith('/') || ownedRoot.includes('\0')) throw new Error('Mac lifecycle requires an absolute owned root');
   return `(version 1)\n(allow default)\n(deny network*)\n(deny file-write* (require-all (require-not (subpath ${JSON.stringify(ownedRoot)})) (require-not (literal "/dev/null"))))\n`;

scripts/pi-public-install-probe.mjs

@@ -32,8 +32,6 @@ export async function verifyPiPackagedDaemon(server, daemon, target, runnerBinar
     assert.equal(`sha256:${createHash('sha256').update(bytes).digest('hex')}`, artifact.sha256);
     assert.equal(runnerBinaryTarget(bytes), target);
   } else {
-    // Existing host-only source packages have no multi-target release manifest.
-    // They must still use their exact normal flat daemon, never an override.
     assert.equal(await realpath(daemon), expectedPath);
     assert.equal(runnerBinaryTarget(await readFile(expectedPath)), target);
   }

scripts/prepare-linux-arm64-qualification.sh

@@ -1,6 +1,4 @@
 #!/usr/bin/env bash
-# Prepare the disposable GitHub ARM qualification host using stock distro files.
-# Extraction skips package maintainer scripts and their global policy changes.
 set -euo pipefail
 
 if [[ "${GITHUB_ACTIONS:-}" != true || "${RUNNER_OS:-}" != Linux ]]; then
@@ -87,7 +85,6 @@ test "$(od -An -tx1 -N4 "$stock_binary" | tr -d ' \n')" = 7f454c46
 readelf -h "$stock_binary" | tee "$prerequisite_report_dir/bwrap-elf-header.txt"
 grep -E 'Machine:.*AArch64' "$prerequisite_report_dir/bwrap-elf-header.txt"
 
-# Reject every target symlink, including dangling links, before privileged copy.
 test ! -L /usr/bin/bwrap
 if test -e /usr/bin/bwrap; then
   test -f /usr/bin/bwrap

scripts/release.sh

@@ -284,9 +284,6 @@ release_info ""
 release_info "==> Step 2/7: Building workspace artifacts..."
 cd "$REPO_ROOT"
 pnpm build
-# Hosted producers supply data-only, hash/source/architecture-bound daemon
-# receipts. Assemble after the build (which stages its host binary), before
-# public packages are packed. The server vendors this same compiled runner.
 if [ -n "${PAPERCLIP_RELEASE_RUNNER_ARTIFACTS_DIR:-}" ]; then
   node "$REPO_ROOT/packages/paperclip-runner/scripts/stage-release-runner-binaries.mjs" \
     assemble-daemons "$PAPERCLIP_RELEASE_RUNNER_ARTIFACTS_DIR" "$(git rev-parse HEAD)"

scripts/verify-grok-npm-install.mjs

@@ -36,8 +36,6 @@ async function verifyMacConsumer(packageDirectory, sourceRevision, receiptPath)
     for (const directory of [consumer, home, tools, join(root, 'tmp'), join(root, 'cache')]) mkdirSync(directory);
     const npmCli = realpathSync(execFileSync('/usr/bin/which', ['npm'], { encoding: 'utf8' }).trim());
     symlinkSync(process.execPath, join(tools, 'node'));
-    // npm subprocesses get a Node-only owned tool directory; no ambient harness
-    // command can hide missing installed dependencies.
     const env = { PATH: `${tools}:/usr/bin:/bin:/usr/sbin:/sbin`, HOME: home, TMPDIR: join(root, 'tmp'),
       npm_config_cache: join(root, 'cache'), npm_config_audit: 'false', npm_config_fund: 'false' };
     const run = (command, args, cwd = consumer, runEnv = env) => execFileSync(command, args, { cwd, env: runEnv,
@@ -147,13 +145,8 @@ async function verifyLinuxArmConsumer(packageDirectory, sourceRevision, receiptP
     const daemon = probe('daemon-probe.mjs', installedDaemonProbeSource(installed, '/consumer', sourceRevision));
     assert.equal(daemon.target, 'linux-arm64');
     const codex = probe('codex-probe.mjs', installedCodexProbeSource(installed + '/index.js', '/consumer', undefined, { nativeCodex: true }));
-    // Reuse the existing zero-turn hook as read-only verifier source. All
-    // production imports still resolve from the installed consumer graph.
     cpSync(join(repo, 'tests/runner-e2e/installed-cli.ts'), join(assets, 'installed-cli.ts'));
     writeFileSync(join(assets, 'types.js'), stripTypeScriptTypes(readFileSync(join(repo, 'tests/runner-e2e/types.ts'), 'utf8')));
-    // The restricted install container deliberately forbids nested namespaces.
-    // Keep its lifecycle/no-network proof, then test the exact same bind-mounted
-    // graph on the native host using Codex's normal read-only namespace policy.
     const home = join(root, 'host-home'), hostTmp = join(root, 'host-tmp');
     for (const directory of [home, hostTmp]) mkdirSync(directory, { mode: 0o700 });
     const hostEnv = { PATH: `${dirname(process.execPath)}:/usr/bin:/bin:/usr/sbin:/sbin`, HOME: home, TMPDIR: hostTmp, LC_ALL: 'C', TZ: 'UTC' };
@@ -330,9 +323,6 @@ try {
   timing.stage_pack_ms = Math.round(performance.now() - packStarted);
   Object.assign(timing, packTimings(packs, concurrency));
 
-  // Preserve the exact Linux-produced public tarballs for independent Mac
-  // consumers even if a later Linux runtime probe fails. This is a packaging
-  // receipt, never an installation or provider-admission pass.
   if (process.env.PAPERCLIP_RUNNER_PUBLIC_PACKS_DIR) {
     const output = resolve(process.env.PAPERCLIP_RUNNER_PUBLIC_PACKS_DIR);
     assert.equal(JSON.parse(readFileSync(join(repo, 'server/dist/build-info.json'))).commit, sourceRevision);