Reconcile Claude platform qualification with current master

Co-Authored-By: Paperclip <noreply@paperclip.ing>

scripts/__tests__/e2e-shard.test.mjs

@@ -57,9 +57,9 @@ function readWorkflowJobs(workflow) {
 function runStackScope(stack, prBaseRef) {
   const workflow = readFileSync(routingWorkflow, "utf8");
   const match = workflow.match(
-    /      - name: Select stacked PR CI scope[\s\S]*?        run: \|\n([\s\S]*?)\s*$/,
+    /      - name: Select PR CI scope[\s\S]*?        run: \|\n([\s\S]*?)\s*$/,
   );
-  assert.ok(match, "routing workflow must define the stacked PR scope script");
+  assert.ok(match, "routing workflow must define the PR CI scope script");
   const script = match[1]
     .split("\n")
     .map((line) => line.replace(/^ {10}/, ""))

scripts/__tests__/provision-worktree-self-heal.test.mjs

@@ -345,16 +345,11 @@ test("rejects a dangling base workspace .paperclip symlink instead of falling ba
   assert.match(result.stderr, /\.paperclip is a broken symlink/);
 });
 
-test("falls back to an isolated config when the base CLI cannot boot", () => {
-  // Simulates the dangling pnpm symlink incident: the runner and entry files
-  // exist, but booting the CLI fails ESM resolution. The base has no
-  // package.json/pnpm-lock.yaml, so the repair install is not possible and the
-  // script must degrade to the no-CLI fallback config instead of failing.
+test("isolates fallback configuration and reconciles deployment mode from the registered source when reusing a guest config", () => {
   const baseCwd = makeBaseWorkspace({ helpExit: 1, initExit: 0 });
-  const { result, worktreeCwd, worktreesHome } = runProvision(baseCwd);
-
-  assert.equal(result.status, 0, result.stderr);
-  assert.match(result.stderr, /writing isolated fallback config/);
+  const { result: first, worktreeCwd, worktreesHome, paperclipHome } = runProvision(baseCwd);
+  assert.equal(first.status, 0, first.stderr);
+  assert.match(first.stderr, /writing isolated fallback config/);
   const config = readWorktreeConfig(worktreeCwd);
   assert.equal(config.$meta.source, "configure");
   const dataDir = config.database.embeddedPostgresDataDir;
@@ -368,12 +363,7 @@ test("falls back to an isolated config when the base CLI cannot boot", () => {
     JSON.parse(fs.readFileSync(path.join(worktreeCwd, ".paperclip", "seed-manifest.json"), "utf8")).state,
     "pending",
   );
-});
 
-test("reconciles deployment mode from the registered source when reusing a guest config", () => {
-  const baseCwd = makeBaseWorkspace({ helpExit: 1, initExit: 0 });
-  const { result: first, worktreeCwd, worktreesHome, paperclipHome } = runProvision(baseCwd);
-  assert.equal(first.status, 0, first.stderr);
   assert.equal(readWorktreeConfig(worktreeCwd).server.deploymentMode, "local_trusted");
 
   // A base workspace that does carry its own instance config outranks the fallback.

scripts/__tests__/run-vitest-stable-shard.test.mjs

@@ -52,18 +52,6 @@ function dryRunJson(args, envOverrides = {}) {
 const SHARD_COUNT = 12;
 const SERIALIZED_SHARD_COUNT = 9;
 
-
-test("the serialized shards form a complete, non-overlapping partition", () => {
-  const shards = Array.from({ length: SERIALIZED_SHARD_COUNT }, (_, index) =>
-    dryRunJson(["--mode", "serialized", "--shard-index", String(index), "--shard-count", String(SERIALIZED_SHARD_COUNT)]),
-  );
-
-  const total = shards[0].serializedSuiteCount;
-  const selected = shards.flatMap((shard) => shard.selectedSerializedSuites);
-  assert.equal(selected.length, total, "every serialized suite must be selected exactly once");
-  assert.equal(new Set(selected).size, total, "serialized shards must not overlap");
-});
-
 test("the general-server shards form a complete, non-overlapping partition", () => {
   const shards = Array.from({ length: SHARD_COUNT }, (_, index) =>
     dryRunJson(["--mode", "general", "--group", "general-server", "--shard-index", String(index), "--shard-count", String(SHARD_COUNT)]),
@@ -77,6 +65,10 @@ test("the general-server shards form a complete, non-overlapping partition", ()
   for (const shard of shards) {
     assert.equal(shard.generalServerSuiteCount, total, "suite count must be stable across shards");
     for (const file of shard.selectedGeneralServerSuites) {
+      assert.ok(
+        !(file.startsWith("server/src/__tests__/") && /[^/]*(?:route|routes|authz)[^/]*\.test\.ts$/.test(file)),
+        `route/authz suite must stay in the serialized lane, not general-server: ${file}`,
+      );
       assert.ok(!seen.has(file), `suite assigned to more than one shard: ${file}`);
       seen.add(file);
       selectedTotal += 1;
@@ -88,16 +80,6 @@ test("the general-server shards form a complete, non-overlapping partition", ()
   assert.equal(seen.size, total, "union of shards must cover the whole suite set");
 });
 
-test("a route/authz suite never leaks into the general-server shards", () => {
-  const shard = dryRunJson(["--mode", "general", "--group", "general-server", "--shard-index", "0", "--shard-count", SHARD_COUNT.toString()]);
-  for (const file of shard.selectedGeneralServerSuites) {
-    assert.ok(
-      !(file.startsWith("server/src/__tests__/") && /[^/]*(?:route|routes|authz)[^/]*\.test\.ts$/.test(file)),
-      `route/authz suite must stay in the serialized lane, not general-server: ${file}`,
-    );
-  }
-});
-
 test("general shards retain scripts and route-named suites outside the serialized directory", () => {
   const general = dryRunJson(["--mode", "general", "--group", "general-server", "--shard-index", "0", "--shard-count", "1"]);
   for (const file of [
@@ -306,13 +288,18 @@ test("the checked-in serialized manifest loads and covers most of the current su
   );
 });
 
-test("the real serialized shard partition is duration-balanced", () => {
+test("the real serialized shard partition is complete, non-overlapping and duration-balanced", () => {
   const durations = loadShardDurations(serializedDurationsManifest);
   const fallback = defaultSuiteWeight(durations);
   const shards = Array.from({ length: SERIALIZED_SHARD_COUNT }, (_, index) =>
     dryRunJson(["--mode", "serialized", "--shard-index", String(index), "--shard-count", String(SERIALIZED_SHARD_COUNT)]),
   );
 
+  const total = shards[0].serializedSuiteCount;
+  const selected = shards.flatMap((shard) => shard.selectedSerializedSuites);
+  assert.equal(selected.length, total, "every serialized suite must be selected exactly once");
+  assert.equal(new Set(selected).size, total, "serialized shards must not overlap");
+
   const totals = shards.map((shard) =>
     shard.selectedSerializedSuites.reduce((sum, file) => sum + (durations[file] ?? fallback), 0),
   );
@@ -326,19 +313,26 @@ test("the real serialized shard partition is duration-balanced", () => {
   );
 });
 
-test("the real shard partition is duration-balanced", () => {
-  // Mirrors the PR matrix: general-server-without-chat across SHARD_COUNT
-  // runners, with the chat suite carried by the dedicated general-chat lanes
-  // and the native-runner suite by the Rust-cached PR vitest lane.
+const chatSuitePath = "server/src/__tests__/chat-channels.integration.test.ts";
+const nativeRunnerSuitePath =
+  "server/src/services/native-runtime/native-codex-runner.integration.test.ts";
+const dotRunnerSuitePath = "server/src/__tests__/dot-runner.test.ts";
+const restartRecoverySuitePath =
+  "server/src/services/native-runtime/native-runner-restart-recovery.integration.test.ts";
+
+// Mirrors pr-trusted.yml (12 shards, called by pr.yml so GITHUB_WORKFLOW is
+// "PR"): the chat suite runs in its dedicated lanes and the cargo-dependent
+// native-runner suite in the Rust-cached final Verify Paperclip Runner vitest
+// shard, so together the three cover the full server group exactly.
+test("12 PR without-chat shards plus the dedicated chat and native-runner lanes cover the original server group exactly", () => {
   const durations = loadShardDurations(durationsManifest);
   const fallback = defaultSuiteWeight(durations);
-  const shards = Array.from({ length: SHARD_COUNT }, (_, index) =>
-    dryRunJson(
-      ["--mode", "general", "--group", "general-server-without-chat", "--shard-index", String(index), "--shard-count", String(SHARD_COUNT)],
-      { GITHUB_WORKFLOW: "PR" },
-    ),
-  );
-
+  const prEnv = { GITHUB_WORKFLOW: "PR" };
+  const full = dryRunJson(["--mode", "general", "--group", "general-server", "--shard-index", "0", "--shard-count", "1"], prEnv);
+  const shards = Array.from({ length: 12 }, (_, index) => dryRunJson([
+    "--mode", "general", "--group", "general-server-without-chat",
+    "--shard-index", String(index), "--shard-count", "12",
+  ], prEnv));
   const totals = shards.map((shard) =>
     shard.selectedGeneralServerSuites.reduce((sum, file) => sum + (durations[file] ?? fallback), 0),
   );
@@ -359,27 +353,7 @@ test("the real shard partition is duration-balanced", () => {
     maxTotal - minTotal <= heaviest,
     `shard weight spread ${maxTotal - minTotal}ms exceeds heaviest suite ${heaviest}ms: ${totals.join(", ")}`,
   );
-});
 
-
-const chatSuitePath = "server/src/__tests__/chat-channels.integration.test.ts";
-const nativeRunnerSuitePath =
-  "server/src/services/native-runtime/native-codex-runner.integration.test.ts";
-const dotRunnerSuitePath = "server/src/__tests__/dot-runner.test.ts";
-const restartRecoverySuitePath =
-  "server/src/services/native-runtime/native-runner-restart-recovery.integration.test.ts";
-
-// Mirrors pr-trusted.yml (12 shards, called by pr.yml so GITHUB_WORKFLOW is
-// "PR"): the chat suite runs in its dedicated lanes and the cargo-dependent
-// native-runner suite in the Rust-cached final Verify Paperclip Runner vitest
-// shard, so together the three cover the full server group exactly.
-test("12 PR without-chat shards plus the dedicated chat and native-runner lanes cover the original server group exactly", () => {
-  const prEnv = { GITHUB_WORKFLOW: "PR" };
-  const full = dryRunJson(["--mode", "general", "--group", "general-server", "--shard-index", "0", "--shard-count", "1"], prEnv);
-  const shards = Array.from({ length: 12 }, (_, index) => dryRunJson([
-    "--mode", "general", "--group", "general-server-without-chat",
-    "--shard-index", String(index), "--shard-count", "12",
-  ], prEnv));
   const files = shards.flatMap((shard) => shard.selectedGeneralServerSuites);
   assert.ok(!files.includes(chatSuitePath));
   assert.ok(!files.includes(nativeRunnerSuitePath));

scripts/benchmark-workspace-authorization.ts

@@ -0,0 +1,74 @@
+import assert from "node:assert/strict";
+import { randomUUID } from "node:crypto";
+import { execFileSync } from "node:child_process";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { createRequire } from "node:module";
+const { and, eq } = createRequire(new URL("../server/package.json", import.meta.url))("drizzle-orm");
+import { agents, authUsers, companies, companyMemberships, createDb, executionWorkspaces, issues,
+  startEmbeddedPostgresTestDatabase, type Db } from "../packages/db/src/index.js";
+import * as authorization from "../server/src/services/authorization.js";
+
+const baselineRef = process.argv.find(arg => arg.startsWith("--baseline-ref="))?.slice(15) ?? "HEAD";
+const baselineRevision = execFileSync("git", ["rev-parse", `${baselineRef}^{commit}`], { encoding: "utf8" }).trim();
+process.env.PAPERCLIP_ISSUE_PRIVACY_MODE = "enforce";
+const keepAlive = setInterval(() => {}, 1000);
+let database: Awaited<ReturnType<typeof startEmbeddedPostgresTestDatabase>> | undefined;
+let db: Db | undefined;
+let baselineDir: string | undefined;
+try {
+  database = await startEmbeddedPostgresTestDatabase("workspace-authorization-benchmark-");
+  db = createDb(database.connectionString);
+  baselineDir = await fs.mkdtemp(fileURLToPath(new URL("../server/scripts/.workspace-auth-baseline-", import.meta.url)));
+  const original = new URL("../server/src/services/authorization.ts", import.meta.url);
+  const source = execFileSync("git", ["show", `${baselineRevision}:server/src/services/authorization.ts`], { encoding: "utf8" });
+  const rewritten = source.replace(/from "(\.{1,2}\/[^\"]+)"/g,
+    (_match, specifier: string) => `from ${JSON.stringify(fileURLToPath(new URL(specifier, original)))}`);
+  const baselinePath = path.join(baselineDir, "authorization.ts");
+  await fs.writeFile(baselinePath, rewritten);
+  const baseline = await import(pathToFileURL(baselinePath).href) as typeof authorization;
+  const companyId = randomUUID(), agentId = randomUUID(), userId = randomUUID(), workspaceId = randomUUID();
+  await db.insert(companies).values({ id: companyId, name: "Synthetic workspace authorization", issuePrefix: "BENCH" });
+  await db.insert(authUsers).values({ id: userId, name: "Sponsor", email: `${userId}@example.test`, emailVerified: true, createdAt: new Date(), updatedAt: new Date() });
+  await db.insert(agents).values({ id: agentId, companyId, name: "Worker", adapterType: "process" });
+  await db.insert(companyMemberships).values({ companyId, principalType: "user", principalId: userId, status: "active", membershipRole: "operator" });
+  await db.insert(executionWorkspaces).values({ id: workspaceId, companyId, name: "Shared source", mode: "shared_workspace", strategyType: "operator_directory" });
+  await db.$client.unsafe(`insert into issues (company_id, title) select $1, 'Historical task ' || n from generate_series(1, 13428) n`, [companyId]);
+  const [sourceIssue] = await db.insert(issues).values({ companyId, title: "Retained source after unrelated history" }).returning({ id: issues.id });
+  await db.update(executionWorkspaces).set({ sourceIssueId: sourceIssue.id }).where(eq(executionWorkspaces.id, workspaceId));
+  await db.$client.unsafe("ANALYZE");
+  const actor: authorization.AuthorizationActor = { type: "agent", source: "agent_jwt", agentId, companyId, onBehalfOfUserId: userId };
+  const queries = await Promise.all([baseline, authorization].map(async module => db!.select().from(executionWorkspaces).where(and(
+    eq(executionWorkspaces.id, workspaceId), eq(executionWorkspaces.companyId, companyId),
+    await module.executionWorkspaceReadSqlCondition(db!, actor),
+  )).toSQL()));
+  const samples: number[][] = [[], []];
+  let expected: unknown;
+  for (let n = 0; n < 7; n++) {
+    for (const variant of n % 2 ? [1, 0] : [0, 1]) {
+      const query = queries[variant];
+      const start = performance.now();
+      const rows = await db.$client.unsafe(query.sql, query.params as never[]).values();
+      if (n >= 2) samples[variant].push(performance.now() - start);
+      assert.equal(rows.length, 1);
+      if (expected === undefined) expected = rows;
+      else assert.deepEqual(rows, expected);
+    }
+  }
+  const results = [];
+  for (const [variant, query] of queries.entries()) {
+    const [plan] = await db.$client.unsafe(`EXPLAIN (ANALYZE, BUFFERS, FORMAT JSON) ${query.sql}`, query.params as never[]);
+    results.push({ variant: variant ? "treatment" : "baseline", samplesMs: samples[variant],
+      medianMs: [...samples[variant]].sort((a, b) => a - b)[2], sql: query.sql, params: query.params, plan: plan["QUERY PLAN"] });
+  }
+  console.log(JSON.stringify({ baselineRevision, tasks: 13429, retainedSources: 1, equalCompleteRows: true,
+    fixtureIds: { companyId, agentId, userId, workspaceId },
+    postgres: (await db.$client.unsafe("select version()"))[0].version, results }, null, 2));
+} finally {
+  try {
+    await db?.$client.end({ timeout: 0 });
+    await database?.cleanup();
+    if (baselineDir) await fs.rm(baselineDir, { recursive: true, force: true });
+  } finally { clearInterval(keepAlive); }
+}

scripts/benchmark-workspace-record-reads.ts

@@ -0,0 +1,81 @@
+import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { promisify } from "node:util";
+import { companies, createDb, executionWorkspaces, startEmbeddedPostgresTestDatabase } from "../packages/db/src/index.js";
+import { executionWorkspaceService } from "../server/src/services/execution-workspaces.js";
+
+const run = promisify(execFile);
+const root = await fs.mkdtemp(path.join(os.tmpdir(), "workspace-record-benchmark-"));
+const repo = path.join(root, "repo");
+const worktree = path.join(root, "worktree");
+const residentMiB = Number(process.argv.find(arg => arg.startsWith("--resident-mib="))?.split("=")[1] ?? 0);
+assert.ok(Number.isInteger(residentMiB) && residentMiB >= 0 && residentMiB <= 2048);
+const previousTrace = process.env.GIT_TRACE;
+const keepAlive = setInterval(() => {}, 1000);
+let database: Awaited<ReturnType<typeof startEmbeddedPostgresTestDatabase>> | undefined;
+let db: ReturnType<typeof createDb> | undefined;
+try {
+  await fs.mkdir(repo);
+  const git = (...args: string[]) => run("git", ["-C", repo, ...args]);
+  await git("init", "-b", "main");
+  await git("config", "user.name", "Workspace benchmark");
+  await git("config", "user.email", "benchmark@paperclip.local");
+  await fs.writeFile(path.join(repo, "README.md"), "Synthetic workspace\n");
+  await git("add", "README.md");
+  await git("commit", "-m", "Fixture");
+  await git("worktree", "add", "-b", "fixture", worktree);
+  database = await startEmbeddedPostgresTestDatabase("workspace-record-benchmark-");
+  db = createDb(database.connectionString);
+  const companyId = randomUUID();
+  await db.insert(companies).values({ id: companyId, name: "Synthetic workspace reads", issuePrefix: "BENCH" });
+  const rows = await db.insert(executionWorkspaces).values(Array.from({ length: 20 }, (_, index) => ({
+    companyId, name: `Fixture ${index}`, mode: "isolated_workspace", strategyType: "git_worktree",
+    cwd: worktree, providerRef: worktree, providerType: "git_worktree", baseRef: "main", branchName: "fixture",
+  }))).returning();
+  const service = executionWorkspaceService(db);
+  const resident = Array.from({ length: residentMiB }, () => Buffer.alloc(1024 * 1024, 1));
+  const persisted = (workspace: NonNullable<Awaited<ReturnType<typeof service.getById>>>) => {
+    const { runtimeServices: _services, deliveryState: _delivery, ...record } = workspace;
+    return record;
+  };
+  const results = [];
+  let expected: ReturnType<typeof persisted>[] | undefined;
+  await service.getStoredById(companyId, rows[0].id);
+  for (const mode of ["detail", "stored"] as const) {
+    const trace = path.join(root, `${mode}.trace`);
+    process.env.GIT_TRACE = trace;
+    const start = performance.now();
+    const records = [];
+    for (const row of rows) {
+      const workspace = mode === "detail"
+        ? await service.getById(row.id)
+        : await service.getStoredById(companyId, row.id);
+      assert.ok(workspace);
+      records.push(persisted(workspace));
+    }
+    const wallMs = performance.now() - start;
+    if (expected) assert.deepEqual(records, expected);
+    else expected = records;
+    const traceText = await fs.readFile(trace, "utf8").catch(error => {
+      if (error.code === "ENOENT") return "";
+      throw error;
+    });
+    results.push({ mode, reads: rows.length, wallMs, gitCommands: traceText.split("\n").filter(line => line.includes("built-in: git ")).length });
+  }
+  assert.equal(results[1].gitCommands, 0);
+  console.log(JSON.stringify({ node: process.version, platform: process.platform, arch: process.arch,
+    residentMiB: resident.length, rssMiB: Math.round(process.memoryUsage().rss / 1024 / 1024),
+    equalPersistedRecords: true, results }, null, 2));
+} finally {
+  if (previousTrace === undefined) delete process.env.GIT_TRACE;
+  else process.env.GIT_TRACE = previousTrace;
+  try {
+    await db?.$client.end({ timeout: 0 });
+    await database?.cleanup();
+    await fs.rm(root, { recursive: true, force: true });
+  } finally { clearInterval(keepAlive); }
+}