Retain Pi startup timeout and bounded-copy diagnosis

Record the eighth supervised attempt, fresh merged-source pack proof, zero billing delta, and credential-free reproduction. Keep the measured copy fix separate from still-pending end-to-end qualification. Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-10-21 08:22:20 +02:00 · 2026-09-28 15:14:57 -05:00
1 parent b3824f53df
commit dd78df1ef8
@@ -2,7 +2,8 @@

 Status: implementation candidate, 2026-09-28. Deterministic protocol tests and an
 uncredentialed admission probe pass. One paid local Runner turn reached semantic
-tools but timed out; Product E2E setup exposed a separate candidate-admission gap.
+tools but timed out; the latest Product attempt stopped before a prompt because
+verified snapshot preparation exceeded the startup deadline.
 Local and Linux x64 Daytona qualification remain pending; this document does not promote the candidate to a
 qualified production runtime.

@@ -241,29 +242,26 @@ helper discards failed-attempt usage, so any retry or missing compaction receipt
 invalidates complete-turn token/cost totals instead of inventing complete coverage.

 The retained [macOS ARM64 provider-pack admission proof](../../packages/paperclip-runner/test-fixtures/pi-acp/offline-provider-pack-proof.darwin-arm64.json)
-records source `a6167ce3a7804c31f4f9990a9ba6761c1d91f27c`, after final-spawn
-credential-marker preservation and direct candidate-admission gating. It includes
-the Node engine, Pi v2 fixture, assigned HTTPS gateway, and failed-turn receipt
-repairs. Its manifest digest is
-`sha256:0ed45bf84d172aa7087baec3d662275206e8121b0ba142aaa9039dcfbf4402a2`.
-This refresh also includes candidate initialization, canonical CLI paths, usage
-provenance and reasoning projection repairs; the prior
-[58511d79d proof](../../packages/paperclip-runner/test-fixtures/pi-acp/offline-provider-pack-proof.darwin-arm64.58511d79d.json)
-remains a historical observation.
-The clean tracked-lock resolution matched Docker's reviewed
-`650e23d20e967bcfbfced888e131199b9a06e66a1ba4f64cfb68383b59def4a8` digest
-before a frozen install and pack build. The probe used the deployed generic
-installation registry and immutable snapshot. Every advertised capability was
-read and asserted from its actual initialize response. Session creation rejected
-the missing bound credential; no model prompt was submitted. The record contains
-no credentials or provider session IDs and records zero paid calls. This refreshed
-probe is an admission check, not an authenticated interaction test. The 128
-targeted backend/environment/control-plane checks, 31 installed-distribution
-checks and 17 patched-package checks remain recorded with the historical
-`58511d79d` proof. The preceding full Runner suite (2,202 passed, 11 skipped) and
-13 native-provider Rust tests remain pinned to source `2e65b64d5`; they are not
-relabeled as checks of the latest source. Current focused validation and the
-separate authenticated attempts are recorded below.
+records source `9f2d0420ed9a398e3bacd1d7e996614f3296ac56`, including the
+merged Grok support, candidate identity and completion-contract fixes. Its manifest
+digest is `sha256:2a6f457205743487cdd35ed3634532028e6e0200001f70e087d0e084fc85d452`.
+Both clean dependency resolutions matched the reviewed Docker lock digest
+`9c163adf40fe1c6a65abda6207bd9f5acfc8196bc94f81348b8bf1b2769e050e`.
+The generic installation registry and immutable snapshot passed initialization
+and rejected the missing bound credential before any model prompt. Current-source
+verification passed the TypeScript and release Runner builds, 97 Vitest checks
+(with one optional installation case skipped), and 22 package/receipt/materializer
+checks using the newly built distribution. An initial package-test invocation
+omitted the isolated package locations; the corrected explicit pack invocation
+passed all 22 checks. These checks do not constitute full repository verification
+or authenticated qualification.
+
+The [a6167ce3a proof](../../packages/paperclip-runner/test-fixtures/pi-acp/offline-provider-pack-proof.darwin-arm64.a6167ce3a.json)
+and [58511d79d proof](../../packages/paperclip-runner/test-fixtures/pi-acp/offline-provider-pack-proof.darwin-arm64.58511d79d.json)
+remain historical observations. The 128 targeted checks, 31 installation checks
+and 17 package checks remain pinned to `58511d79d`; the full Runner suite
+(2,202 passed, 11 skipped) and 13 native-provider Rust tests remain pinned to
+`2e65b64d5`. They are not relabeled as checks of the latest source.

 The [pre-launch-boundary proof](../../packages/paperclip-runner/test-fixtures/pi-acp/offline-provider-pack-proof.2e65b64d5.darwin-arm64.json)
 retains source `2e65b64d5a2148583109b8157d6e72f54f5ad29b` and manifest
@@ -323,7 +321,7 @@ every field in Pi's native event stream. These are explicit follow-ups:
 ## Authenticated local qualification progress

 The [sanitized attempt ledger](../../packages/paperclip-runner/test-fixtures/pi-acp/paid-qualification-progress.darwin-arm64.json)
-retains all seven attempts, including six failures before a model prompt. One Runner protocol turn reached the exact
+retains all eight attempts, including seven failures before a model prompt. One Runner protocol turn reached the exact
 model and successfully called `get_task_context`, `get_task_history`,
 `list_documents`, and `read_document`. The canonical case permits those extra
 orientation reads, but also requires a completed turn; it timed out after 120s
@@ -353,7 +351,11 @@ provider-profile validator still rejected candidates before the host's explicit
 qualification admission boundary. Shared commit `26dde3cfe` corrected that gate. The next attempt created the agent
 and task, then found a dormant Pi-only rejection in the verified runnerd backend
 factory (`transportDriverIdentity`); it again submitted no model prompt and
-incurred zero measured billing delta. That shared identity correction is pending.
+incurred zero measured billing delta. The shared identity correction is included
+in foundation `c3b7e9ecd`. The next attempt passed those guards but stopped at
+`PRP command session.open timed out` after 36.5 seconds of run startup; cleanup
+passed and the measured key billing delta remained zero. It produced no terminal
+usage receipt or matcher success.

 The canonical live-eval completion contract had a separate defect: fresh sessions
 omitted native `paperclip_finish`/`paperclip_block` schemas, their callback rejected
@@ -366,5 +368,18 @@ regression failed before repair; 45 live-session tests and three focused follow-
 checks passed, with source typecheck. This is a confirmed protocol defect, but
 its causal contribution to the earlier model timeout is not proven.

+The [startup diagnostic](../../packages/paperclip-runner/test-fixtures/pi-acp/startup-diagnostic.darwin-arm64.json)
+reproduces that failure without credentials through the deployed Runner transport.
+Its `run.prepare` command completes, while `session.open` remains pending at the
+unchanged 30-second deadline. Separately timing the same 13,827-file, 234 MB
+closure measured 5.168 seconds of verification and 37.423 seconds to construct
+its immutable snapshot, before any Pi process starts. Shared fix `2a30219f1`
+copies at most eight files and 32 MiB per batch, with larger admitted files alone.
+It retains every file identity, digest and confinement check and drains all copy
+promises before cleanup. The same tree then copied in 5.851 seconds; ten security
+and concurrency tests and both Runner TypeScript checks passed. This measurement
+is not yet proof of successful end-to-end startup after the fix; the pack and
+paid attempt above intentionally retain their earlier source identity.
+
 Production admission remains qualification-pending until the live matrix and
 spend receipt checks pass.
@@ -0,0 +1,83 @@
+{
+  "schema": "paperclip.pi-provider-pack-offline-proof.v1",
+  "recordedAt": "2026-09-28T19:35:49.729Z",
+  "classification": "offline_candidate_admission",
+  "source": {
+    "runnerRevision": "a6167ce3a7804c31f4f9990a9ba6761c1d91f27c",
+    "distDigest": "sha256:2d0c65ff3d859717cc27fd03739a5e639171d4c46804a1884b3e1301c865eaa8",
+    "bridgeDigest": "sha256:a81fb87bf2204b0fddac15f952724f691645d3ddbafb93b75b7776f61cbaa5a2",
+    "productionLockDigest": "sha256:e0c928a494f90ddad3c00791e83f09315ee8c82df2a0418a809dcf93649a8ab3",
+    "note": "Built from the recorded source after candidate initialization, CLI canonical-path, usage provenance and canonical reasoning projection fixes. The generic registry launched the immutable snapshot, asserted every capability from its initialize response and verified missing-credential refusal. No prompt was sent by this offline probe."
+  },
+  "environment": {
+    "platform": "darwin",
+    "architecture": "arm64",
+    "nodeVersion": "24.19.0",
+    "execution": "local macOS ARM64; immutable guarded provider snapshot",
+    "packageManager": "pnpm@9.15.4"
+  },
+  "candidate": {
+    "agent": "pi",
+    "qualification": "pending",
+    "agentProfileVersion": 2,
+    "declaredModel": "openrouter/deepseek/deepseek-v4-flash-0731",
+    "reportedModelId": null,
+    "modelVerification": "not_performed_authentication_missing",
+    "wrapperVersion": "0.0.33",
+    "runtimeVersion": "0.84.2",
+    "profileDigest": "sha256:0f687e38cb3c607a01fab80f03e19bbbf5cb53a8afb1fc40d71f9ab54551cff1",
+    "closureDigest": "sha256:b30047dce9c4c25e1fbc88a1aa828690a6a11ebdc3f6fcc083875986eb2d9585",
+    "assetTreeDigest": "sha256:5c046265335d4a6924efcd207f837d5aa0e0fc3baa0bf6ea7059afe8d6ab3939",
+    "distributionManifestDigest": "sha256:406345b3b75d8aee399da886fbdf8566aaaa44ff29fe3462da21f0c29901aecd",
+    "wrapperDigest": "sha256:2eb201c3a931177490a8e18f4a8392f00cbcf21847e9cc171de528da5e253935",
+    "helperDigest": "sha256:4333d284ff06ab1195e49630041f0b03a486a92fc678100525ad107e0982dba1",
+    "extensionDigest": "sha256:0a2ca138d6d87a85498bd982ee64543ea8b14f2ecceded96cfc27b0836cc4254"
+  },
+  "providerPack": {
+    "manifestDigest": "sha256:0ed45bf84d172aa7087baec3d662275206e8121b0ba142aaa9039dcfbf4402a2",
+    "portableNodeDigest": "sha256:27db838bb204ef7c21df2931f5656e4c8fb32e6e947f363a402b49714d32b5b1",
+    "piNodeDigest": "sha256:27db838bb204ef7c21df2931f5656e4c8fb32e6e947f363a402b49714d32b5b1",
+    "acpxSidecarDigest": "sha256:cfdb2b53f8f4500205560cfc33ca12c2b6c4ffaf54e666250c184f655d095d13"
+  },
+  "observed": {
+    "closedSnapshotLaunch": true,
+    "acpInitialize": "passed",
+    "authMethods": [],
+    "capabilities": {
+      "version": 1,
+      "steering": true,
+      "queuedFollowUp": true,
+      "questions": [
+        "select",
+        "confirm",
+        "input",
+        "editor"
+      ],
+      "nativePermissions": true,
+      "promptUsage": true,
+      "nativePlan": false,
+      "pendingRequestRecovery": "live-process-only"
+    },
+    "sessionNew": "rejected_authentication_missing",
+    "expectedError": "Bind the configured OpenRouter API credential to this Paperclip runtime.",
+    "missingCredentialRejected": true,
+    "capabilityProvenance": "Read and asserted in full from this pack launch.",
+    "rpcMethods": [
+      "initialize",
+      "session/new"
+    ]
+  },
+  "usage": {
+    "providerCalls": 0,
+    "promptRequests": 0,
+    "paidProviderCalls": 0,
+    "credentials": "none",
+    "spentUsd": 0
+  },
+  "limitations": [
+    "No provider authentication, model prompt, or reported currentModelId was verified.",
+    "Native tool execution, permissions, questions, and semantic MCP calls were not exercised by this pack-launch probe.",
+    "Linux x64, macOS x64, and Daytona execution were not exercised.",
+    "Production qualification remains pending."
+  ]
+}
@@ -1,13 +1,13 @@
 {
  "schema": "paperclip.pi-provider-pack-offline-proof.v1",
-  "recordedAt": "2026-09-28T19:35:49.729Z",
+  "recordedAt": "2026-09-28T20:02:30.796Z",
  "classification": "offline_candidate_admission",
  "source": {
-    "runnerRevision": "a6167ce3a7804c31f4f9990a9ba6761c1d91f27c",
-    "distDigest": "sha256:2d0c65ff3d859717cc27fd03739a5e639171d4c46804a1884b3e1301c865eaa8",
-    "bridgeDigest": "sha256:a81fb87bf2204b0fddac15f952724f691645d3ddbafb93b75b7776f61cbaa5a2",
+    "runnerRevision": "9f2d0420ed9a398e3bacd1d7e996614f3296ac56",
+    "distDigest": "sha256:3fb488c2a156f8ee1feab94f98985662da393bfeb516a19150638d6b45ec55cd",
+    "bridgeDigest": "sha256:f6c56eac02b7962f100add6c5ce2daeeae4ab2c70aaa39b046b8bb1fc584e175",
    "productionLockDigest": "sha256:e0c928a494f90ddad3c00791e83f09315ee8c82df2a0418a809dcf93649a8ab3",
-    "note": "Built from the recorded source after candidate initialization, CLI canonical-path, usage provenance and canonical reasoning projection fixes. The generic registry launched the immutable snapshot, asserted every capability from its initialize response and verified missing-credential refusal. No prompt was sent by this offline probe."
+    "note": "Built from merged foundation c3b7e9ecd plus the Pi provider branch, including native candidate identity and visible completion-contract fixes. This probe executes the deployed generic registry and immutable snapshot without credentials or prompts. It predates shared copy-performance fix 2a30219f1; the public paid ledger separately retains the startup failure from this source."
  },
  "environment": {
    "platform": "darwin",
@@ -34,10 +34,10 @@
    "extensionDigest": "sha256:0a2ca138d6d87a85498bd982ee64543ea8b14f2ecceded96cfc27b0836cc4254"
  },
  "providerPack": {
-    "manifestDigest": "sha256:0ed45bf84d172aa7087baec3d662275206e8121b0ba142aaa9039dcfbf4402a2",
+    "manifestDigest": "sha256:2a6f457205743487cdd35ed3634532028e6e0200001f70e087d0e084fc85d452",
    "portableNodeDigest": "sha256:27db838bb204ef7c21df2931f5656e4c8fb32e6e947f363a402b49714d32b5b1",
    "piNodeDigest": "sha256:27db838bb204ef7c21df2931f5656e4c8fb32e6e947f363a402b49714d32b5b1",
-    "acpxSidecarDigest": "sha256:cfdb2b53f8f4500205560cfc33ca12c2b6c4ffaf54e666250c184f655d095d13"
+    "acpxSidecarDigest": "sha256:aa71619ea0f5e08d78c13bbca1812038d4ab6fee8550177be210b5afeb26d01a"
  },
  "observed": {
    "closedSnapshotLaunch": true,
@@ -1,6 +1,6 @@
 {
  "schema": "paperclip.pi-paid-qualification-progress.v1",
-  "recordedAt": "2026-09-28T19:45:32.427487+00:00",
+  "recordedAt": "2026-09-28T20:04:32.924765+00:00",
  "qualificationStatus": "pending",
  "environment": {
    "platform": "darwin",
@@ -171,7 +171,7 @@
      "profileDigest": "sha256:0f687e38cb3c607a01fab80f03e19bbbf5cb53a8afb1fc40d71f9ab54551cff1",
      "exitCode": 1,
      "retainedMachineDisposition": "permanent_infrastructure",
-      "diagnosis": "The real server rejected candidate agent creation422 before any provider prompt. Host-only qualification was wired at launch but not the earlier provider-profile resolver. Shared correction pending.",
+      "diagnosis": "The real server rejected candidate agent creation422 before any provider prompt. Host-only qualification was wired at launch but not the earlier provider-profile resolver. Shared correction 26dde3cfe is included in the merged foundation.",
      "submittedProviderTurns": 0,
      "providerRequestCount": 0,
      "billingDeltaUsd": 0,
@@ -211,7 +211,7 @@
        "ref": "refs/heads/codex/runner-pi-acp",
        "workflowRunUrl": null
      },
-      "diagnosis": "Agent creation succeeded after shared admission repair; the actual verified runnerd backend factory then hit a dormant Pi-only transportDriverIdentity rejection before provider launch. Shared identity correction pending.",
+      "diagnosis": "Agent creation succeeded after shared admission repair; the actual verified runnerd backend factory then hit a dormant Pi-only transportDriverIdentity rejection before provider launch. The shared identity correction is included in foundation c3b7e9ecd.",
      "submittedProviderTurns": 0,
      "providerRequestCount": 0,
      "billingDeltaUsd": 0,
@@ -224,6 +224,41 @@
        "outerDeadlineSeconds": 300,
        "configuredActiveTimeoutSeconds": 120
      }
+    },
+    {
+      "attemptId": "pi-product-hello-04",
+      "family": "product-e2e",
+      "caseId": "extended-harnesses.runner-acpx-pi.local.hello-complete",
+      "startedAt": "2026-09-28T20:03:06.338199+00:00",
+      "finishedAt": "2026-09-28T20:04:32.924765+00:00",
+      "durationSeconds": 86.582,
+      "sourceRevision": "9f2d0420ed9a398e3bacd1d7e996614f3296ac56",
+      "providerPackDigest": "sha256:2a6f457205743487cdd35ed3634532028e6e0200001f70e087d0e084fc85d452",
+      "runnerdDigest": "sha256:3fdff11d17faf096fce29b57a8e762e6dd241ef5009771913eb4798d10a0deca",
+      "profileDigest": "sha256:0f687e38cb3c607a01fab80f03e19bbbf5cb53a8afb1fc40d71f9ab54551cff1",
+      "exitCode": 1,
+      "retainedMachineDisposition": "candidate_failure",
+      "retainedStatus": "failed",
+      "cleanup": "passed",
+      "fixtureReportedSource": {
+        "sha": "9f2d0420ed9a398e3bacd1d7e996614f3296ac56",
+        "ref": "refs/heads/codex/runner-pi-acp",
+        "workflowRunUrl": null
+      },
+      "diagnosis": "The earlier candidate and transport identity gates are corrected. PRP run.prepare succeeds, but session.open times out before prompt submission at its unchanged 30-second deadline. A credential-free deployed-pack reproduction and separate stage timing isolate immutable snapshot copying as exceeding that deadline. Shared fix 2a30219f1 reduces measured copy latency; end-to-end admission after that fix is not yet proven.",
+      "submittedProviderTurns": 0,
+      "providerRequestCount": 0,
+      "billingDeltaUsd": 0,
+      "billingCoverage": "exclusive OpenRouter key usage delta, two spaced post-attempt observations",
+      "terminalUsage": null,
+      "retainedCostCoverage": "unavailable",
+      "automaticRetries": 0,
+      "supervision": {
+        "reservationUsd": 2,
+        "billingWatchdogUsd": 0.5,
+        "outerDeadlineSeconds": 300,
+        "configuredActiveTimeoutSeconds": 120
+      }
    }
  ],
  "observedSemanticOperations": {
@@ -260,7 +295,20 @@
      "instructionFollowupFocusedTestsPassed": 3,
      "sourceTypecheck": "passed",
      "boundary": "Advisory native report does not mutate mock state or settle provider turn; stale revision, wrong turn, conflicting report and unauthorized create_task rejected"
-    }
+    },
+    "currentPiSource": {
+      "source": "9f2d0420ed9a398e3bacd1d7e996614f3296ac56",
+      "typescriptBuild": "passed",
+      "releaseRunnerBuild": "passed",
+      "vitestPassed": 97,
+      "vitestSkipped": 1,
+      "installedPackageChecksPassed": 22,
+      "packageCheckInvocation": "The initial command lacked isolated Pi package locations and failed module resolution; all 22 passed after selecting the freshly built pack packages explicitly.",
+      "deployedPackCredentialFreeProbe": "passed",
+      "cleanDependencyResolution": "two independent runs from tracked manifest/config/patch inputs with pnpm9.15.4 --resolution-only --ignore-scripts --no-frozen-lockfile",
+      "cleanDependencyLockSha256": "9c163adf40fe1c6a65abda6207bd9f5acfc8196bc94f81348b8bf1b2769e050e"
+    },
+    "startupDiagnosis": "startup-diagnostic.darwin-arm64.json"
  },
  "publicationBoundary": {
    "hiddenReasoningIncluded": false,
@@ -0,0 +1,70 @@
+{
+  "schema": "paperclip.pi-startup-diagnostic.v1",
+  "recordedAt": "2026-09-28T20:14:44.089567+00:00",
+  "sourceRevision": "9f2d0420ed9a398e3bacd1d7e996614f3296ac56",
+  "providerPackDigest": "sha256:2a6f457205743487cdd35ed3634532028e6e0200001f70e087d0e084fc85d452",
+  "profileDigest": "sha256:0f687e38cb3c607a01fab80f03e19bbbf5cb53a8afb1fc40d71f9ab54551cff1",
+  "runnerdDigest": "sha256:3fdff11d17faf096fce29b57a8e762e6dd241ef5009771913eb4798d10a0deca",
+  "environment": {
+    "platform": "darwin",
+    "architecture": "arm64",
+    "node": "24.19.0"
+  },
+  "credentialFreeReproduction": {
+    "durationMs": 40572,
+    "result": "runner_local_connect_failed: PRP command session.open timed out",
+    "runPrepare": "completed",
+    "sessionOpen": "pending",
+    "providerIdentityReported": false,
+    "credentials": "none",
+    "promptCalls": 0,
+    "providerCalls": 0
+  },
+  "before": {
+    "closedFiles": 13827,
+    "closedBytes": 234019683,
+    "stages": [
+      {
+        "phase": "verifyInstallation",
+        "durationMs": 5168,
+        "elapsedMs": 5168
+      },
+      {
+        "phase": "openImmutableCommand",
+        "durationMs": 37423,
+        "elapsedMs": 42591
+      },
+      {
+        "phase": "closeImmutableCommand",
+        "durationMs": 5978,
+        "elapsedMs": 48568
+      }
+    ],
+    "sessionOpenDeadlineMs": 30000
+  },
+  "repair": {
+    "foundationCommit": "2a30219f194cb094b18b5a19ffc5991b47924088",
+    "moduleSha256": "ad88337545673913a24ed283bf0b53016737cae471ef4822b92cc2930e31398d",
+    "copyMs": 5851,
+    "cleanupMs": 1026,
+    "copyConcurrency": 8,
+    "copyBufferBudgetBytes": 33554432,
+    "oversizedFilePolicy": "one admitted file alone; unchanged384MiB file limit",
+    "focusedTestsPassed": 10,
+    "sourceAndSurfacesTypecheck": "passed",
+    "activeOrStartupTimeoutChanged": false,
+    "retainedGuarantees": [
+      "no-follow and realpath confinement",
+      "held descriptor identity before/after reads",
+      "content digest verification",
+      "root identity checks",
+      "canonical manifest ordering",
+      "all in-flight writes drained before failure cleanup"
+    ]
+  },
+  "limits": [
+    "The post-fix timing measures actual immutable snapshot creation, not a full authenticated Runner session.",
+    "No paid prompt or provider request was issued by either diagnostic.",
+    "Private process identifiers, credentials and raw traces are excluded."
+  ]
+}