diff --git a/doc/architecture/runner-pi-capabilities.md b/doc/architecture/runner-pi-capabilities.md index 80d5652bb89..b96b1014704 100644 --- a/doc/architecture/runner-pi-capabilities.md +++ b/doc/architecture/runner-pi-capabilities.md @@ -2,7 +2,8 @@ Status: implementation candidate, 2026-09-28. Deterministic protocol tests and an uncredentialed admission probe pass. One paid local Runner turn reached semantic -tools but timed out; Product E2E setup exposed a separate candidate-admission gap. +tools but timed out; the latest Product attempt stopped before a prompt because +verified snapshot preparation exceeded the startup deadline. Local and Linux x64 Daytona qualification remain pending; this document does not promote the candidate to a qualified production runtime. @@ -241,29 +242,26 @@ helper discards failed-attempt usage, so any retry or missing compaction receipt invalidates complete-turn token/cost totals instead of inventing complete coverage. The retained [macOS ARM64 provider-pack admission proof](../../packages/paperclip-runner/test-fixtures/pi-acp/offline-provider-pack-proof.darwin-arm64.json) -records source `a6167ce3a7804c31f4f9990a9ba6761c1d91f27c`, after final-spawn -credential-marker preservation and direct candidate-admission gating. It includes -the Node engine, Pi v2 fixture, assigned HTTPS gateway, and failed-turn receipt -repairs. Its manifest digest is -`sha256:0ed45bf84d172aa7087baec3d662275206e8121b0ba142aaa9039dcfbf4402a2`. -This refresh also includes candidate initialization, canonical CLI paths, usage -provenance and reasoning projection repairs; the prior -[58511d79d proof](../../packages/paperclip-runner/test-fixtures/pi-acp/offline-provider-pack-proof.darwin-arm64.58511d79d.json) -remains a historical observation. -The clean tracked-lock resolution matched Docker's reviewed -`650e23d20e967bcfbfced888e131199b9a06e66a1ba4f64cfb68383b59def4a8` digest -before a frozen install and pack build. The probe used the deployed generic -installation registry and immutable snapshot. Every advertised capability was -read and asserted from its actual initialize response. Session creation rejected -the missing bound credential; no model prompt was submitted. The record contains -no credentials or provider session IDs and records zero paid calls. This refreshed -probe is an admission check, not an authenticated interaction test. The 128 -targeted backend/environment/control-plane checks, 31 installed-distribution -checks and 17 patched-package checks remain recorded with the historical -`58511d79d` proof. The preceding full Runner suite (2,202 passed, 11 skipped) and -13 native-provider Rust tests remain pinned to source `2e65b64d5`; they are not -relabeled as checks of the latest source. Current focused validation and the -separate authenticated attempts are recorded below. +records source `9f2d0420ed9a398e3bacd1d7e996614f3296ac56`, including the +merged Grok support, candidate identity and completion-contract fixes. Its manifest +digest is `sha256:2a6f457205743487cdd35ed3634532028e6e0200001f70e087d0e084fc85d452`. +Both clean dependency resolutions matched the reviewed Docker lock digest +`9c163adf40fe1c6a65abda6207bd9f5acfc8196bc94f81348b8bf1b2769e050e`. +The generic installation registry and immutable snapshot passed initialization +and rejected the missing bound credential before any model prompt. Current-source +verification passed the TypeScript and release Runner builds, 97 Vitest checks +(with one optional installation case skipped), and 22 package/receipt/materializer +checks using the newly built distribution. An initial package-test invocation +omitted the isolated package locations; the corrected explicit pack invocation +passed all 22 checks. These checks do not constitute full repository verification +or authenticated qualification. + +The [a6167ce3a proof](../../packages/paperclip-runner/test-fixtures/pi-acp/offline-provider-pack-proof.darwin-arm64.a6167ce3a.json) +and [58511d79d proof](../../packages/paperclip-runner/test-fixtures/pi-acp/offline-provider-pack-proof.darwin-arm64.58511d79d.json) +remain historical observations. The 128 targeted checks, 31 installation checks +and 17 package checks remain pinned to `58511d79d`; the full Runner suite +(2,202 passed, 11 skipped) and 13 native-provider Rust tests remain pinned to +`2e65b64d5`. They are not relabeled as checks of the latest source. The [pre-launch-boundary proof](../../packages/paperclip-runner/test-fixtures/pi-acp/offline-provider-pack-proof.2e65b64d5.darwin-arm64.json) retains source `2e65b64d5a2148583109b8157d6e72f54f5ad29b` and manifest @@ -323,7 +321,7 @@ every field in Pi's native event stream. These are explicit follow-ups: ## Authenticated local qualification progress The [sanitized attempt ledger](../../packages/paperclip-runner/test-fixtures/pi-acp/paid-qualification-progress.darwin-arm64.json) -retains all seven attempts, including six failures before a model prompt. One Runner protocol turn reached the exact +retains all eight attempts, including seven failures before a model prompt. One Runner protocol turn reached the exact model and successfully called `get_task_context`, `get_task_history`, `list_documents`, and `read_document`. The canonical case permits those extra orientation reads, but also requires a completed turn; it timed out after 120s @@ -353,7 +351,11 @@ provider-profile validator still rejected candidates before the host's explicit qualification admission boundary. Shared commit `26dde3cfe` corrected that gate. The next attempt created the agent and task, then found a dormant Pi-only rejection in the verified runnerd backend factory (`transportDriverIdentity`); it again submitted no model prompt and -incurred zero measured billing delta. That shared identity correction is pending. +incurred zero measured billing delta. The shared identity correction is included +in foundation `c3b7e9ecd`. The next attempt passed those guards but stopped at +`PRP command session.open timed out` after 36.5 seconds of run startup; cleanup +passed and the measured key billing delta remained zero. It produced no terminal +usage receipt or matcher success. The canonical live-eval completion contract had a separate defect: fresh sessions omitted native `paperclip_finish`/`paperclip_block` schemas, their callback rejected @@ -366,5 +368,18 @@ regression failed before repair; 45 live-session tests and three focused follow- checks passed, with source typecheck. This is a confirmed protocol defect, but its causal contribution to the earlier model timeout is not proven. +The [startup diagnostic](../../packages/paperclip-runner/test-fixtures/pi-acp/startup-diagnostic.darwin-arm64.json) +reproduces that failure without credentials through the deployed Runner transport. +Its `run.prepare` command completes, while `session.open` remains pending at the +unchanged 30-second deadline. Separately timing the same 13,827-file, 234 MB +closure measured 5.168 seconds of verification and 37.423 seconds to construct +its immutable snapshot, before any Pi process starts. Shared fix `2a30219f1` +copies at most eight files and 32 MiB per batch, with larger admitted files alone. +It retains every file identity, digest and confinement check and drains all copy +promises before cleanup. The same tree then copied in 5.851 seconds; ten security +and concurrency tests and both Runner TypeScript checks passed. This measurement +is not yet proof of successful end-to-end startup after the fix; the pack and +paid attempt above intentionally retain their earlier source identity. + Production admission remains qualification-pending until the live matrix and spend receipt checks pass. diff --git a/packages/paperclip-runner/test-fixtures/pi-acp/offline-provider-pack-proof.darwin-arm64.a6167ce3a.json b/packages/paperclip-runner/test-fixtures/pi-acp/offline-provider-pack-proof.darwin-arm64.a6167ce3a.json new file mode 100644 index 00000000000..b292668a165 --- /dev/null +++ b/packages/paperclip-runner/test-fixtures/pi-acp/offline-provider-pack-proof.darwin-arm64.a6167ce3a.json @@ -0,0 +1,83 @@ +{ + "schema": "paperclip.pi-provider-pack-offline-proof.v1", + "recordedAt": "2026-09-28T19:35:49.729Z", + "classification": "offline_candidate_admission", + "source": { + "runnerRevision": "a6167ce3a7804c31f4f9990a9ba6761c1d91f27c", + "distDigest": "sha256:2d0c65ff3d859717cc27fd03739a5e639171d4c46804a1884b3e1301c865eaa8", + "bridgeDigest": "sha256:a81fb87bf2204b0fddac15f952724f691645d3ddbafb93b75b7776f61cbaa5a2", + "productionLockDigest": "sha256:e0c928a494f90ddad3c00791e83f09315ee8c82df2a0418a809dcf93649a8ab3", + "note": "Built from the recorded source after candidate initialization, CLI canonical-path, usage provenance and canonical reasoning projection fixes. The generic registry launched the immutable snapshot, asserted every capability from its initialize response and verified missing-credential refusal. No prompt was sent by this offline probe." + }, + "environment": { + "platform": "darwin", + "architecture": "arm64", + "nodeVersion": "24.19.0", + "execution": "local macOS ARM64; immutable guarded provider snapshot", + "packageManager": "pnpm@9.15.4" + }, + "candidate": { + "agent": "pi", + "qualification": "pending", + "agentProfileVersion": 2, + "declaredModel": "openrouter/deepseek/deepseek-v4-flash-0731", + "reportedModelId": null, + "modelVerification": "not_performed_authentication_missing", + "wrapperVersion": "0.0.33", + "runtimeVersion": "0.84.2", + "profileDigest": "sha256:0f687e38cb3c607a01fab80f03e19bbbf5cb53a8afb1fc40d71f9ab54551cff1", + "closureDigest": "sha256:b30047dce9c4c25e1fbc88a1aa828690a6a11ebdc3f6fcc083875986eb2d9585", + "assetTreeDigest": "sha256:5c046265335d4a6924efcd207f837d5aa0e0fc3baa0bf6ea7059afe8d6ab3939", + "distributionManifestDigest": "sha256:406345b3b75d8aee399da886fbdf8566aaaa44ff29fe3462da21f0c29901aecd", + "wrapperDigest": "sha256:2eb201c3a931177490a8e18f4a8392f00cbcf21847e9cc171de528da5e253935", + "helperDigest": "sha256:4333d284ff06ab1195e49630041f0b03a486a92fc678100525ad107e0982dba1", + "extensionDigest": "sha256:0a2ca138d6d87a85498bd982ee64543ea8b14f2ecceded96cfc27b0836cc4254" + }, + "providerPack": { + "manifestDigest": "sha256:0ed45bf84d172aa7087baec3d662275206e8121b0ba142aaa9039dcfbf4402a2", + "portableNodeDigest": "sha256:27db838bb204ef7c21df2931f5656e4c8fb32e6e947f363a402b49714d32b5b1", + "piNodeDigest": "sha256:27db838bb204ef7c21df2931f5656e4c8fb32e6e947f363a402b49714d32b5b1", + "acpxSidecarDigest": "sha256:cfdb2b53f8f4500205560cfc33ca12c2b6c4ffaf54e666250c184f655d095d13" + }, + "observed": { + "closedSnapshotLaunch": true, + "acpInitialize": "passed", + "authMethods": [], + "capabilities": { + "version": 1, + "steering": true, + "queuedFollowUp": true, + "questions": [ + "select", + "confirm", + "input", + "editor" + ], + "nativePermissions": true, + "promptUsage": true, + "nativePlan": false, + "pendingRequestRecovery": "live-process-only" + }, + "sessionNew": "rejected_authentication_missing", + "expectedError": "Bind the configured OpenRouter API credential to this Paperclip runtime.", + "missingCredentialRejected": true, + "capabilityProvenance": "Read and asserted in full from this pack launch.", + "rpcMethods": [ + "initialize", + "session/new" + ] + }, + "usage": { + "providerCalls": 0, + "promptRequests": 0, + "paidProviderCalls": 0, + "credentials": "none", + "spentUsd": 0 + }, + "limitations": [ + "No provider authentication, model prompt, or reported currentModelId was verified.", + "Native tool execution, permissions, questions, and semantic MCP calls were not exercised by this pack-launch probe.", + "Linux x64, macOS x64, and Daytona execution were not exercised.", + "Production qualification remains pending." + ] +} diff --git a/packages/paperclip-runner/test-fixtures/pi-acp/offline-provider-pack-proof.darwin-arm64.json b/packages/paperclip-runner/test-fixtures/pi-acp/offline-provider-pack-proof.darwin-arm64.json index b292668a165..a8b6094b036 100644 --- a/packages/paperclip-runner/test-fixtures/pi-acp/offline-provider-pack-proof.darwin-arm64.json +++ b/packages/paperclip-runner/test-fixtures/pi-acp/offline-provider-pack-proof.darwin-arm64.json @@ -1,13 +1,13 @@ { "schema": "paperclip.pi-provider-pack-offline-proof.v1", - "recordedAt": "2026-09-28T19:35:49.729Z", + "recordedAt": "2026-09-28T20:02:30.796Z", "classification": "offline_candidate_admission", "source": { - "runnerRevision": "a6167ce3a7804c31f4f9990a9ba6761c1d91f27c", - "distDigest": "sha256:2d0c65ff3d859717cc27fd03739a5e639171d4c46804a1884b3e1301c865eaa8", - "bridgeDigest": "sha256:a81fb87bf2204b0fddac15f952724f691645d3ddbafb93b75b7776f61cbaa5a2", + "runnerRevision": "9f2d0420ed9a398e3bacd1d7e996614f3296ac56", + "distDigest": "sha256:3fb488c2a156f8ee1feab94f98985662da393bfeb516a19150638d6b45ec55cd", + "bridgeDigest": "sha256:f6c56eac02b7962f100add6c5ce2daeeae4ab2c70aaa39b046b8bb1fc584e175", "productionLockDigest": "sha256:e0c928a494f90ddad3c00791e83f09315ee8c82df2a0418a809dcf93649a8ab3", - "note": "Built from the recorded source after candidate initialization, CLI canonical-path, usage provenance and canonical reasoning projection fixes. The generic registry launched the immutable snapshot, asserted every capability from its initialize response and verified missing-credential refusal. No prompt was sent by this offline probe." + "note": "Built from merged foundation c3b7e9ecd plus the Pi provider branch, including native candidate identity and visible completion-contract fixes. This probe executes the deployed generic registry and immutable snapshot without credentials or prompts. It predates shared copy-performance fix 2a30219f1; the public paid ledger separately retains the startup failure from this source." }, "environment": { "platform": "darwin", @@ -34,10 +34,10 @@ "extensionDigest": "sha256:0a2ca138d6d87a85498bd982ee64543ea8b14f2ecceded96cfc27b0836cc4254" }, "providerPack": { - "manifestDigest": "sha256:0ed45bf84d172aa7087baec3d662275206e8121b0ba142aaa9039dcfbf4402a2", + "manifestDigest": "sha256:2a6f457205743487cdd35ed3634532028e6e0200001f70e087d0e084fc85d452", "portableNodeDigest": "sha256:27db838bb204ef7c21df2931f5656e4c8fb32e6e947f363a402b49714d32b5b1", "piNodeDigest": "sha256:27db838bb204ef7c21df2931f5656e4c8fb32e6e947f363a402b49714d32b5b1", - "acpxSidecarDigest": "sha256:cfdb2b53f8f4500205560cfc33ca12c2b6c4ffaf54e666250c184f655d095d13" + "acpxSidecarDigest": "sha256:aa71619ea0f5e08d78c13bbca1812038d4ab6fee8550177be210b5afeb26d01a" }, "observed": { "closedSnapshotLaunch": true, diff --git a/packages/paperclip-runner/test-fixtures/pi-acp/paid-qualification-progress.darwin-arm64.json b/packages/paperclip-runner/test-fixtures/pi-acp/paid-qualification-progress.darwin-arm64.json index 0349723ae9a..98d54b7de34 100644 --- a/packages/paperclip-runner/test-fixtures/pi-acp/paid-qualification-progress.darwin-arm64.json +++ b/packages/paperclip-runner/test-fixtures/pi-acp/paid-qualification-progress.darwin-arm64.json @@ -1,6 +1,6 @@ { "schema": "paperclip.pi-paid-qualification-progress.v1", - "recordedAt": "2026-09-28T19:45:32.427487+00:00", + "recordedAt": "2026-09-28T20:04:32.924765+00:00", "qualificationStatus": "pending", "environment": { "platform": "darwin", @@ -171,7 +171,7 @@ "profileDigest": "sha256:0f687e38cb3c607a01fab80f03e19bbbf5cb53a8afb1fc40d71f9ab54551cff1", "exitCode": 1, "retainedMachineDisposition": "permanent_infrastructure", - "diagnosis": "The real server rejected candidate agent creation422 before any provider prompt. Host-only qualification was wired at launch but not the earlier provider-profile resolver. Shared correction pending.", + "diagnosis": "The real server rejected candidate agent creation422 before any provider prompt. Host-only qualification was wired at launch but not the earlier provider-profile resolver. Shared correction 26dde3cfe is included in the merged foundation.", "submittedProviderTurns": 0, "providerRequestCount": 0, "billingDeltaUsd": 0, @@ -211,7 +211,7 @@ "ref": "refs/heads/codex/runner-pi-acp", "workflowRunUrl": null }, - "diagnosis": "Agent creation succeeded after shared admission repair; the actual verified runnerd backend factory then hit a dormant Pi-only transportDriverIdentity rejection before provider launch. Shared identity correction pending.", + "diagnosis": "Agent creation succeeded after shared admission repair; the actual verified runnerd backend factory then hit a dormant Pi-only transportDriverIdentity rejection before provider launch. The shared identity correction is included in foundation c3b7e9ecd.", "submittedProviderTurns": 0, "providerRequestCount": 0, "billingDeltaUsd": 0, @@ -224,6 +224,41 @@ "outerDeadlineSeconds": 300, "configuredActiveTimeoutSeconds": 120 } + }, + { + "attemptId": "pi-product-hello-04", + "family": "product-e2e", + "caseId": "extended-harnesses.runner-acpx-pi.local.hello-complete", + "startedAt": "2026-09-28T20:03:06.338199+00:00", + "finishedAt": "2026-09-28T20:04:32.924765+00:00", + "durationSeconds": 86.582, + "sourceRevision": "9f2d0420ed9a398e3bacd1d7e996614f3296ac56", + "providerPackDigest": "sha256:2a6f457205743487cdd35ed3634532028e6e0200001f70e087d0e084fc85d452", + "runnerdDigest": "sha256:3fdff11d17faf096fce29b57a8e762e6dd241ef5009771913eb4798d10a0deca", + "profileDigest": "sha256:0f687e38cb3c607a01fab80f03e19bbbf5cb53a8afb1fc40d71f9ab54551cff1", + "exitCode": 1, + "retainedMachineDisposition": "candidate_failure", + "retainedStatus": "failed", + "cleanup": "passed", + "fixtureReportedSource": { + "sha": "9f2d0420ed9a398e3bacd1d7e996614f3296ac56", + "ref": "refs/heads/codex/runner-pi-acp", + "workflowRunUrl": null + }, + "diagnosis": "The earlier candidate and transport identity gates are corrected. PRP run.prepare succeeds, but session.open times out before prompt submission at its unchanged 30-second deadline. A credential-free deployed-pack reproduction and separate stage timing isolate immutable snapshot copying as exceeding that deadline. Shared fix 2a30219f1 reduces measured copy latency; end-to-end admission after that fix is not yet proven.", + "submittedProviderTurns": 0, + "providerRequestCount": 0, + "billingDeltaUsd": 0, + "billingCoverage": "exclusive OpenRouter key usage delta, two spaced post-attempt observations", + "terminalUsage": null, + "retainedCostCoverage": "unavailable", + "automaticRetries": 0, + "supervision": { + "reservationUsd": 2, + "billingWatchdogUsd": 0.5, + "outerDeadlineSeconds": 300, + "configuredActiveTimeoutSeconds": 120 + } } ], "observedSemanticOperations": { @@ -260,7 +295,20 @@ "instructionFollowupFocusedTestsPassed": 3, "sourceTypecheck": "passed", "boundary": "Advisory native report does not mutate mock state or settle provider turn; stale revision, wrong turn, conflicting report and unauthorized create_task rejected" - } + }, + "currentPiSource": { + "source": "9f2d0420ed9a398e3bacd1d7e996614f3296ac56", + "typescriptBuild": "passed", + "releaseRunnerBuild": "passed", + "vitestPassed": 97, + "vitestSkipped": 1, + "installedPackageChecksPassed": 22, + "packageCheckInvocation": "The initial command lacked isolated Pi package locations and failed module resolution; all 22 passed after selecting the freshly built pack packages explicitly.", + "deployedPackCredentialFreeProbe": "passed", + "cleanDependencyResolution": "two independent runs from tracked manifest/config/patch inputs with pnpm9.15.4 --resolution-only --ignore-scripts --no-frozen-lockfile", + "cleanDependencyLockSha256": "9c163adf40fe1c6a65abda6207bd9f5acfc8196bc94f81348b8bf1b2769e050e" + }, + "startupDiagnosis": "startup-diagnostic.darwin-arm64.json" }, "publicationBoundary": { "hiddenReasoningIncluded": false, diff --git a/packages/paperclip-runner/test-fixtures/pi-acp/startup-diagnostic.darwin-arm64.json b/packages/paperclip-runner/test-fixtures/pi-acp/startup-diagnostic.darwin-arm64.json new file mode 100644 index 00000000000..0bbfbb2a5e6 --- /dev/null +++ b/packages/paperclip-runner/test-fixtures/pi-acp/startup-diagnostic.darwin-arm64.json @@ -0,0 +1,70 @@ +{ + "schema": "paperclip.pi-startup-diagnostic.v1", + "recordedAt": "2026-09-28T20:14:44.089567+00:00", + "sourceRevision": "9f2d0420ed9a398e3bacd1d7e996614f3296ac56", + "providerPackDigest": "sha256:2a6f457205743487cdd35ed3634532028e6e0200001f70e087d0e084fc85d452", + "profileDigest": "sha256:0f687e38cb3c607a01fab80f03e19bbbf5cb53a8afb1fc40d71f9ab54551cff1", + "runnerdDigest": "sha256:3fdff11d17faf096fce29b57a8e762e6dd241ef5009771913eb4798d10a0deca", + "environment": { + "platform": "darwin", + "architecture": "arm64", + "node": "24.19.0" + }, + "credentialFreeReproduction": { + "durationMs": 40572, + "result": "runner_local_connect_failed: PRP command session.open timed out", + "runPrepare": "completed", + "sessionOpen": "pending", + "providerIdentityReported": false, + "credentials": "none", + "promptCalls": 0, + "providerCalls": 0 + }, + "before": { + "closedFiles": 13827, + "closedBytes": 234019683, + "stages": [ + { + "phase": "verifyInstallation", + "durationMs": 5168, + "elapsedMs": 5168 + }, + { + "phase": "openImmutableCommand", + "durationMs": 37423, + "elapsedMs": 42591 + }, + { + "phase": "closeImmutableCommand", + "durationMs": 5978, + "elapsedMs": 48568 + } + ], + "sessionOpenDeadlineMs": 30000 + }, + "repair": { + "foundationCommit": "2a30219f194cb094b18b5a19ffc5991b47924088", + "moduleSha256": "ad88337545673913a24ed283bf0b53016737cae471ef4822b92cc2930e31398d", + "copyMs": 5851, + "cleanupMs": 1026, + "copyConcurrency": 8, + "copyBufferBudgetBytes": 33554432, + "oversizedFilePolicy": "one admitted file alone; unchanged384MiB file limit", + "focusedTestsPassed": 10, + "sourceAndSurfacesTypecheck": "passed", + "activeOrStartupTimeoutChanged": false, + "retainedGuarantees": [ + "no-follow and realpath confinement", + "held descriptor identity before/after reads", + "content digest verification", + "root identity checks", + "canonical manifest ordering", + "all in-flight writes drained before failure cleanup" + ] + }, + "limits": [ + "The post-fix timing measures actual immutable snapshot creation, not a full authenticated Runner session.", + "No paid prompt or provider request was issued by either diagnostic.", + "Private process identifiers, credentials and raw traces are excluded." + ] +}