From ddeee41ee659f695dc1f036aeec27059a320aa92 Mon Sep 17 00:00:00 2001 From: Dotta Date: Mon, 28 Sep 2026 17:42:05 -0500 Subject: [PATCH] docs(runner): retain Pi v5 security and paid control proofs Co-Authored-By: Paperclip --- doc/architecture/runner-pi-capabilities.md | 51 +++- ...native-controls-proof.v5.darwin-arm64.json | 122 ++++++++ ...e-provider-pack-proof.v5.darwin-arm64.json | 283 ++++++++++++++++++ ...d-qualification-progress.darwin-arm64.json | 53 +++- .../pi-acp/security-closure-proof.v5.json | 173 +++++++++++ 5 files changed, 672 insertions(+), 10 deletions(-) create mode 100644 packages/paperclip-runner/test-fixtures/pi-acp/native-controls-proof.v5.darwin-arm64.json create mode 100644 packages/paperclip-runner/test-fixtures/pi-acp/offline-provider-pack-proof.v5.darwin-arm64.json create mode 100644 packages/paperclip-runner/test-fixtures/pi-acp/security-closure-proof.v5.json diff --git a/doc/architecture/runner-pi-capabilities.md b/doc/architecture/runner-pi-capabilities.md index f73d0d85937..ba88f49cabb 100644 --- a/doc/architecture/runner-pi-capabilities.md +++ b/doc/architecture/runner-pi-capabilities.md @@ -2,7 +2,7 @@ Status: implementation candidate, 2026-09-28. Profile version 5 repairs the Undici dependency and bundled Node runtime affected by GHSA-3wwx-pv8p-q78v. -Authenticated v5 qualification is pending. Historical version 4 repairs native +Full authenticated v5 qualification is pending; its bounded native controls probe passes. Historical version 4 repairs native tool ID reuse across model iterations and warm prompts; its native steering, queued follow-up and denied-write probe passes. Historical version 3 passes cover local Product file delivery, typed question continuation and native steering, queued follow-up and @@ -156,6 +156,29 @@ part of its verified package and must never be omitted from a copy or hash. ## Verification and maintenance +The [v5 offline pack proof](../../packages/paperclip-runner/test-fixtures/pi-acp/offline-provider-pack-proof.v5.darwin-arm64.json) +binds runtime source `aec26ad83f1d082f0d0a5eaffbd615a9e2e26155`, combined macOS +pack `sha256:cf7d0998bbc2bed7b893c726c2b6455ba8a683d9cff7d92afedbff2d5900d500`, +and immutable daemon `sha256:fe03a5f5e7b7d51aafb398aa435e4a200ca6e0206c46b84ba0baa15aa0be5f31`. +Recursive workspace typecheck and full build pass. Focused checks pass 43 +TypeScript tests including actual installation launch, 19 installed-wrapper/native +SDK tests, eight materializer tests and 13 Rust backend tests. Independent review +recomputed the v5 digest and verified all 13,827 installed files. The +[security closure proof](../../packages/paperclip-runner/test-fixtures/pi-acp/security-closure-proof.v5.json) +retains npm's vulnerable pre-replacement result, the fixed installed version, +unchanged upstream metadata, target pins and exact runtime file changes. + +Both Pi's private interpreter and the separately manifest-bound outer macOS pack +interpreter are official Node 24.21.0 with bundled Undici 7.29.1. Sibling provider +closure/profile declarations are unchanged. The actual Pi registry initializes +ACP1 under a network-denying sandbox, exits EOF0 and releases its process group. +Full Runner startup with no credential rejects in 8.558 seconds, below the +unchanged 30-second deadline; this is a typed admission failure, not authenticated +success. Linux packaging uses the later Docker-only source `94ef513f8`; its +runtime source trees remain identical to `aec26ad83`. Linux execution is recorded +separately. The two clean lock resolutions match `9eea6018…`; tracked lock bytes +remain unchanged. + The [v4 offline proof](../../packages/paperclip-runner/test-fixtures/pi-acp/offline-provider-pack-proof.v4.darwin-arm64.json) binds frozen source `f556110d588a9de9fefe676a9a62bf09e98afb85`, combined pack `sha256:4df7e9fa164929c7ae7d8e8711f0bf7d587d9fa6a246d0a8340f318f57168855`, @@ -432,6 +455,22 @@ every field in Pi's native event stream. These are explicit follow-ups: ## Authenticated local qualification progress +The [v5 native controls proof](../../packages/paperclip-runner/test-fixtures/pi-acp/native-controls-proof.v5.darwin-arm64.json) +passes the unchanged probe on frozen `aec26ad83` / pack `cf7d0998…` in 19.199 seconds. +The original write invocation `pi-849b369266c920633abffa988509e4ba61fcdf464f62c73900fd5ddd6d477402` +correlates with the denied failed-tool update. The decision is fsynced before either control request; both control +acknowledgements precede sending the original denial response. Visible output is exactly +`STEERED_CURRENTQUEUED_NEXT`, stale steering rejects, the forbidden file remains +absent, and the turn settles `end_turn`. Child, verified lease and temporary +workspace cleanup complete; an independent process check finds no remaining +probe or Pi process. No database is started. Actual usage is 3,727 input, 140 +output and 1,792 cached-read tokens. Delayed exclusive-key billing settles at +$0.000151739; the separate Pi catalog estimate is $0.000611156. Initial unchanged +reads are retained, not interpreted as free inference. This proves direct native +controls and denial on the patched profile; it does not qualify Product recovery +or remote execution. + + The [v4 native controls proof](../../packages/paperclip-runner/test-fixtures/pi-acp/native-controls-proof.v4.darwin-arm64.json) passes on frozen `f556110d5` / pack `4df7e9fa…`: one native write request uses the same normalized invocation ID in its persisted decision and failed tool update; @@ -445,9 +484,9 @@ unchanged billing reads are retained and were not treated as free inference. A newly indexed [Undici advisory](https://github.com/advisories/GHSA-3wwx-pv8p-q78v) affects the historical v4 isolated npm Undici 8.9.0 and Node 24.19.0's bundled -Undici 7.29.0. Profile v5 fixes both copies as described above. Further paid work -remains held until fresh pack proofs and a new bounded authorization. This paid -v4 proof remains bound to its original bytes. +Undici 7.29.0. Profile v5 fixes both copies as described above. The separately authorized v5 +control proof uses that repaired closure; no further paid case is authorized. +This paid v4 proof remains bound to its original bytes. The first [v4 plan attempt](../../packages/paperclip-runner/test-fixtures/pi-acp/product-plan-infrastructure-failure.v4.darwin-arm64.json) failed before provider startup: embedded PostgreSQL could not initialize the @@ -465,14 +504,14 @@ qualification is held until a supported database resource path is available. The [sanitized attempt ledger](../../packages/paperclip-runner/test-fixtures/pi-acp/paid-qualification-progress.darwin-arm64.json) -retains all nineteen attempts, including eight failures before a model prompt. One +retains all twenty attempts, including eight failures before a model prompt. One Runner protocol turn reached the exact model and successfully called `get_task_context`, `get_task_history`, `list_documents`, and `read_document`. The canonical case permits those extra orientation reads, but also requires a completed turn; it timed out after 120s without terminal usage. The later Product hello journey passes; the canonical Runner protocol case has not yet passed. -Exclusive OpenRouter key billing increased by **$0.028706633**, including +Exclusive OpenRouter key billing increased by **$0.028858372**, including $0.000351509 from the sleep-interrupted Product attempt and $0.000654767 from the successful hello journey, plus $0.010995043 across the restrictive-denial and file-edit batch. A delayed charge crossed the latter attempt baselines, so diff --git a/packages/paperclip-runner/test-fixtures/pi-acp/native-controls-proof.v5.darwin-arm64.json b/packages/paperclip-runner/test-fixtures/pi-acp/native-controls-proof.v5.darwin-arm64.json new file mode 100644 index 00000000000..c302868de63 --- /dev/null +++ b/packages/paperclip-runner/test-fixtures/pi-acp/native-controls-proof.v5.darwin-arm64.json @@ -0,0 +1,122 @@ +{ + "schema": "paperclip.pi-native-controls-proof.v1", + "sourceRevision": "aec26ad83f1d082f0d0a5eaffbd615a9e2e26155", + "providerPackDigest": "sha256:cf7d0998bbc2bed7b893c726c2b6455ba8a683d9cff7d92afedbff2d5900d500", + "profileDigest": "sha256:020d96ccbd3c45c3f62680814776394ed5a56d9572a1a4dccda56a74d16c7803", + "actualSelectedModel": "openrouter/deepseek/deepseek-v4-flash-0731", + "modelPromptRequests": 1, + "visibleText": "STEERED_CURRENTQUEUED_NEXT", + "staleSteerRejected": true, + "permissionRequests": 1, + "settlement": { + "stopReason": "end_turn", + "usage": { + "inputTokens": 3727, + "outputTokens": 140, + "cachedReadTokens": 1792, + "cachedWriteTokens": 0, + "totalTokens": 5659, + "_meta": { + "paperclipPi": { + "provenance": "assistant_message_receipts", + "costUsd": 0.0006111560000000002, + "costSource": "pi_pricing_estimate" + } + } + }, + "metadata": null + }, + "oracle": { + "markerExistedBefore": false, + "markerExistsAfter": false, + "method": "independent filesystem stat before cleanup" + }, + "limits": [ + "Direct ACP active steering, queued native follow-up and owned extension denial; durable PRP restart replay is not exercised.", + "Pipe write acknowledgement is followed by the matching failed tool update and settled prompt." + ], + "attemptId": "pi-native-controls-03", + "profileVersion": 5, + "qualificationStatus": "pending", + "environment": { + "platform": "darwin", + "architecture": "arm64", + "execution": "direct-native-acp" + }, + "controls": [ + { + "method": "pi/steer", + "kind": "steer", + "accepted": true, + "activePromptPending": true, + "ackBeforePermissionResponse": true, + "activeSessionIdentityMatched": true + }, + { + "method": "pi/follow_up", + "kind": "follow_up", + "accepted": true, + "activePromptPending": true, + "ackBeforePermissionResponse": true, + "activeSessionIdentityMatched": true + } + ], + "decision": { + "count": 1, + "normalizedInvocationId": "pi-849b369266c920633abffa988509e4ba61fcdf464f62c73900fd5ddd6d477402", + "toolTitle": "Pi write", + "originalOfferedOptionIds": [ + "allow_once", + "allow_always", + "reject_once" + ], + "selectedOriginalOptionId": "reject_once", + "persistedAndFsyncedBeforeResponse": true, + "pipeWriteAcknowledged": true, + "matchingFailedToolUpdate": true, + "rawRequestAndSessionIdsRetainedPrivately": true + }, + "result": { + "durationSeconds": 19.199, + "exitCode": 0, + "stopReason": null, + "status": "passed" + }, + "cost": { + "catalogEstimateUsd": 0.0006111560000000002, + "costSource": "pi_pricing_estimate", + "providerReportedUsd": null, + "observedKeyDeltaUsd": 0.000151739, + "earlyObservedKeyDeltaUsd": 0, + "cumulativeObservedExclusiveKeyDeltaUsd": 0.028858372, + "billingReconciliation": "Later exclusive-key observation resolves initial unchanged reads; no intervening provider activity." + }, + "supervision": { + "model": "openrouter/deepseek/deepseek-v4-flash-0731", + "source": "aec26ad83f1d082f0d0a5eaffbd615a9e2e26155", + "packDigest": "sha256:cf7d0998bbc2bed7b893c726c2b6455ba8a683d9cff7d92afedbff2d5900d500", + "reservationUsd": 2, + "billingWatchdogUsd": 0.5, + "activeDeadlineSeconds": 120, + "outerDeadlineSeconds": 300, + "deadlineClocks": [ + "wall", + "monotonic" + ], + "sleepAssertion": "caffeinate -i", + "automaticRetries": 0, + "providerPromptMaximum": 1 + }, + "cleanup": { + "probeFinallyCompleted": true, + "childCloseAndVerifiedCommandLeaseCloseAwaited": true, + "temporaryWorkspaceRemovalAwaited": true, + "matchingLiveProbeOrPiProcesses": 0, + "databaseStarted": false + }, + "publication": { + "hiddenReasoningIncluded": false, + "credentialsIncluded": false, + "providerSessionIdsIncluded": false + } +} diff --git a/packages/paperclip-runner/test-fixtures/pi-acp/offline-provider-pack-proof.v5.darwin-arm64.json b/packages/paperclip-runner/test-fixtures/pi-acp/offline-provider-pack-proof.v5.darwin-arm64.json new file mode 100644 index 00000000000..09aeba44266 --- /dev/null +++ b/packages/paperclip-runner/test-fixtures/pi-acp/offline-provider-pack-proof.v5.darwin-arm64.json @@ -0,0 +1,283 @@ +{ + "schema": "paperclip.pi-v5-offline-qualification/v1", + "sourceRevision": "aec26ad83f1d082f0d0a5eaffbd615a9e2e26155", + "profileVersion": 5, + "model": "openrouter/deepseek/deepseek-v4-flash-0731", + "qualification": "pending", + "paidCalls": 0, + "credentials": false, + "sourceTrees": { + "packages/paperclip-runner/src": "08da7f645ec75be82e525da2d0cae46b329b734f", + "packages/paperclip-runner/scripts": "5413d7ec0e8306efa29c43c063c642e7984c13ce", + "packages/paperclip-runner/runner": "b9b519d1766df8af629a2eacb91d51ee6a1f92c2", + "patches": "5d9ae2a6546e13f780269e4fdbf03efa99fbafe4", + "server/src": "1a4c4b7000becae6021d74e7dc0f2f36180c767c", + "tests/runner-e2e": "6d15ec5668fda2eed3bd308e11e0fda0cf48ca19" + }, + "verification": { + "recursiveTypecheck": "passed", + "fullRepositoryBuild": "passed", + "typescriptIncludingActualInstallation": 43, + "installedWrapperAndNativeSdk": 19, + "materializer": 8, + "nativeBackendRustTestsPassed": 13, + "independentCodeReview": "no blocking findings", + "cleanDependencyResolutions": 2, + "resolvedLockSha256": "9eea60187c6c808efb4d936a234a8d8000beac45253091abd4c5348132bd1408", + "trackedLockUnchanged": true + }, + "pack": { + "sourceRevision": "aec26ad83f1d082f0d0a5eaffbd615a9e2e26155", + "packDigest": "sha256:cf7d0998bbc2bed7b893c726c2b6455ba8a683d9cff7d92afedbff2d5900d500", + "manifestFileSha256": "6fe0fae6057a1d4503e0b0901bce330b403b64f7610a27695ff289f0f2181c58", + "target": { + "platform": "darwin", + "architecture": "arm64" + }, + "productionLock": "sha256:9eea60187c6c808efb4d936a234a8d8000beac45253091abd4c5348132bd1408", + "distDigest": "sha256:2fc9b100eb4b3a8dde6d51cdcf3741815dde783579fe35c7d04e59833440ffff", + "verifiedProviders": { + "cursor": { + "version": "2026.09.26-dd393fe", + "profileDigest": "sha256:1157a5d071abbd57ab132f22bace75c65e84cc47a045b0023475488755e14899", + "closureDigest": "sha256:77394184a89b0e7384971181da19c3c82d83a399b04e7944b3f94fe3d7e62b25", + "qualification": "pending", + "path": "provider-assets/cursor/darwin-arm64", + "sha256": "sha256:3b6de19114d4df62f648604025a0d71937dfa7c2b15b397cce5da2c5da268994", + "verifiedFileCount": 446 + }, + "copilot": { + "version": "1.0.88", + "profileDigest": "sha256:b18c01603dd0169d233140709cfaa8bf5304a03cf5de78ca4f625f30013e8457", + "closureDigest": "sha256:fb3b367a45cd76122fe931521fa2a18adf234ba944fc302db9e10e005e57037e", + "qualification": "pending", + "path": "provider-assets/copilot/darwin-arm64", + "sha256": "sha256:49ad871973843e2bfc3ee1d1886f6a1537e887748cc6f3d5148b3ec7f3c7298f", + "verifiedFileCount": 1 + }, + "pi": { + "version": "0.84.2", + "profileDigest": "sha256:020d96ccbd3c45c3f62680814776394ed5a56d9572a1a4dccda56a74d16c7803", + "closureDigest": "sha256:0010175e4bc200f145386e59f7a824cf7532ad273e9db6824d22c4f82cdcd6ff", + "qualification": "pending", + "path": "provider-assets/pi/darwin-arm64", + "sha256": "sha256:a679a009c1fe370fed020acad1c642848a278278306885edd9c47de897cfe566", + "verifiedFileCount": 13827 + } + }, + "providerInferenceCalls": 0, + "providerProcessesStarted": 0 + }, + "outerNode": { + "version": "24.21.0", + "bundledUndici": "7.29.1", + "sha256": "e4b5a3af0e05c75de2eae013904145f40fe7fc2a6e6f17510128bf45cca4e79b", + "relocatedPackInterpreterExecuted": true + }, + "nativeLaunch": { + "schema": "paperclip.combined-provider-offline-smoke/v1", + "provider": "pi", + "target": { + "platform": "darwin", + "architecture": "arm64" + }, + "sourceRevision": "aec26ad83f1d082f0d0a5eaffbd615a9e2e26155", + "providerPackDigest": "sha256:cf7d0998bbc2bed7b893c726c2b6455ba8a683d9cff7d92afedbff2d5900d500", + "candidate": { + "version": "0.84.2", + "profileDigest": "sha256:020d96ccbd3c45c3f62680814776394ed5a56d9572a1a4dccda56a74d16c7803", + "closureDigest": "sha256:0010175e4bc200f145386e59f7a824cf7532ad273e9db6824d22c4f82cdcd6ff", + "qualification": "pending", + "path": "provider-assets/pi/darwin-arm64", + "sha256": "sha256:a679a009c1fe370fed020acad1c642848a278278306885edd9c47de897cfe566" + }, + "commandDigest": "sha256:020d96ccbd3c45c3f62680814776394ed5a56d9572a1a4dccda56a74d16c7803", + "registryLaunch": "verifyAcpxProfileInstallation/openCommand/spawn", + "initializeRequestId": 0, + "protocolVersion": 1, + "nativeInfo": { + "name": "pi-acp", + "title": "pi ACP adapter", + "version": "0.0.33" + }, + "agentCapabilities": { + "loadSession": true, + "mcpCapabilities": { + "http": true, + "sse": false + }, + "_meta": { + "paperclipPi": { + "version": 1, + "steering": true, + "queuedFollowUp": true, + "questions": [ + "select", + "confirm", + "input", + "editor" + ], + "nativePermissions": true, + "promptUsage": true, + "nativePlan": false, + "pendingRequestRecovery": "live-process-only" + } + }, + "promptCapabilities": { + "image": true, + "audio": false, + "embeddedContext": false + }, + "sessionCapabilities": { + "list": {} + } + }, + "exitCode": 0, + "eofSettled": true, + "prompts": 0, + "inferenceCalls": 0, + "network": "macOS sandbox-exec deny network*", + "credentials": false, + "explicitModelOnlyForProfileAdmission": "openrouter/deepseek/deepseek-v4-flash-0731", + "modelSelected": false, + "providerGroupCleanup": true, + "privateStateRemoved": true + }, + "runnerBinary": { + "source": "aec26ad83f1d082f0d0a5eaffbd615a9e2e26155", + "rustTree": "b9b519d1766df8af629a2eacb91d51ee6a1f92c2", + "sha256": "fe03a5f5e7b7d51aafb398aa435e4a200ca6e0206c46b84ba0baa15aa0be5f31", + "profileVersion": 5, + "profileDigest": "sha256:020d96ccbd3c45c3f62680814776394ed5a56d9572a1a4dccda56a74d16c7803", + "model": "openrouter/deepseek/deepseek-v4-flash-0731", + "mode": "0555", + "build": "pnpm build (release runnerd)" + }, + "fullRunnerStartup": { + "credentials": false, + "promptCalls": 0, + "durationMs": 8558, + "result": "typed_rejection", + "code": "command_execution_failed", + "classification": "session_ensure_failed", + "unchangedDeadlineMs": 30000, + "interpretation": "Credential-free admission rejection; not authenticated session success." + }, + "securityProof": "security-closure-proof.v5.json", + "limits": [ + "macOS ARM64 credential-free launch only; no authenticated v5 qualification in this artifact.", + "x64 Node archives and closure identities are pinned; target execution is not demonstrated by this artifact.", + "Historical v1-v4 evidence remains bound to its own source and bytes." + ], + "independentCombinedRegistryStartup": { + "schema": "paperclip.combined-provider-probe-index/v2", + "sourceRevision": "aec26ad83f1d082f0d0a5eaffbd615a9e2e26155", + "providerPackDigest": "sha256:cf7d0998bbc2bed7b893c726c2b6455ba8a683d9cff7d92afedbff2d5900d500", + "platform": { + "platform": "darwin", + "architecture": "arm64" + }, + "outerInterpreter": { + "version": "24.21.0", + "bundledUndici": "7.29.1", + "sha256": "sha256:e4b5a3af0e05c75de2eae013904145f40fe7fc2a6e6f17510128bf45cca4e79b" + }, + "proofs": { + "cursor": { + "sha256": "39d5e570970f476dd861f26d616383a5fb8751e90644e8f902f316d530df4b8b", + "registryLaunch": "verifyAcpxProfileInstallation/openCommand/spawn", + "candidate": { + "version": "2026.09.26-dd393fe", + "profileDigest": "sha256:1157a5d071abbd57ab132f22bace75c65e84cc47a045b0023475488755e14899", + "closureDigest": "sha256:77394184a89b0e7384971181da19c3c82d83a399b04e7944b3f94fe3d7e62b25", + "qualification": "pending", + "path": "provider-assets/cursor/darwin-arm64", + "sha256": "sha256:3b6de19114d4df62f648604025a0d71937dfa7c2b15b397cce5da2c5da268994" + }, + "initialized": true, + "protocolVersion": 1, + "nativeInfo": null, + "eofExit": { + "exitCode": null, + "cleanExit": false + }, + "explicitCleanupRequired": true, + "leaseCleanupPassed": true, + "privateStateRemoved": true, + "supervisorExitCode": 0, + "networkPolicy": "deny network", + "fixtureRequests": [], + "durationSeconds": 7.233 + }, + "copilot": { + "sha256": "44cdc7243d93f7bf0a78cb955d15c145f7b0cbf482664f4a03ebd887d2d7ea5f", + "registryLaunch": "verifyAcpxProfileInstallation/openCommand/spawn", + "candidate": { + "version": "1.0.88", + "profileDigest": "sha256:b18c01603dd0169d233140709cfaa8bf5304a03cf5de78ca4f625f30013e8457", + "closureDigest": "sha256:fb3b367a45cd76122fe931521fa2a18adf234ba944fc302db9e10e005e57037e", + "qualification": "pending", + "path": "provider-assets/copilot/darwin-arm64", + "sha256": "sha256:49ad871973843e2bfc3ee1d1886f6a1537e887748cc6f3d5148b3ec7f3c7298f" + }, + "initialized": true, + "protocolVersion": 1, + "nativeInfo": { + "name": "Copilot", + "title": "Copilot", + "version": "1.0.88" + }, + "eofExit": { + "exitCode": 0, + "cleanExit": true + }, + "explicitCleanupRequired": false, + "leaseCleanupPassed": true, + "privateStateRemoved": true, + "supervisorExitCode": 0, + "networkPolicy": "deny network except loopback", + "fixtureRequests": [], + "durationSeconds": 2.872 + }, + "pi": { + "sha256": "1c4395d673fc4ba789cf90b570ae4f8e9431fe5676eae3fcad9c6347aa971d84", + "registryLaunch": "verifyAcpxProfileInstallation/openCommand/spawn", + "candidate": { + "version": "0.84.2", + "profileDigest": "sha256:020d96ccbd3c45c3f62680814776394ed5a56d9572a1a4dccda56a74d16c7803", + "closureDigest": "sha256:0010175e4bc200f145386e59f7a824cf7532ad273e9db6824d22c4f82cdcd6ff", + "qualification": "pending", + "path": "provider-assets/pi/darwin-arm64", + "sha256": "sha256:a679a009c1fe370fed020acad1c642848a278278306885edd9c47de897cfe566" + }, + "initialized": true, + "protocolVersion": 1, + "nativeInfo": { + "name": "pi-acp", + "title": "pi ACP adapter", + "version": "0.0.33" + }, + "eofExit": { + "exitCode": 0, + "cleanExit": true + }, + "explicitCleanupRequired": false, + "leaseCleanupPassed": true, + "privateStateRemoved": true, + "supervisorExitCode": 0, + "networkPolicy": "deny network", + "fixtureRequests": [], + "durationSeconds": 11.046 + } + }, + "credentialsProvided": false, + "promptsSent": 0, + "providerInferenceCalls": 0, + "remainingProbeSupervisors": 0, + "qualification": "pending; credential-free initialization only; no model/paid/Daytona qualification", + "unchangedSiblingProviderIdentities": [ + "cursor", + "copilot" + ] + } +} diff --git a/packages/paperclip-runner/test-fixtures/pi-acp/paid-qualification-progress.darwin-arm64.json b/packages/paperclip-runner/test-fixtures/pi-acp/paid-qualification-progress.darwin-arm64.json index 617fd983c78..2cfffbbef78 100644 --- a/packages/paperclip-runner/test-fixtures/pi-acp/paid-qualification-progress.darwin-arm64.json +++ b/packages/paperclip-runner/test-fixtures/pi-acp/paid-qualification-progress.darwin-arm64.json @@ -1,6 +1,6 @@ { "schema": "paperclip.pi-paid-qualification-progress.v1", - "recordedAt": "2026-09-28T22:24:39.777300+00:00", + "recordedAt": "2026-09-28T22:41:36.062345+00:00", "qualificationStatus": "pending", "environment": { "platform": "darwin", @@ -17,7 +17,7 @@ "budget": { "authorizedMaximumUsd": 25, "reservedPerBatchUsd": 2, - "measuredSpendUsd": 0.028706633, + "measuredSpendUsd": 0.028858372, "measurement": "exclusive OpenRouter key billing delta; model catalog estimates are not provider billing", "billingGroups": [ { @@ -700,6 +700,38 @@ }, "automaticRetries": 0, "evidence": "native-controls-proof.v4.darwin-arm64.json" + }, + { + "attemptId": "pi-native-controls-03", + "family": "native-acp", + "caseId": "active-steer-queued-follow-up-and-denied-write", + "profileVersion": 5, + "source": "aec26ad83f1d082f0d0a5eaffbd615a9e2e26155", + "packDigest": "sha256:cf7d0998bbc2bed7b893c726c2b6455ba8a683d9cff7d92afedbff2d5900d500", + "profileDigest": "sha256:020d96ccbd3c45c3f62680814776394ed5a56d9572a1a4dccda56a74d16c7803", + "model": "openrouter/deepseek/deepseek-v4-flash-0731", + "status": "passed", + "modelPromptRequests": 1, + "durationSeconds": 19.199, + "billingDeltaUsd": 0.000151739, + "earlyObservedKeyDeltaUsd": 0, + "billingCoverage": "exclusive key delta settled on later observation", + "terminalUsage": { + "inputTokens": 3727, + "outputTokens": 140, + "cachedReadTokens": 1792, + "cachedWriteTokens": 0, + "totalTokens": 5659, + "_meta": { + "paperclipPi": { + "provenance": "assistant_message_receipts", + "costUsd": 0.0006111560000000002, + "costSource": "pi_pricing_estimate" + } + } + }, + "automaticRetries": 0, + "evidence": "native-controls-proof.v5.darwin-arm64.json" } ], "observedSemanticOperations": { @@ -777,8 +809,21 @@ "optionalInstallationSuitePassed": 5, "installedPackageAndMaterializerTestsPassed": 24, "nativeRustTestsPassed": 13, - "authenticatedQualification": "blocked before provider startup by local database fixture infrastructure", + "authenticatedQualification": "Product blocked before provider startup by local database fixture infrastructure; separate native controls probe passed", "nativeControlsProof": "native-controls-proof.v4.darwin-arm64.json" + }, + "version5": { + "source": "aec26ad83f1d082f0d0a5eaffbd615a9e2e26155", + "offlineProof": "offline-provider-pack-proof.v5.darwin-arm64.json", + "securityClosureProof": "security-closure-proof.v5.json", + "nativeControlsProof": "native-controls-proof.v5.darwin-arm64.json", + "recursiveTypecheck": "passed", + "fullBuild": "passed", + "focusedTypeScriptTestsPassed": 43, + "installedWrapperAndNativeSdkTestsPassed": 19, + "materializerTestsPassed": 8, + "nativeRustTestsPassed": 13, + "qualification": "pending; one direct ACP controls probe passed, complete Product/Daytona matrix remains pending" } }, "publicationBoundary": { @@ -789,7 +834,7 @@ }, "remaining": [ "Successful canonical Runner protocol completion", - "Semantic plan approval with canonical write boundary, pending-input restart, and refreshed version4 Product hello", + "Current version5 local Product hello, file, question, semantic plan and pending-input restart journeys", "Durable native pending-request reconnect/recovery beyond direct ACP controls", "Complete token and price/billing coverage, separate from catalog estimates", "Linux x64 Daytona authenticated qualification" diff --git a/packages/paperclip-runner/test-fixtures/pi-acp/security-closure-proof.v5.json b/packages/paperclip-runner/test-fixtures/pi-acp/security-closure-proof.v5.json new file mode 100644 index 00000000000..c7bf2776f73 --- /dev/null +++ b/packages/paperclip-runner/test-fixtures/pi-acp/security-closure-proof.v5.json @@ -0,0 +1,173 @@ +{ + "schema": "paperclip.pi-security-closure-proof.v1", + "sourceRevision": "aec26ad83f1d082f0d0a5eaffbd615a9e2e26155", + "advisory": "https://github.com/advisories/GHSA-3wwx-pv8p-q78v", + "profileVersion": 5, + "profileDigest": "sha256:020d96ccbd3c45c3f62680814776394ed5a56d9572a1a4dccda56a74d16c7803", + "npmCiInstalledVersionBeforeOwnedReplacement": "8.9.0", + "installedVersionAfterOwnedReplacement": "8.10.2", + "isolatedLockUnchangedByInstall": true, + "isolatedLockSha256": "0516456f6da2b09f35b15b17b558780f9d98419d2d911a37416e07cf0e306df4", + "upstreamMetadata": { + "package.json": { + "sha256": "820f4adc6d61f2cefbc29ce17e9dfd9aa482248d54be5d0dfa2a868ca000c7b0", + "unchangedFromV4": true + }, + "npm-shrinkwrap.json": { + "sha256": "e09ee75249d2381fbb66d2199c9e699910ce3fa7608d55e93f6fe37c3ded5973", + "unchangedFromV4": true + } + }, + "node": { + "version": "24.21.0", + "bundledUndici": "7.29.1", + "sha256": "e4b5a3af0e05c75de2eae013904145f40fe7fc2a6e6f17510128bf45cca4e79b" + }, + "targets": { + "darwin-arm64": { + "archiveSha256": "bed7eea5325e1108f32ce5228ddd6a5f0f08a499ee42aa7442aea583702f6057", + "executableSha256": "e4b5a3af0e05c75de2eae013904145f40fe7fc2a6e6f17510128bf45cca4e79b", + "executableSize": 122129232 + }, + "darwin-x64": { + "archiveSha256": "1462cb3b3046b815cf8ea436d3da450ec1a9f11dac7e5a46b0ada5305d7e8097", + "executableSha256": "7abcf39bd37ab251015337ff75304d7555f0d8e88c6e0fbf04bce8ce34636f49", + "executableSize": 125270960 + }, + "linux-x64": { + "archiveSha256": "6e1db87ef58b8819e5d5402eff1536491b18edd8eb7bee5ef7897876e88dc5ff", + "executableSha256": "7fde7b8afa198da66257f42ee2001d874c7355631e6d1579a5fb5ef1f246df4c", + "executableSize": 126595440 + } + }, + "closureSha256": { + "darwin-arm64": "0010175e4bc200f145386e59f7a824cf7532ad273e9db6824d22c4f82cdcd6ff", + "darwin-x64": "9dd49bd1341a6e3438db56cc6b3dc772964ebcdd0552bcfbf2e5e621b2970ab6", + "linux-x64": "91169667544764764e2e402868fbb76a9a429575cfdb1b312b8ed8ae669ebc89" + }, + "verifiedFileCount": 13827, + "changedRuntimeFiles": [ + "node/bin/node", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/docs/docs/api/Client.md", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/docs/docs/api/EnvHttpProxyAgent.md", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/docs/docs/api/EventSource.md", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/docs/docs/api/Interceptors.md", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/docs/docs/api/Socks5ProxyAgent.md", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/api/readable.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/cache/memory-cache-store.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/core/connect.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/core/symbols.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/dispatcher/agent.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/dispatcher/balanced-pool.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/dispatcher/client-h1.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/dispatcher/client-h2.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/dispatcher/client.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/dispatcher/dispatcher-base.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/dispatcher/dispatcher.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/dispatcher/dispatcher1-wrapper.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/dispatcher/env-http-proxy-agent.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/dispatcher/proxy-agent.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/dispatcher/retry-agent.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/dispatcher/round-robin-pool.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/dispatcher/socks5-proxy-agent.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/handler/cache-handler.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/handler/decorator-handler.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/handler/deduplication-handler.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/handler/redirect-handler.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/handler/retry-handler.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/interceptor/cache.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/interceptor/decompress.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/interceptor/deduplicate.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/interceptor/dns.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/interceptor/dump.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/mock/mock-agent.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/mock/mock-utils.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/util/cache.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/web/cookies/parse.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/web/eventsource/eventsource-stream.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/web/eventsource/eventsource.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/web/fetch/index.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/web/fetch/request.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/web/fetch/util.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/web/webidl/index.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/web/websocket/connection.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/web/websocket/permessage-deflate.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/web/websocket/stream/websocketstream.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/lib/web/websocket/websocket.js", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/package.json", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/types/client.d.ts", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/types/interceptors.d.ts", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/types/mock-agent.d.ts", + "node_modules/@earendil-works/pi-coding-agent/node_modules/undici/types/socks5-proxy-agent.d.ts", + "package-lock.json", + "package.json" + ], + "archiveBounds": { + "compressedBytes": 4194304, + "inflatedTarBytes": 4194304, + "regularFiles": 214 + }, + "credentialAccess": false, + "providerPrompts": 0, + "providerInferenceCalls": 0, + "x64ExecutionQualified": false, + "tests": { + "materializer": 8, + "typescriptIncludingActualInstallation": 43, + "installedWrapperAndNativeSdk": 19, + "rustNativeBackend": 13 + }, + "independentReview": { + "source": "aec26ad83f1d082f0d0a5eaffbd615a9e2e26155", + "review": "read-only credential-free", + "packageCount": 143, + "verifiedFiles": 13827, + "closureSha256": "0010175e4bc200f145386e59f7a824cf7532ad273e9db6824d22c4f82cdcd6ff", + "profileSha256": "020d96ccbd3c45c3f62680814776394ed5a56d9572a1a4dccda56a74d16c7803", + "node": { + "node": "24.21.0", + "undici": "7.29.1" + }, + "installedUndici": "8.10.2", + "unchangedUpstreamMetadata": { + "package.json": "820f4adc6d61f2cefbc29ce17e9dfd9aa482248d54be5d0dfa2a868ca000c7b0", + "npm-shrinkwrap.json": "e09ee75249d2381fbb66d2199c9e699910ce3fa7608d55e93f6fe37c3ded5973" + }, + "unchangedDistributionLockSha256": "0516456f6da2b09f35b15b17b558780f9d98419d2d911a37416e07cf0e306df4", + "scope": "Reviewed source upgrades Pi private interpreter. Parent separately authorized outer pack Node24.21.0 and Docker provider-build Node24.21.0; resulting mac/Linux artifacts are not covered by this installed-distribution proof.", + "x64Execution": "not tested", + "inferenceRequests": 0, + "verification": { + "materializer": { + "passed": 8, + "failed": 0 + }, + "profileAndRecovery": { + "passed": 12, + "failed": 0, + "skipped": 1, + "skip": "Optional actual snapshot launch separately covered by Pi implementer" + }, + "retainedOperatorSetupFailures": 2 + }, + "warmIdentityReview": { + "piOldProfileVersionsRejected": [ + 1, + 2, + 3, + 4 + ], + "privateProfileBinds": [ + "wrapper patch", + "all platform closure pins", + "Node executable via closure" + ], + "outerPackBinds": [ + "Node artifact sha256", + "canonical manifest digest", + "runner launch authority digest", + "persisted launch_profile_digest" + ] + } + } +}