Admit versioned ACP profile snapshots for the Pi error contract

Allow profile version 3 without changing existing provider identities. Reject unsupported and malformed versions, and retain exact runtime identity verification.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

packages/paperclip-runner/src/contracts/native-execution.test.ts

@@ -280,7 +280,7 @@ describe("NativeExecutionInputV1", () => {
     })).toThrow("eventExpiryDays");
   });
 
-  it("accepts only a closed ACPX profile matching the driver and agent", () => {
+  it.each([1, 2, 3] as const)("accepts only a closed ACPX profile matching the driver and agent at profile version %s", (agentProfileVersion) => {
     const provider = {
       kind: "acpx",
       agent: "pi",
@@ -291,7 +291,7 @@ describe("NativeExecutionInputV1", () => {
         protocolVersion: 1,
         acpxVersion: "0.13.1",
         agent: "pi",
-        agentProfileVersion: 1,
+        agentProfileVersion,
         agentServerPackage: "pi-acp",
         agentServerVersion: "0.0.33",
         agentRuntimePackage: "@earendil-works/pi-coding-agent",
@@ -312,6 +312,13 @@ describe("NativeExecutionInputV1", () => {
       profile: provider.profile,
     });
     expect(parseNativeExecutionInput(parsed)).toEqual(parsed);
+    for (const unsupportedVersion of [0, 4, 1.5, "3", null]) {
+      expect(() => parseNativeExecutionInput({
+        ...input,
+        session: { ...input.session, driverKind: "acpx_runtime" },
+        provider: { ...provider, profile: { ...provider.profile, agentProfileVersion: unsupportedVersion } },
+      })).toThrow("qualified ACPX v1 profile");
+    }
     expect(buildNativeModelEnvelope(parsed).workspace).toEqual({ cwd: "/safe/workspace" });
     expect(() => parseNativeExecutionInput({
       ...input,

packages/paperclip-runner/src/contracts/native-execution.ts

@@ -90,7 +90,7 @@ export interface NativeAcpxProfileSnapshot {
   protocolVersion: 1;
   acpxVersion: "0.13.1";
   agent: NativeAcpxAgent;
-  agentProfileVersion: 1 | 2;
+  agentProfileVersion: 1 | 2 | 3;
   agentServerPackage: string;
   agentServerVersion: string;
   agentRuntimePackage: string | null;
@@ -596,7 +596,7 @@ export function parseNativeExecutionInput(value: unknown): NativeExecutionInput
       || profile.protocolVersion !== 1
       || profile.acpxVersion !== "0.13.1"
       || profile.agent !== provider.agent
-      || (profile.agentProfileVersion !== 1 && profile.agentProfileVersion !== 2)
+      || (profile.agentProfileVersion !== 1 && profile.agentProfileVersion !== 2 && profile.agentProfileVersion !== 3)
     ) {
       throw new NativeExecutionInputError("input.provider.profile does not match the qualified ACPX v1 profile");
     }

packages/paperclip-runner/src/drivers/acpx/qualified-profiles.ts

@@ -11,7 +11,7 @@ export interface QualifiedAcpxProfile {
   readonly protocolVersion: typeof ACPX_DRIVER_PROTOCOL_VERSION;
   readonly acpxVersion: typeof QUALIFIED_ACPX_VERSION;
   readonly agent: QualifiedAcpxAgent;
-  readonly agentProfileVersion: 1 | 2;
+  readonly agentProfileVersion: 1 | 2 | 3;
   readonly qualificationStatus?: "pending";
   readonly modelPolicy?: "explicit-provider-verified";
   /** Wire identity: an npm package name or a runner-owned builtin: identifier. */