Commit Graph
3 Commits
Author SHA1 Message Date
DottaandPaperclip 7d9b93aee2 docs: establish paired feature and agent access maps (#16025)
## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work.
> - Contributors use the feature map to understand and verify product
capabilities.
> - Agents need APIs and usable entry points within their permission
boundaries.
> - Product recipes and agent access need separate records with shared
capability IDs.
> - This pull request establishes that contract and gives maintenance
ownership of both maps.
> - The benefit is repeatable access review without changing product
behavior or permissions.

## Linked Issues or Issue Description

Refs: #15983, which added the portable verification skills and updated
the feature map. This is its contract-only follow-up. Related: #15288
added the original feature map.

**Issue type**

Missing documentation and maintenance contract.

**Where is the issue?**

The product map, its missing agent access companions, and the
verification skills.

**What's wrong?**

There is no shared convention for API presence, agent entry points,
permission boundaries, access gaps, or evidence. An API declaration does
not prove that a permitted native or remote agent can use it.

**Suggested fix**

Keep the product and agent access maps as siblings under `maps/`. Reuse
capability IDs. Record representative source inventory separately from
operation review and live proof. Keep both maps aligned through the
maintenance skill.

## What Changed

- Move the existing product map to `maps/feature-map/`. Preserve its
recipes and Poteto format. Update relative links and add companion
links.
- Add `maps/agent-access-map/` with 35 area files and 171 matching
capability IDs. Seed representative API operations, agent paths,
policies and known gaps from the reviewed source inventory. Mark entries
as `baseline`, `source-only`, and live verification `not-run`.
- Define the shared contract in `maps/README.md`. Track API presence,
agent availability, policy, evidence and review depth separately.
Require operation enumeration before marking a broad capability
operation-reviewed.
- Extend `maintain-verification-skill` to reconcile both maps and
inspect actual route policy and production tool admission. Update
creation, verification, notices and contributor references to use the
shared contract.
- Add `scripts/check-maps.mjs` and ten regression tests. Check matching
areas/IDs, indexes, references, contract fields, API method/path
examples, justified exceptions and evidence-state consistency.
- Keep the coverage inventory unchanged. Preserve skill invocation
policies and both MIT license blocks. No product API, permission, UI,
runtime helper, migration, dependency or workflow changes.

## Verification

- Passed: `node scripts/check-maps.mjs` reports 35 paired areas and 171
matching capability IDs. All local map references resolve.
- Passed: `node --test scripts/check-maps.test.mjs` runs ten tests.
Fixtures cover missing companions, renamed/orphan/duplicate IDs, broken
references, missing operation fields, empty exceptions, missing API
examples, empty policy fields, and verified evidence without passed
verification.
- Passed: metadata validation for all three verification skills. Skill
and contributor links resolve. Invocation policies and both license
blocks are unchanged.
- Compared relocated recipes with current master. Contents differ only
in relative links and companion links. `coverage.json` is byte-for-byte
unchanged. Master's updated read-only interaction test reference is
retained.
- Passed: `git diff --check`. The branch starts from current master and
contains only this contract change.
- Repository-wide typecheck, tests and build were not run locally for
this documentation and Node structural-check scope. Live agent access
was not exercised. Those gaps are explicit in the baseline entries; the
structural check does not certify behavior. CI and automated review are
pending.

## Risks

- The companions are representative source baselines. They are not
complete operation inventories or passed agent journeys.
- The checker cannot establish actual permissions, native tool
admission, operation completeness or truthful live evidence. Maintenance
must inspect source and verify with the actual permitted agent context.
- External links to the old product-map directory may need updates.
Repository references have been updated.
- Existing access gaps and board/user restrictions remain recorded. This
contract does not change authority or implement missing paths.

## Model Used

OpenAI GPT-6 through Codex assisted with this change. The session does
not expose the exact serving model ID, configured context-window size,
or reasoning setting. Capabilities used: source analysis, file edits,
shell commands, and structural regression tests.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [ ] All Paperclip CI gates are green
- [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-10-12 14:52:28 -05:00
DottaandPaperclip cc88b61c09 feat: add portable verification skills and refresh the feature map (#15983)
## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work.
> - Contributors use the feature map to select verification recipes.
> - The repository needs separate skills to create a verifier, maintain
recipes, and run checks.
> - Shared recipes must match current routes, controls, and
prerequisites.
> - This pull request adds portable verification skills and updates the
existing map.
> - The benefit is a repeatable verification workflow with clear
ownership and evidence limits.

## Linked Issues or Issue Description

Refs: #15288, which added the existing feature map. The related test
cleanup in #15978 changes test ownership; this PR changes skill
instructions and recipes.

**Issue type**

Missing documentation and outdated verification instructions.

**Where is the issue?**

The project-local skills in `.agents/skills/` and the recipes in
`feature-map/`.

**What's wrong?**

The repository lacks the portable creation and maintenance skills. The
verifier mixes live verification with map editing. Some recipes describe
old controls or omit required flags, identities, and provider setup.

**Suggested fix**

Import the skills and their complete references from Paperclip's pstack
fork. Keep the existing map in its current directory. Let the verifier
read recipes and report drift. Let the maintenance skill update the map.

## What Changed

- Add `create-verification-skill` and `maintain-verification-skill` from
the portable fork of Poteto's pstack. Include invocation policies, all
feature-map examples, self-contained attribution notices and the full
MIT license in each skill folder.
- Use the existing `feature-map/` directory and Poteto's recipe format.
Omit the fork's separate runtime skill and runtime-skill dependencies
because Paperclip supplies execution.
- Add `verify-paperclip` with executable launch, readiness, onboarding,
and cleanup helpers. Use isolated temporary data and separate evidence
directories.
- Make `verify-paperclip` consume the map and report recipe drift. Give
map editing to `maintain-verification-skill`.
- Review all 35 feature files and correct 30 recipes. Clarify routes,
flags, current controls, persistence scope, and the limits of linked
tests.
- Remove the unrelated Conference Room flag change from the onboarding
smoke helper.
- Add a standard-library ownership test. It proves that doctor and stop
reject a foreign checkout without stopping its live server. A
delayed-exit fixture also proves cleanup waits for runtime exit.
- Keep audit screenshots and scratch reports outside the repository. No
product code, migrations, lockfile, or workflow changes.

## Verification

- Passed after rebase: metadata validation for all three skills, Python
syntax and executable checks, JavaScript syntax, 35-entry map/index
consistency, relative links, license preservation, and `git diff
--check`.
- Ran one isolated live audit before rebase. Checked task persistence,
document upload/download bytes, goal hierarchy, project edits, search,
local process Agent Chat, question replies, queued-message discard/stop,
and a harmless loopback MCP call.
- Checked local settings and draft flows. Synthetic cost events reached
a small budget limit and paused the test agent. These checks do not
prove external model quality or provider billing.
- Checked cleanup of the audit server, database, local MCP fixture, and
workspace service inventory.
- Passed: `pnpm -r typecheck`.
- Greptile: 5/5 on commit `4344ac4df7`. The cleanup finding is fixed and
its review thread is resolved. A fresh review is pending for the notice
relocation.
- Passed: `python3 -m unittest discover -s
.agents/skills/verify-paperclip/tests -v`. Both tests pass: the foreign
fixture stayed alive after rejection, and owned cleanup waited for
delayed runtime exit.
- Passed: `pnpm build`.
- All GitHub CI checks were green on commit `4344ac4df7`. The cloud-auth
browser shard passed after one retry for a disposed mocked API response.
The notice relocation passed skill metadata, relative-link, and
license-preservation checks; fresh CI/review is pending.
- The full local `pnpm test:run` did not complete. It was interrupted
after nearly 30 minutes once the complete CI suite passed on the same
commit. Exit code: 130. The new helper safety tests passed locally. The
local full-suite checklist item stays unchecked.
- Full live coverage is incomplete. Authenticated multi-user checks and
external provider journeys need their own identities, credentials, and
targets.
- The corrected onboarding helper could not be re-tested after removing
the flag mutation. Two fresh launches failed before server startup.
Direct PostgreSQL initialization reported exhausted shared-memory IDs or
limits. The host had free disk space. No host-wide limits or unrelated
instances were changed.

## Risks

- Recipe drift can return as the UI changes. The map records
verification scope, not proof of a passed journey.
- The new helpers assume a source checkout with installed dependencies,
Python, Node, and `lsof`. The onboarding helper also needs Playwright.
- The local audit found observations that need separate investigation:
an action test returned fixture data while the connection control showed
Off and native profiles existed; a failed status-card setup task left
the card showing Setting up. Workspace service start also did not reach
a running state. This PR does not change product behavior or redefine
those outcomes as success.
- The main audit trace did not finalize during browser shutdown.
Screenshots, text captures, and iteration results were retained.
- Live evidence was captured before rebase. The onboarding helper
re-test and full provider/auth qualification remain incomplete.

## Model Used

OpenAI GPT-6 through Codex assisted with this change. The session does
not expose the exact serving model ID, configured context-window size,
or reasoning setting. Capabilities used: source analysis, read-only
source subagents, file edits, shell commands, and browser automation.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [ ] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [ ] All Paperclip CI gates are green
- [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

---------

Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-10-12 13:31:44 -05:00
DottaandPaperclip 45862dd210 docs: add a product feature map (#15288)
## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work.
> - Its user journeys span tasks, agents, projects, connected apps,
governance, and CLI operations.
> - Existing tests do not provide a shared index of entry points and
verification steps.
> - Contributors need to see which surfaces a change affects and what
evidence exists.
> - This pull request adds an optional product feature map with recipes
and explicit coverage gaps.
> - The map adds no CI checks or required maintenance for future pull
requests.
> - Contributors can use it to find verification steps and state what
they checked.

## Linked Issues or Issue Description

**Issue type**

Missing documentation.

**Where is the issue?**

User-journey verification guidance in AGENTS.md and doc/DEVELOPING.md.

**What's wrong?**

There is no shared index of product features, user entry points,
available test evidence, and remaining coverage gaps. Shared components
can hide differences between their hosts.

**Suggested fix**

Add a documentation-only capability index and verification recipes. The
format takes inspiration from [Omnigent's feature
map](https://github.com/omnigent-ai/omnigent/tree/91acfbbb59f6fc210ff95a9e9428aadd62e06582/feature-map).
The recipes describe Paperclip's own behavior and tests.

Searched GitHub PRs and issues for `feature map` and `feature-map`. No
duplicate change was found. Checked ROADMAP.md. This PR documents
existing capabilities.

## What Changed

- Added 35 feature recipes, 171 named sub-features, and 91 entry points
across product, CLI, operator, and developer surfaces.
- Each recipe describes setup, expected results, existing automated
evidence, manual verification, and coverage gaps.
- Added a dated source snapshot of 185 non-test page TSX modules in 15
areas. The snapshot describes documentation coverage, not runtime
health.
- Included entry points within existing pages, CLI/API operations, and
experimental surfaces. Identified helper-only test evidence where a
rendered journey has no automated proof.
- Linked the map from AGENTS.md and doc/DEVELOPING.md as an optional
reference.
- The final diff contains only Markdown and the inventory JSON. It adds
no checker, tests, package commands, workflows, dependencies, scheduled
work, or mandatory inventory updates.

## Verification

- PASS: local documentation links resolve and the inventory JSON parses.
Confirmed the final PR diff contains only 39 documentation files.
- PASS: `node --test '.github/scripts/tests/*.test.mjs'` — 381 existing
tests after removal of the feature-map tests.
- PASS: `git diff --check`.
- Earlier local build and typecheck passed. The full local test run was
stopped after 26 minutes with failures in unchanged chat-channel and
native-runner integration tests. It did not complete. These application
checks were not repeated for the documentation-only removal.
- [CI on the preceding
head](https://github.com/paperclipai/paperclip/actions/runs/37398407523)
passed all applicable checks. Checks on the final documentation-only
head are pending.
- PASS: Greptile review on final head
`45c4b0aeb26540324825da43e81bee2336ad1c1f` is 5/5. There are no
unresolved findings.
- Live product/provider journeys were not run to author the map. The
recipes identify available evidence and manual steps, not new
qualification results.

## Risks

Low product risk: the PR changes documentation only. Recipes and the
source snapshot can become stale. Maintenance is optional and based on
review. Linked tests do not prove that every documented journey works.
The map states remaining coverage gaps.

## Model Used

OpenAI Codex, GPT-6 family, with repository inspection, reasoning, tool
use, and code execution. The exact serving model ID and context window
were not exposed in this session.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [ ] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

---------

Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-10-06 02:08:47 +00:00