Keep raw invocation provenance separate from the validated proposal digest. Advance the semantic evidence contract to v2 and Copilot suite to 8; preserve denial and attached-operation invariants.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Use session/request_permission for the native permission fixture and verify that the real pending-request mapper settles its callback exactly once with action cancel.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Require the normalized pending-request closure and cancelled terminal with the existing caller-owned Stop and native evidence guards. Exercise the real Product projection and version the changed settlement oracle.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Keep bridge call identity separate from canonical result item identity. Require one complete shell-read lifecycle tied to the started command and reject extra or partial reads.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Generate both input orders through the real Cursor and Copilot projectors. Preserve Cursor's deferred permission evidence invariant while allowing Copilot's immediate permission notice before its exact tool origin; retain all pre-Stop and settlement bindings.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Accept either canonical permission/tool arrival order while binding the exact native-origin and tool-start rows before Stop and through cancellation. Version the pending receipt and suite; retain strict identity, no-effects, unanswered-request, and settlement checks.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
State each bootstrap prohibition separately so the production file-delivery classifier does not treat an isolated clause as a requested output. Keep immediate completion stress, private marker evidence and all settlement assertions unchanged; version the authored Copilot protection definition.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Include lease revalidation and the readiness RPC in the existing setup reserve, so late lease admission cannot consume the observation window. Keep the authored outer deadline, single installation, armed baseline action gate, and teardown reserve unchanged.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Observe the pinned run process and runtime inode within the original deadline before one observer install. Revalidate identity at installation and baseline, and retain only closed RPC phase/error diagnostics. Preserve action, ownership and cleanup gates.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Distinguish live snapshots from the automatic owned-process retirement seal. Preserve local four-phase observation and separately revalidate remote UI/API cancellation state without claiming later filesystem reads. Version the suite and calibrate stale/replayed/foreign/lost-descendant evidence.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Observe the task In Progress header and native Run cancelled marker with loaded history before treating an absent Deny button as unanswerable. Bound all waits by the existing attempt deadline.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Observe the isolated local-board session through the public API, retain it before Stop, and require its exact startup cancellation actor. Explicitly bind both closure and terminal envelopes to the observed turn, normalized session and source, including missing/null-turn negatives.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Wait for the exact turn reply and pending review card with enabled Continue work, In Review header and completed history loading before capturing intermediate warm screenshots. Reuse the existing turn deadline; preserve prior screenshots and result grades.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Add explicit Cursor and Copilot local/Daytona cells that retain an unanswered callback before a caller-correlated Stop, require cancelled provider settlement and stale-answer rejection, and independently verify no effects through owned retirement. Normal completion and provider death do not satisfy this active-work oracle.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Reserve an optional board request UUID under the run lock and retain it
through default Stop joins and native dispatch. Reject prior or competing
intents and require the same actor for idempotent retries.
Bind the Copilot denial fixture to its exact request and audited intent,
with versioned causal receipts and negative controls for earlier Stop.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Keep direct-child fallback bounded when process inspection fails, preserve incomplete cleanup evidence, and select graceful owners from the delivery snapshot without signaling already-covered descendants again.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Recognize socket hang up only in transport errors. Test plain and prefixed drops plus HTTP bodies with misleading network text.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Preserve typed HTTP and transport timeout classification while removing raw response bodies and causes from admission reports. Reject unknown failures and malformed JSON without weakening ownership or deadline checks.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Bound outstanding admission reads, preserve successful stop and ownership proof immediately, and retain API failure causes and classification at the existing deadline.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Retain successful ownership and terminal reads when another endpoint fails. Reserve the existing fixture setup allowance inside the authored case deadline and capture binder failures with startup state.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Wait through cold snapshot provisioning while rechecking exact task/run ownership and active lease admission. Fail promptly on terminal runs and retain bounded startup state.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Bind normal native plan acceptance to its durable request, delivered answer, admitted run and completion contract. Commit a passive in-progress result with a visible next-message summary, preserve semantic finish priority, and suppress recovery until task-specific continuation without changing modes.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Load route modules during fixture setup so cold transforms cannot leave a timed-out request running against the next test mock state. Dismiss delayed product announcements through the normal Board UI in the attachment receipt fixture.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Keep raw native command digests and exact execution origins while admitting at most eight leading ASCII space or tab bytes. Verify the relation in the settlement grader and retain independent local observations before a command mismatch aborts grading.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Reserve 15 seconds for public teardown, share remaining time across SDK/socket/host waits, subtract setup time from observer TTL, and bound close independently without extending qualification.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Withhold native tasks until exact owned observers are armed, preserve sealed retirement proof before environment teardown, and register explicit local and Daytona warm continuity cases.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Admit the actual staged runtime layout, retain sentinel and sibling mutation coverage, distinguish observed PRP identity from the sandbox lease, and bound setup readiness inside the caller deadline.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Arm bounded filesystem and process observers before publishing native actions, retain sealed file and retirement receipts before ephemeral lease teardown, and provide an independent attached-command fixture.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
