Normal parent merge; only the two qualified card interval paths change. Preserve every other owned and upstream blob.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Normal parent merge; only the two qualified card interval paths change. Preserve every other owned and upstream blob.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Normal parent merge; only the two qualified card interval paths change. Preserve every other owned and upstream blob.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Keep membership provenance from describing an interval-owned evaluation deadline; retain existing cadence and source handling.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Normal parent merge; only the five qualified card/search paths change. Preserve every other owned and upstream blob.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Normal parent merge; only the five qualified card/search paths change. Preserve every other owned and upstream blob.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Normal parent merge; only the five qualified card/search paths change. Preserve every other owned and upstream blob.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Add an internal result-kind constraint owned by company search, preserving all/comments/documents task matching and default mixed search. Apply it to card snapshots and preview without unrelated entity producer fanout.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Normal parent merge; only the three qualified status-card paths change. Preserve every other owned and upstream blob.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Normal parent merge; only the three qualified status-card paths change. Preserve every other owned and upstream blob.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Normal parent merge; only the three qualified status-card paths change. Preserve every other owned and upstream blob.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Guard stale cleanup with the durable generation ledger and a transaction-bound canonical cancellation. Coalesce the original completed manual request, retain future manual work, and preserve one-connection and outer-commit effects.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
The actual master tree equals the already-qualified C1 parent. Resolve squash ancestry conflicts to retain the entire qualified cards source tree byte for byte.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Resolve fourteen ancestry-only regions in six files by retaining the already qualified deferred owner registration, queue topics, reaper delegation and transactional eligibility producers. Landed master tree equals the qualified B parent; resulting whole candidate tree remains byte-identical to d6d0b67e8a.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Keep concurrent refreshes of one revision deduplicated while preventing a superseded refresh from cancelling a newer revision task before its claim.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Match the specific task href within the completion message while retaining link semantics. Both hydrated issue chips and links awaiting their title now satisfy the same target identity assertion; other tasks cannot match.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
The delegated completion paragraph includes a task link whose SVG status title contributes to Playwright text matching. Assert the completion prefix and exact accessible task identity together without assuming flat text. Keep the existing visibility deadline and delivery/document assertions.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Preserve confirmation candidates and notification ownership alongside the current routine, native, security, and retention changes.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
## Thinking Path
> - Paperclip manages agent work and keeps its results available to
users.
> - Agent Chat needs a visible reply before the conversation can wait
for more input.
> - Native result commitment and reply presentation are separate
obligations.
> - A completed conversation can retain a valid final message without a
saved reply.
> - Existing reply recovery excludes these completed conversation turns.
> - This pull request repairs that persistence gap through the existing
recovery worker.
## Linked Issues or Issue Description
**What happened?**
A native Agent Chat turn completed successfully and saved its workspace.
Its accepted result and final assistant message were durable, but no
reply appeared in the conversation. The chat stayed active. The
deployment hiring journey in #18351 then reached its deadline while
waiting for the first reply.
**Expected behavior**
Recover the exact accepted turn's final reply once, then use normal
conversation settlement. Keep later user input active. Do not run the
agent again or replace a selected or deleted reply.
**Steps to reproduce**
1. Create an active conversation with one admitted native turn.
2. Commit an accepted DONE result and a final-channel assistant message
for that exact run, session and turn.
3. Finish workspace finalization before live heartbeat reply
presentation. Leave no saved reply.
4. Run normal response recovery. Before this fix it finds no
conversation candidate and leaves the chat active.
**Paperclip version or commit**
Reproduced with actual services at frozen master
`8bcc5a01edd5d87540401521e6f30d3df43e1848`. The production predicate
also exists in the deployed revision that exposed the failure.
Related work: #18351. The broader receipt and recovery work in #18118
and #18409 does not touch these source files.
## What Changed
- Discover unanswered committed Agent Chat turns through the existing
native response presentation worker.
- Recheck company, agent, responsible user, current execution and
conversation generation under the normal transaction locks.
- Require the accepted result digest and an exact final message from the
same native run, session and accepted turn. Keep external publication
authority separate.
- Commit the reply and presentation receipt before normal conversation
settlement. Later input stays active. Recovery does not repeat agent
work.
- Preserve skip decisions and selected or deleted replies. Add database
controls for foreign identity, stale sessions, partial commitment,
duplicates and ordinary internal task behavior.
- Document the recovery boundary in the developer guide.
## Verification
- Real-service RED/GREEN uses all 418 canonical migrations in isolated
PGlite and the exact new regression fixture. Before the fix: zero
candidates, no reply, recovery returns false and the chat stays active.
After the fix: one candidate, one exact reply, recovery returns true and
the chat waits. A repeat returns false and creates no second reply.
- All 20 canonical regression cases pass locally through a fixture-only
PGlite bridge. Only local database provisioning and `createDb` selection
differ from the normal embedded PostgreSQL fixture. Production services,
SQL queries, transactions, protocol validation and assertions remain
real. Linux embedded PostgreSQL CI is required before merge.
- Focused current-source no-emit typing passes for both production
modules and the new regression file, with normal Express augmentation
and source aliases. The broader local presentation/ownership and
conversation-settlement PGlite bridge run was interrupted before it
reported results; it is not counted as a pass. No repository-wide local
build is claimed from borrowed workspace dependencies. Clean-build CI
and canonical PostgreSQL consumer tests remain required.
- `git diff --check` and the scoped source/test secret scan pass. No
captured run data, credentials or private target identities are
committed.
- No live journey retry, deployment, configuration change or test-plan
admission was performed. The original failed journey remains failed;
this production fix still needs deployed qualification through the
unchanged journey.
- Current-head [canonical Linux
CI](https://github.com/paperclipai/paperclip/actions/runs/41207018345)
passed all 57 terminal checks with no failure or pending check. The new
20-case database regression actually passed in [server shard
8](https://github.com/paperclipai/paperclip/actions/runs/41207018345/job/124555006090),
at 13:59:25 UTC (2,643 ms). Typecheck, build and the existing consumer
lanes passed. Fresh [Greptile
review](https://github.com/paperclipai/paperclip/pull/18465#issuecomment-6544208002)
on exact `f32a432e10b377ae6277d6f728995d5fedcf9d7b` is 5/5; the
review-thread inventory is empty with no pagination. No live deployment
or journey pass is claimed by these checks.
## Risks
Eligible active conversations can gain a previously missing reply.
Recovery accepts only the exact saved final message under its accepted
result and current conversation identity. It does not run a model,
repeat hiring or change a prior test grade. Reply persistence precedes
waiting-state settlement; existing conversation recovery retains
ownership of a later interrupted settlement. No schema or public API
changes are included.
## Model Used
OpenAI Codex, GPT-6 family. The session does not expose a more specific
backend model ID or fixed context window. Used reasoning, repository
tools, TypeScript and real database test execution.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
## Thinking Path
> - Paperclip helps people manage AI agents and their work.
> - The Coordinator workspace shows a task transcript and a message
composer.
> - The composer footer can cover part of the transcript on desktop.
> - The footer has a transparent background, so text shows through
accessory panels and gaps.
> - This pull request gives the footer a solid background from the
active theme.
> - Users can read the composer controls without text from the
transcript behind them.
## Linked Issues or Issue Description
**What happened?**
The Coordinator composer footer lets transcript text show through the
area above the message field.
**Expected behavior**
The full footer has a solid surface in light and dark themes.
**Steps to reproduce**
1. Enable the Coordinator workspace.
2. Open a task with enough messages to scroll.
3. Show a composer accessory, such as queued messages or a pending
question.
4. Scroll the transcript behind the footer on desktop.
**Paperclip version or commit**
Base commit: f2db909393.
**Deployment mode**
Built from source. The change affects the Coordinator workspace.
Related work: https://github.com/paperclipai/paperclip/pull/17983 added
the workspace. Searches for an opaque or transparent composer fix found
no duplicate.
## What Changed
- Use `var(--background)` for the full Coordinator composer footer.
- Keep the outer footer square so transcript text cannot show at its
corners.
- Block clicks through the footer gaps. Forward wheel input from these
gaps to the transcript.
- Keep editor scrolling, zoom input, and the classic workspace behavior.
- Add regression tests for the footer surface, wheel input, and canceled
forwarded events.
- Keep wheel modifier keys. Use the font size to calculate horizontal
distance for line-mode input.
- Remove the old comment that describes a transparent footer.
## Verification
- Passed: 173 tests in `TaskChatComposerDock`, `TaskChatComposerStyles`,
`TaskChatComposer`, `TaskChatQueuedMessages`, and `TaskMessageScroller`.
- The surface and wheel tests fail on the previous implementation and
pass with this change.
- The latest wheel tests reproduce lost modifier keys and excessive
horizontal distance on the prior commit. The cancellation test fails
when the cancellation guard is removed.
- Passed: `pnpm check:token-gates` and `git diff --check`.
- Passed: local Chromium checks with the production dock and built UI
CSS in light and dark themes at desktop and mobile sizes. The checks
cover solid corners, blocked clicks in footer gaps, wheel input, message
entry, and horizontal overflow.
- The browser fixture reproduces the hidden-control click when the old
pointer rules are restored. These are local fixture checks, not a
deployed acceptance result.
- Passed: `pnpm --filter @paperclipai/ui typecheck` and `pnpm --filter
@paperclipai/ui build`.
- Full local `pnpm -r typecheck` and `pnpm build` could not finish
because Cargo is absent from this environment. The full local test run
was stopped without a complete result after these missing prerequisites
were confirmed. Full CI now passes on the current commit.
- Passed: [full
CI](https://github.com/paperclipai/paperclip/actions/runs/41205893876)
on commit `37feaef28`. Greptile and Paperclip both gave this commit 5/5.
Both review threads are resolved.
- Paperclip review found hidden clicks through footer gaps and exposed
corners. This change addresses both findings. The first CI quality
review required a regression test. This change adds those tests. The
later review requested a cancellation test and better horizontal wheel
handling. This change addresses both items.
## Risks
- Low risk. The CSS selector applies only inside the Coordinator
workspace.
- The footer now captures clicks across its full area. Wheel input in
empty footer space still scrolls the transcript.
- The dock forwards wheel input to the transcript handler so
earlier-history loading still receives that input.
- No API, data, or migration changes.
## Model Used
- OpenAI Codex, based on GPT-6 (`gpt-6`), with reasoning, tool use, and
code execution. The runtime does not expose its context window. The
model ID for the original saved CSS patch is not retained in the task
evidence.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
---------
Co-authored-by: Paperclip <noreply@paperclip.ing>
Carry only the final C1 test fixture and unrelated-process regression. Preserve all status-card, migration and runtime inputs.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
* commit '939b90abe3f455762185110e42918ae379af6e64':
test(server): observe restored Retry before draining unrelated work
## Thinking Path
> - Paperclip is the open source app people use to manage AI agents for
work.
> - Chat feature evaluations send their results to TestOps.
> - The final reader checks the result against its current GitHub run.
> - A real result omitted the nested job object and had no presentation
links.
> - The reader rejected that passed result after a successful upload.
> - This change joins the embedded job-run ID to the separate job-run
response.
> - The reader keeps the source, case, status, and attachment checks.
## Linked Issues or Issue Description
Refs #18394 and #18322.
**What happened?**
The native chat test and cleanup passed. TestOps stored a passed result
and three attachments. The final read-only step failed with
`chat_testops_upload_mismatch`. The result response had a job-run ID,
launch ID, and current GitHub run URL. It did not include the nested job
object. Its presentation links were empty.
**Expected behavior**
The reader must accept that response when the separate job-run response
proves the exact job, launch, and current GitHub run. It must reject
conflicting identity or source data.
**Steps to reproduce**
1. Return a valid result with an unexpanded job run and empty links.
2. Return the matching full job run from the existing job-run endpoint.
3. Call `verifyChatUpload`. The old reader rejects the result.
**Paperclip version or commit**
Observed on c2971badde. The fix starts
from ab51cabbbd.
**Deployment mode**
GitHub Actions and AWS. This defect is in the TestOps report reader.
## What Changed
- Join the exact embedded job-run ID to the separately checked job-run
response.
- Accept empty presentation links. Reject conflicting known run and
commit links when present.
- Reject conflicting embedded job fields.
- Add regressions for the observed response and wrong job, run, launch,
and source data.
## Verification
- Three new tests fail against the parent reader.
- `node --test tests/runner-e2e/chat-feature-testops-api.test.mjs`: 47
passed.
- `node --test tests/runner-e2e/testops-chat-reporter.test.mjs`: 14
passed.
- Both changed files pass `node --check`. `git diff --check` passes.
- Local checks used Node 26.4. Normal CI must check the workflow
runtime.
- Full local typecheck, build, app, database, SDK, and provider runs
were not run. This two-file MJS fix uses pure tests and mocks.
- Normal CI
[41205375203](https://github.com/paperclipai/paperclip/actions/runs/41205375203),
attempt 1, passed on c7b5bf3238. Both required checks passed. Greptile
is 5/5. The optional automated coverage note has a recorded disposition
and is resolved.
- The original feature verdict, backend pass, and failed final reader
step remain separate. This change does not regrade that run.
## Risks
- Empty presentation links do not prove a server commit link. Source
identity comes from the trusted current GitHub context, selection, and
bound export.
- The separate job-run response remains required. All case, status,
attachment, and deadline checks remain active.
- The new reader has not yet run against the live service. CI and a
later authorized run must qualify delivery.
## Model Used
OpenAI Codex, `gpt-6.1-sol`, with reasoning, source inspection, and code
execution. The host does not expose the context-window limit.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
Co-authored-by: Paperclip <noreply@paperclip.ing>
Prove a completed saved Retry remains observable while another real process holds the global drain open. Preserve exact target completion, stdout, execution count, deadline and final quiet assertions, and always release the held provider before teardown. Align two inherited fixture literals with current types.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Carry the final C1 ancestry without changing status-card, migration, server or dependency inputs.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
* commit 'c6f4e04473fef908f8799b51cd9354af903ca8a8':
test(runner): own listener cleanup across setup failures
test(runner): buffer upgrade frames until the wire subscribes
Preserve the published concurrent comment uniqueness and read-state backfill migration. Regenerate the combined schema as migration0420 with the repository workflow and retain five snapshots. Add both upgrade-path controls without changing status-card execution policy.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Keep listener setup and address validation inside the regression fixture's try/finally. Reject listen errors and close all owned sockets even when setup fails.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Keep coalesced WebSocket upgrade-head messages until the control-plane listener is installed. A real TCP regression reproduces the lost Hello without changing reconnect grace; both real staged handoff modes retain their original authority and process assertions.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
## Thinking Path
> - Paperclip lets people answer questions while native agent work is
active.
> - Runner drivers translate provider question forms and answers into
the shared contract.
> - Pinned OpenCode 1.18.34 enables written answers when `custom` is
omitted.
> - The driver required explicit `true`, so it removed that input from
ordinary native questions.
> - The same branch could override a native opt-out or add a separate
custom field to a text-only question.
> - This pull request preserves the native default, explicit opt-out,
original choices, and exact answer delivery.
## Linked Issues or Issue Description
**What happened?**
A native OpenCode question with choices and no `custom` field loses its
written-answer control in Paperclip. The pinned provider enables that
control by default. A legacy alias can also override native
`custom:false`. A question with no choices and `custom:true` is rejected
because the driver adds a separate custom field to text mode.
**Expected behavior**
Follow the [pinned OpenCode question
contract](https://github.com/anomalyco/opencode/blob/v1.18.34/packages/schema/src/v1/question.ts).
Preserve the written-answer default for choices. Honor native
`custom:false`. Keep optionless questions text-only. Preserve every
supplied choice and return the exact written answer to the same native
request.
**Steps to reproduce**
Use the normalizer regression or the local OpenCode driver fixture. Emit
a native question with choices and omit `custom`. The unfixed driver
omits `customAnswer`; its existing written-answer roundtrip assertion
fails. The separate negative controls reproduce native opt-out
precedence and text-only normalization errors.
**Paperclip version or commit**
Reproduced on main `f2db909393de124caf6a5380a52d4e0e1d621661`, with
pinned `opencode-ai@1.18.34`.
## What Changed
- Apply the native `custom` flag first, then the legacy alias, then the
pinned default of `true`.
- Add a separate custom field only when choices exist. Keep optionless
questions text-only.
- Add default, opt-out, alias, and exact response validation
regressions. Make the driver fixture omit the optional native flag and
retain its exact custom-answer roundtrip assertion.
- Document the pinned native behavior.
## Verification
- Before the fix, the real normalizer fails three targeted assertions:
omitted custom input, native opt-out precedence, and optionless text
with `custom:true`.
- The local driver subprocess regression also fails before the fix. Its
native request omits `custom`, and the driver drops the expected
written-answer control.
- After the fix, all **79 tests in three files pass**: the new nine-case
normalizer suite, the full 65-case OpenCode driver suite, and the five
question-set response tests. The driver sends the unchanged written
answer in the provider's ordered answer array and records one terminal
request resolution.
- Runner TypeScript check passes. A first attempt lacked the isolated
eval-kernel declarations; building that local dependency resolved the
setup gap. Locked dependencies were installed from the existing cache
with scripts disabled.
- Diff checks pass. Exact-head [canonical CI run
41203866644](https://github.com/paperclipai/paperclip/actions/runs/41203866644)
passes build, typecheck, release registry, Runner checks, server tests,
and all eight E2E shards at `72b21207e8590b78e24fe2cef4e3f6c374be53a4`.
All current PR checks are terminal with no failures. Storybook is
skipped for this scope and Paperclip Review is neutral. Full repository
checks were not repeated locally for this narrow provider translation
change.
- [Fresh Greptile
review](https://github.com/paperclipai/paperclip/pull/18456#issuecomment-6543742512)
gives 5/5 on that exact head with no actionable findings. All review
threads are addressed. GitHub reports `MERGEABLE` and `CLEAN`.
- Local tests use a controlled provider fixture. They do not establish a
paid model pass or attribute a deployment incident without its original
native arguments. No QA run, runtime deployment, protected pin, journey
oracle, prompt, budget, run bound, or model setting changed.
## Risks
Native OpenCode choices now expose the written-answer control that the
provider already enables by default. Explicit native opt-out wins over
the legacy alias, and disabled custom responses remain rejected.
Existing choice IDs and labels remain unchanged. Deployed users need the
repaired Runner artifact through the normal delivery path. Local driver
proof does not replace deployed journey qualification.
## Model Used
OpenAI Codex, GPT-6 family, with reasoning, source inspection, and code
execution. The host does not expose the exact underlying model version
or context-window size.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with available version and
capability details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs; none repairs
this native default
- [x] I have described the issue in-PR following the bug template
- [x] I have not referenced internal/instance-local Paperclip issues or
links
- [x] My branch name describes the change and contains no internal
ticket or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation
- [x] I have considered and documented risks
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before merge
Co-authored-by: Paperclip <noreply@paperclip.ing>
## Thinking Path
> - Paperclip is the open source app people use to manage AI agents for
work.
> - Native runs keep Stop intent and retry state in durable records.
> - A provider error can leave a failed retry with an earlier
acknowledged Stop.
> - The replay path returned the existing receipt before it closed that
retry.
> - This pull request applies the existing retry fence to the validated
replay.
> - The same Stop can settle without another provider cancellation or a
new receipt.
## Linked Issues or Issue Description
Refs #14733 for the related caller-bound Stop contract. This change
covers a later retry that already has a Stop acknowledgement. The older
CI-only #14743 is not a production delivery PR.
**What happened?**
A failed native run can have a retryable coordinator and an earlier
audited Stop. A repeat Stop returns the old acknowledgement without
moving the coordinator to `terminal_failure`. The final
failed-to-cancelled transition requires that fence, so the Stop cannot
settle through that path.
**Expected behavior**
A valid replay closes the same retry and keeps the original intent and
acknowledgement. It does not send a second provider cancellation.
Physical stop and workspace cleanup still require their own evidence.
**Steps to reproduce**
1. Store a failed native run with a `retryable_failure` coordinator.
2. Store a matching run-scoped Stop with a dispatched acknowledgement
and audit IDs.
3. Call `cancelNativeSession` for that same run and inspect the
coordinator.
**Paperclip version or commit**
Reproduced on public master `f2db909393de124caf6a5380a52d4e0e1d621661`.
**Deployment mode**
Core native execution. The regression uses the real cancellation
executor with controlled persistence and provider boundaries.
## What Changed
- Reuse the existing guarded coordinator fence for a validated Stop
replay.
- Test repeated replay, unchanged receipts, one fence, and no second
provider cancellation.
- Reject foreign company, run, issue, scope, effect, and missing-audit
receipts before any write.
- Check that an acknowledged Stop with an unconfirmed remote lease still
fails the physical-stop guard.
- Document the separate retry fence and physical-cleanup requirements.
## Verification
- RED on the selected public base: the new executor case returned
success but left the coordinator in `retryable_failure` with a future
retry. One case executed and failed for that assertion.
- GREEN: 62 focused tests passed across
`native-session-executor.test.ts` and
`native-cancellation-request.test.ts`. These include ownership, caller
conflict, changed-phase, and receipt controls.
- Command from `server/`: `node ../node_modules/vitest/vitest.mjs run
src/services/native-runtime/native-session-executor.test.ts
src/services/native-runtime/native-cancellation-request.test.ts -t
'native session cancellation|caller-bound native cancellation|failed
native retry caller admission'`.
- Canonical Linux CI passed all 1,018 executor cases and all 32
caller-cancellation cases. The exact file completion lines are in
[server shard
2](https://github.com/paperclipai/paperclip/actions/runs/41203989386/job/124545366271)
and [server shard
10](https://github.com/paperclipai/paperclip/actions/runs/41203989386/job/124545366219).
- Node 24.22.2 and Vitest 5.0.3. Map contract checks and `git diff
--check` pass.
- Local dependencies are linked from an existing checkout. Full local
TypeScript validation reports older Runner/shared declarations that lack
current Kimi and continuity APIs. The changed ranges have no
diagnostics. The canonical clean CI Typecheck + Release Registry gate
passed.
- A broader two-file run was stopped when an unchanged integration case
tried to start embedded Postgres and hit the host listen restriction. It
is not a passing full-suite result. No host settings or other services
were changed.
- Repository-wide `pnpm -r typecheck`, `pnpm test:run`, and `pnpm build`
were not completed locally. Current-head CI passed against clean source
and dependencies.
- Fresh [Greptile
review](https://github.com/paperclipai/paperclip/pull/18457#issuecomment-6543772487)
on `dbc1c1a5b71450194d568725592969660864cb5a`: 5/5 with no actionable
findings. The review-thread inventory has no threads and no pagination.
Full [current-head
CI](https://github.com/paperclipai/paperclip/actions/runs/41203989386)
passed: 59 terminal checks, 55 successful, 3 skipped, and 1 neutral. No
failure or pending check remains. Merge status is CLEAN. No live
recovery, rollout, or physical termination is claimed.
## Risks
- A wrong or stale Stop must not close another retry. Existing
run/coordinator locks, caller checks, receipt binding, and the final
compare-and-set remain in place.
- This fix changes logical retry settlement only. Provider termination,
workspace preservation, lease cleanup, and continuation gates remain
separate.
- The regression controls persistence and provider boundaries. It does
not establish the physical state of a remote provider.
## Model Used
- OpenAI GPT-6 through Codex, with reasoning, code editing, and tool
use. The session does not expose an exact model build ID or
context-window capacity.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` /
`Closes: #` / `Refs #` OR (b) described the issue in-PR following the
relevant issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub references)
- [x] My branch name describes the change and contains no internal
Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
Co-authored-by: Paperclip <noreply@paperclip.ing>
Preserve keyed concurrent checks and their default serial behavior alongside issue-recovery reconstruction spacing and before-pass preparation. Qualify keyed ordering, joined preparation, exact deadline preemption and retained late-write reconstruction debt across drain.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Preserve retained-controller recovery deadlines and rearming together with company-scoped dispatch forwarding. Keep both source owners and all incoming master changes; no execution or retry policy changes.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Preserve master retention I/O settlement and held-I/O coverage alongside the controlled fairness clock and exact run completion barriers. Retain the delegated-completion fixture without changing production code.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
