Coalesce committed company hints in a fixed one-second window without flooring real deadlines. Verify one hundred ordinary issue/comment writes, company isolation, deadline preemption, retained hints and settled SQL quietness. Await actual evaluation I/O in fake-clock acceptance instead of jumping across connection timers.
Co-Authored-By: Paperclip <paperclip@paperclip.ing>
Revalidate the exact selected plugin before result persistence even when an allowed fallback still supports the object. Preserve due debt and token ownership so a fresh allowed resolver can proceed.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Use the owning receipt transaction for source hints and snapshot token invalidation. Preserve scoped confirmation candidates, cancellation, and deferred outer-commit effects.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Guard the failure writer against another receiver's committed success. Prove the rollback race red/green and bounded HTTP body cancellation with unrelated-company progress.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Use a dedicated advisory-lock connection so a one-slot write pool can finish evaluation and result writeback. Record internal deadline provenance so startup recovers lost membership hints without advancing saved policy or retry debt.
Co-Authored-By: Paperclip <paperclip@paperclip.ing>
Preserve routine restore, card, retention, and issue recovery notifications in their original writer transactions.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Preserve all company mutation consumers and verify both merge-confirmation and external-refresh startup registrations.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Keep all owner subscriptions, restore issue identity, and remove only the replaced routine and retention sweeps.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Union feature-owned hints and preserve existing scoped queue behavior; replace the old retention sweep with its deadline owner.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Preserve both notification subscribers and all existing execution queues; retain the union of scoped execution identities.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Load company-partitioned decision/recovery links, run/agent visibility and newer-run probes once per page; share one blocker graph reconstruction and exact SQL timestamps across page entries. Keep fresh per-entry archive locks and revalidation. Add full100-source query budgets and late visibility/supersession safety controls.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
* origin/master:
fix(evals): support official TestOps job metadata (#18385)
fix(config): require shared storage for managed cloud (#18350)
feat(skills): make managed content independent of web-server disk (#18334)
Add a portable agent question and answer resumption journey (#18346)
fix(ci): isolate test selection and require current CI CODEOWNERS (#18376)
fix(evals): capture TestOps registration after watch (#18375)
fix(runner): allow session reset after confirmed task retirement (#18373)
fix(evals): batch task search result readback across renders (#18370)
fix(ui): keep task plugin views available for manual access (#18363)
test: wait for the evidence expiry worker to settle (#18241)
# Conflicts:
# server/src/services/company-skills.ts
# server/src/services/native-runtime/paperclip-runner-tool-authority.ts
Reuse the provider-owned request cancellation contract from merge-confirmation work. Keep host signals out of plugin RPC payloads, preserve refresh debt on shutdown, and target identities or known objects for source writes.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
* origin/master:
fix(evals): support official TestOps job metadata (#18385)
fix(config): require shared storage for managed cloud (#18350)
feat(skills): make managed content independent of web-server disk (#18334)
Add a portable agent question and answer resumption journey (#18346)
fix(ci): isolate test selection and require current CI CODEOWNERS (#18376)
fix(evals): capture TestOps registration after watch (#18375)
fix(runner): allow session reset after confirmed task retirement (#18373)
fix(evals): batch task search result readback across renders (#18370)
fix(ui): keep task plugin views available for manual access (#18363)
test: wait for the evidence expiry worker to settle (#18241)
Batch review and confirmation eligibility per company, scope decision and budget hints, and keep child blocker relation intents inside their owning transaction. Cover ordinary child, budget and execution producers plus full candidate-page query bounds; update startup/import fixtures for source-driven retention.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Retain Cloud event replay through durable enrollment and signed tenant hints. Save credential binding changes and retry deadlines in existing grant metadata. Preserve receipt idempotency, lifecycle admission and mixed-version fallback.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Bound GitHub object and repository probes, keep readiness independent of external reads, and page pending cards through the owning parser.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
* origin/master:
fix(config): require shared storage for managed cloud (#18350)
feat(skills): make managed content independent of web-server disk (#18334)
Add a portable agent question and answer resumption journey (#18346)
fix(ci): isolate test selection and require current CI CODEOWNERS (#18376)
fix(evals): capture TestOps registration after watch (#18375)
fix(runner): allow session reset after confirmed task retirement (#18373)
fix(evals): batch task search result readback across renders (#18370)
fix(ui): keep task plugin views available for manual access (#18363)
test: wait for the evidence expiry worker to settle (#18241)
## Thinking Path
> - Paperclip is the open source app people use to manage AI agents for
work.
> - Agents use installed skills and exact version pins during execution.
> - Managed skills still depended on mutable directories on the web
server.
> - A replacement server could lose acknowledged edits or remove an
unassigned skill whose directory was absent.
> - This pull request makes immutable versions the authority for managed
content and installed repository reads.
> - The server can rebuild delivery files from durable content after
replacement.
> - This establishes skills readiness for ephemeral web servers. General
server draining and workspace recovery remain separate work.
## Linked Issues or Issue Description
**Subsystem affected**
Skills services, shared contracts, database receipts, Skill Studio, and
runtime delivery.
**Problem or motivation**
A fresh web server must discover, read, edit, and deliver protected
installed skills using the same database, object storage, secrets, and
supported application artifacts. It must not need its predecessor's
files or process memory.
**Proposed solution**
Use `managed` ownership with a null source locator. Read installed
content by immutable version. Prepare packages before a short
publication transaction. Persist execution selections before
materialization. Recover exact pinned runtime assets and reject deletion
while active or recovering pins exist.
**Alternatives considered**
Reconstructing a mutable installed directory preserves the old
source-of-truth ambiguity. Permanent dual writes create two competing
authorities. This change uses one managed model after a bounded legacy
conversion.
**Roadmap alignment**
This improves the existing Skills Manager, Studio, version history, and
Cloud execution capabilities. The maintainer supplied the implementation
contract. This does not add a separate skills product or deploy fleet
changes.
Related work: #18082 supplies immutable package storage. #17273
addresses edits outside the API for linked local skills; this PR keeps
that source category separate. #2648 is a closed earlier
ephemeral-filesystem proposal.
## What Changed
- Add managed ownership and focused content publication and execution
materialization modules. Keep the archive format and package storage
tables.
- Publish managed create, save, delete, fork, rename, restore, and
catalog content with version checks. Add durable create receipts.
Preserve file-save receipt responses.
- Return file version identities. Keep Studio drafts after a conflict
and provide an explicit reload action. A delayed reload cannot overwrite
newer typing or navigation.
- Persist exact runtime selections, including empty selections. Rebuild
pinned assets and verify their admitted digests on a replacement server.
- Preserve source access on forks and disconnected copies. Keep the
existing workspace policy category for managed skills.
- Add bounded conversion, eligibility, and independent verification
phases. Load persisted Cloud configuration in the standalone CLI without
seeding or changing it. Reject partial current versions against
installed inventories; recover only complete saved content or the exact
source. Document storage migration blockers and the compatible rollback
floor.
- Add separate-process PostgreSQL/S3 qualification and update domain,
retention, policy, and UI regressions.
- Pass the plugin worker manager into Studio execution, admit restricted
`skill_test` mode through native Runner contracts, and preserve admitted
scope across native and REST tools. Native tests cannot create ordinary
tasks, browse company data, or use external tools.
- Select the exact durable Studio revision even when unassigned or Beta
skills is off. Persist Studio output and audit atomically with native
task completion, preserving the result on replay.
## Verification
- Final revision `13e8af480b88ba6fea5737bac4bd81104d604792` passed full
CI: all 49 workflow jobs completed successfully ([run
41127396098](https://github.com/paperclipai/paperclip/actions/runs/41127396098)).
This includes typecheck, test suites, Runner checks, browser checks and
build. Greptile review 15 is 5/5 on that same revision, with zero
unresolved threads. The PR is ready for review.
- Local workspace typecheck and build passed after integrating master.
Focused checks passed: 33 execution/completion cases, 52 Runner HTTP
cases, 16 managed-content cases, 17 Studio cases, the new real-process
CLI regression, map checks and UI token gates. The CLI regression proves
inspection does not seed missing Cloud configuration. Server typecheck
passed after that fix.
- The independent-process PostgreSQL/S3 matrix passed through normal
HTTP skill routes. It covers A → B → C replacement, lost commit
responses, upload crashes, concurrent saves, binary contents and
executable delivery. Metadata listing and warm selected delivery retain
zero object downloads. Local timing measurements are recorded; they do
not establish hosted latency.
- Hosted A → B → C passed on the owned disposable test tenant with
external Postgres, S3 and a real remote Paperclip Computer. Predecessor
temporary homes were absent. C read and executed B's acknowledged
managed save. New runs used repository v1 while v2 was installed. Hashes
matched an independently checked exact upstream commit.
- Compatible image rollback to `6518b323` passed. Studio retained the
unassigned fork's C save. A fresh remote run executed the newer managed
content and historical repository pin. The actual shell event confirmed
expected hashes, stdout, exit 0 and mode 0555.
- Runtime candidate `9200e3fcb4` deployed successfully ([Cloud run
41124147876](https://github.com/paperclipai/paperclip-cloud/actions/runs/41124147876)).
The final Studio test delivered only the unassigned fork's exact v3,
executed its script and persisted a successful output snapshot.
Independent command-event inspection confirmed all three hashes, stdout,
exit 0 and mode 0555. All 14 installations were version-backed.
Independent verification checked all 25 versions: 23 remote objects, two
bundled database snapshots, zero blockers.
- The deployed image is `9200e3fcb4`. Later master integration, the
client-only delayed-reload draft guard and the CLI bootstrap have
separate automated proof. The CLI bootstrap was also exercised against
the tenant's stored configuration and storage through the same read-only
services. This PR does not claim that the deployed image is the final PR
revision.
- Live Studio checks exposed worker wiring, admission, access scope,
exact selection and completion-publication gaps. They are fixed. Failed
attempts remain in the evidence. The full local suite exceeded 80
minutes under host contention and was stopped. Later combined/isolated
local attempts also timed out; they are not counted as passes. Full CI
covers the integrated suites. Earlier CI found an obsolete restart-scope
fixture, which was corrected and passed all 52 HTTP cases.
- Reproduction and migration:
[`doc/skill-ephemeral-web-servers.md`](doc/skill-ephemeral-web-servers.md).
Source revisions, deployments, versions, run IDs, hashes and failure
history:
[`doc/plans/2026-10-30-ephemeral-web-skills.md`](doc/plans/2026-10-30-ephemeral-web-skills.md).
## Risks
- Legacy conversion requires stopped admission and retired
filesystem-authoritative writers. Pre-conversion binaries are not
supported rollback targets afterward.
- Cloud readiness requires remote object storage. Local provider
receipts and provider mismatches remain blockers until objects are
copied and verified.
- Linked local sources retain filesystem semantics and are outside the
cloud guarantee.
- Cold reads still fetch the existing archive format. Warm runtime
preparation retains the verified-cache path.
- Bundled reconciliation preserves an installed head. Existing release
snapshots remain selectable. An older server must not replace a newer
head with its shipped files.
- No production volumes, fleet defaults, or general deployment
coordination change in this PR.
## Model Used
OpenAI Codex, GPT-6 family, with reasoning, repository tools, code
execution, and browser use. The exact backend model ID and
context-window size are not exposed in this session. No subagents were
used.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
---------
Co-authored-by: Paperclip <noreply@paperclip.ing>
Dotta