Commit Graph
7 Commits
Author SHA1 Message Date
DottaandPaperclip ac4f13d205 fix(e2e): report committed child blockers promptly (#18306)
## Thinking Path

> - Paperclip manages AI agents and their work.
> - Product E2E checks the ordinary onboarding conversation and its
delivered work.
> - A native run can finish successfully while its task remains blocked
for a human.
> - The onboarding journey kept waiting for such a child until the
campaign deadline.
> - This pull request reports the committed child blocker when no owned
work remains pending.
> - The journey still requires the same independent checks before it can
pass.

## Linked Issues or Issue Description

**What happened?**

An approved child can stop with a committed current-track blocker owned
by the board. Its native run succeeds, but the child task stays blocked.
The onboarding journey reports a deadline failure instead of the
observed child blocker.

**Expected behavior**

Report `onboarding_child_task_blocked` when the latest child run commits
that blocker at the child's current status version. Keep waiting for
parent dependencies and pending native or workspace recovery.

**Steps to reproduce**

Use the existing onboarding fixture with an approved blocked child. Give
its latest native run a succeeded status, committed finalization,
blocked work disposition, and the matching task status version. The old
journey waits until its deadline. The new journey fails at that settled
blocker without downloading or accepting any delivery.

Related public context: #18298. Public issue and PR searches found no
duplicate blocked-child harness fix. This change reports the failure
boundary; it does not repair artifact delivery.

## What Changed

- Check the owned child's board blocker after the existing run and
recovery checks.
- Require a unique latest producer, native committed results, and the
current task status version.
- Preserve parent dependency waits and all artifact, document, download,
link, scope, and budget checks.
- Add a behavioral regression and controls for active work, native
recovery, workspace replacement, stale versions, newer producers, and
agent-owned blockers.
- Document the distinct failure code and the existing control-plane
writers for its metadata.

## Verification

- The new behavioral regression failed on the old code with
`onboarding_first_task_deadline`; 147 controls passed.
- The current head passed all 148 onboarding tests, including the valid
agent-owner object control.
- The initial implementation passed 305 tests across all 10 Product E2E
files. The later update changes only writer links and the owner control;
its 148 focused tests and harness typecheck also pass.
- `pnpm test:e2e:runner:typecheck` passed after building the isolated
checkout's workspace declarations.
- `git diff --check` passed.
- All required CI checks passed on
`1b3bd04d193fc98d0d9f2eb3b826a4ef4bdb6dea`, including full tests and
build. They were not repeated locally. Greptile reviewed that exact head
at 5/5.
- The full Cloud journey remains unverified by these source and CI
checks. This change does not claim that the underlying artifact delivery
issue is fixed.

## Risks

The early failure depends on the public task and run projections.
Missing, stale, or ambiguous producer metadata keeps the existing
bounded wait. A pending recovery or newer producer prevents the old
blocker from ending the journey. No success requirement changes.

## Model Used

OpenAI Codex, exact model ID `gpt-6.1-sol`, reasoning effort `ultra`.
The model used source inspection, code editing, and local test tools.
The runtime did not expose its context window size. Root supplied the
model and effort metadata for this agent session.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

---------

Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-10-30 08:26:14 -05:00
DottaandPaperclip 8f50704135 fix(e2e): wait for pending native recovery (#18298)
## Thinking Path

> - Paperclip manages agents and their work.
> - Native runs can retain a bounded automatic recovery on the same run.
> - Product E2E observes those runs before it checks the delivered work.
> - The onboarding journey treated every failed run as a final failure,
even when the server had saved its next recovery attempt.
> - This pull request waits only for the explicit agent-owned native
recovery projection.
> - The journey still requires successful execution and the same
independent delivery checks.

## Linked Issues or Issue Description

**What happened?**

The onboarding journey can stop after a native turn completes without
its semantic result. The server marks that attempt failed and saves a
same-run retry. The journey rejects the failed row before the saved
retry is due. This also affects a native child that follows a proven
workspace deferral.

**Expected behavior**

Observe the saved automatic recovery within the original campaign
deadline and run cap. A pending recovery cannot satisfy completion.
Ordinary failures and exhausted, terminal, or board-owned recovery must
still fail.

**Steps to reproduce**

Use the existing onboarding fixture with a native failed row whose
nativePhase is retryable_failure. Give it the server-owned
native_session_interrupted cause, an agent-owned retry_scheduled
projection, a valid retry time, and attempt 1 of 3. Transition that same
row through reconnecting and running to success. The old journey rejects
the first row.

Related public context: #18292. A search of related native-recovery PRs
found no duplicate harness fix.

## What Changed

- Observe the authenticated native recovery state in the existing
workspace-deferral module. Require matching nonempty cause strings and
every owner, phase, attempt, schedule, deadline, scope, and successor
guard.
- Apply it to the proposal wait, failed native rows, workspace successor
tails, and final settlement.
- Keep defensive rejection of known permanent, permission-declined, and
exhausted causes. Diagnostic cause strings are not a positive retry
policy.
- Add behavioral recovery, deadline, and rejection controls to the
existing workflow tests.
- Document that this wait preserves the original campaign and final
delivery requirements.

## Verification

- Baseline workflow regression: 4 expected premature failures with 90
controls passing. The final structural calibration rejected 20 valid
pending-recovery cases before the correction, with 120 controls passing.
- Final regression: 140/140 pass, including existing and new diagnostic
causes on direct and workspace-successor paths. Known terminal,
ambiguous, malformed, mismatched, and exhausted states still fail.
- Focused Product E2E compatibility: 297/297 pass across 10 files.
- pnpm test:e2e:runner:typecheck: pass after building the normal SDK and
Runner TypeScript dependencies.
- git diff --check: pass.
- Final source passed these checks before the reviewed commit.
- Full repository tests/build and live Cloud acceptance were not run
locally for this harness-only change. Required CI run 41049692194 passed
on 04dedd7d. Live acceptance remains separate.

## Risks

The execution projection is a polling observation, not dispatch
authority. A server that never resumes can hold this wait until the
original deadline. The predicate requires matching native interruption
state and cause, an agent owner, a bounded attempt and schedule, and no
successor. Known terminal-code rejection is a defensive check, not the
authority to retry. The journey must still observe actual success and
pass its document, artifact, download, and parent-link checks.

## Model Used

OpenAI gpt-6.1-sol, ultra reasoning, inherited from the parent runtime
metadata. Context window size is unavailable. Used source inspection,
code edits, shell tools, Git, and deterministic tests.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with Fixes/Closes/Refs OR
(b) described the issue in-PR following the relevant issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links
- [x] My branch name describes the change and contains no internal
Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

---------

Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-10-30 06:55:41 -05:00
DottaandPaperclip 7a7ade4b93 test: require real onboarding result links (#18288)
## Thinking Path

> - Paperclip lets people assign work to agents and use their saved
results.
> - The Cloud onboarding journey tests this handoff through a real
parent and child task.
> - The child can publish a correct file while the parent names that
file without linking it.
> - The existing journey correctly rejects that reply because the user
cannot download the named result from it.
> - This pull request makes the scripted parent request explicit about
real Markdown links and returned attachment paths.
> - The independent artifact and parent-link checks remain unchanged.

## Linked Issues or Issue Description

Refs #18266 and #18258.

**What happened?**

A Cloud onboarding attempt produced a correct child artifact and saved
document. The parent then named the child, document key, and filename in
inline code. It omitted the attachment URL. The attempt failed with
`onboarding_parent_result_links_missing`.

**Expected behavior**

The parent's final reply must link the saved child results. The file
link must use the real published attachment reference.

**Steps to reproduce**

Run the existing explicit Cloud onboarding journey. A reply that only
names the file must remain a failure, even when the child artifact is
correct.

**Paperclip version or commit**

The branch starts from `965184d2968f40b1183803529b88f288264c832f`.

## What Changed

- Ask the parent for real Markdown links in its final reply. Use the
published attachment's returned content or download path. Do not invent
IDs or URLs.
- Add a filename-only reply to the existing negative oracle cases.
- Document this scripted fixture requirement.

## Verification

- Focused onboarding tests: 79 passed.
- Shared task, campaign, and contract tests: 66 passed.
- Existing artifact and native-completion Node checks: 137 passed.
- `git diff --check`: passed.
- Harness typecheck, `pnpm -r typecheck`, and `pnpm build`: passed after
building the existing workspace dependencies. The initial
missing-declaration and local-IPC setup failures remain recorded.
- The full local database test suite was not rerun. Required repository
CI runs the broader suites on Linux.
- Required repository CI passed on the exact PR head. No paid model
calls or Cloud operations were run for this patch.
- [Initial
CI](https://github.com/paperclipai/paperclip/actions/runs/41027635545/attempts/1)
failed one unchanged retention timing test (3310 ms versus the strict
3000 ms bound). The unchanged case passed once on an isolated local
Postgres17 fixture. One failed-jobs-only rerun passed in [attempt
2](https://github.com/paperclipai/paperclip/actions/runs/41027635545/attempts/2).
The original failure remains visible. No timing threshold or retention
source changed.
- The previous live attempt stays failed. Local tests do not prove that
a model follows the revised request. A new bounded live attempt must
establish that result.

## Risks

- The extra instruction can still be ignored by a model. The unchanged
oracle will reject missing links.
- This changes the fixture definition hash. Historical attempts retain
their original source and result.
- No product runtime, API, approval policy, model profile, budget, or
cleanup behavior changes.

## Model Used

OpenAI `gpt-6.1-sol`, ultra reasoning, with code execution and
repository tools. Model metadata was confirmed in the parent task. The
context window size is not exposed.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-10-30 04:01:33 -05:00
DottaandPaperclip 3bd0d81c7b fix(e2e): follow proven workspace deferrals during onboarding (#18008)
## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work.
> - Product E2E journeys verify the user outcome through the browser and
scoped APIs.
> - An onboarding child can wait while its parent owns their shared
workspace.
> - The server records that no provider work started and schedules a
durable replacement.
> - The journey rejected that expected wait, and feedback counted it as
unknown legacy execution.
> - This pull request follows the exact replacement and records the
distinct no-provider evidence.
> - The child must still finish through native execution and produce the
independently checked download.

## Linked Issues or Issue Description

Refs #17940.

**What happened?**

The fresh-workspace journey failed with `onboarding_first_task_failed`
when a child encountered shared-workspace contention. The cancelled
admission had an explicit `workspace_wait` receipt with
`providerWorkStarted: false`. Its linked replacement was still
scheduled. The runtime had not been selected. The default `legacy` value
did not represent a provider execution.

**Expected behavior**

Keep both rows and their run-limit cost. Follow only the unique
replacement for the same company, agent, and issue. A pending
replacement must not pass. Real failures and contradictory execution
evidence must still fail.

**Steps to reproduce**

1. Start a native onboarding parent and accept its child-task proposal.
2. Observe the child admission while the parent still holds their
workspace.
3. Present the server's no-provider cancellation and its durable
scheduled replacement to the journey and feedback collectors.

## What Changed

- Add a shared predicate for the explicit no-provider workspace-deferral
receipt. Reject runtime, process, output, usage, and cost evidence that
contradicts it.
- Follow exact, unique retry lineage during onboarding. Wait for active
or scheduled replacements without repeating browser actions. Preserve
the campaign deadline, run cap, native artifact attribution, and
download oracle.
- Retain per-run feedback inspection classifications: `native_events`,
`provider_not_started`, or `incomplete`. Require exhaustive event reads.
Keep pending work and uncertain execution partial.
- Add causal regressions and document the evidence contract. Historical
failed attempts keep their original grades.

## Verification

- Red: the new journey regression failed with the observed
`onboarding_first_task_failed` before the repair. The new feedback cases
also failed before the repair.
- Green: 70 journey tests and 74 feedback-family tests passed. The final
affected journey/feedback gate passed 275 tests plus 137 Node checks.
Five retry-lane reset cases failed before the review correction and
passed after it.
- `pnpm test:e2e:runner:typecheck` passed after the retry-counter
correction.
- `pnpm -r typecheck` and `pnpm build` passed before the final rebase.
- The full local `pnpm test:run` and harness unit gate encountered
embedded PostgreSQL startup failures. The harness gate passed 4,574
tests and failed its database-startup test. The final focused
journey/feedback gate and all 137 Node checks passed. CI will provide
independent full-suite results before merge.
- Current-head CI passed 55 checks; two checks skipped and one was
neutral. Greptile is 5/5, with zero unresolved review threads.
- Live Cloud verification will use the reviewed harness and Operations
revisions. This PR does not claim that a fresh Cloud campaign has
passed.

## Risks

A broad cancellation exemption could hide real failures. The exemption
requires the server's explicit receipt, unresolved runtime selection, no
contradictory execution evidence, and exact durable lineage. Missing
successors remain pending until the existing deadline. A successful
native child and valid downloaded bytes remain required. No server
behavior, approval policy, or budget policy changes.

## Model Used

OpenAI Codex, `gpt-6.1-sol`, with reasoning, source inspection, tool
use, and code execution. The host does not expose its configured
context-window size.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

---------

Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-10-28 07:58:41 -05:00
DottaandPaperclip d40f9ac377 fix: enforce first-task completion decisions and retain E2E evidence (#17940)
## Thinking Path

> - Paperclip lets people delegate work to agents and approve proposed
work.
> - The onboarding first task asks for scope, proposes a task, and waits
for a human decision.
> - An answer to its opening question supplies scope. It does not
approve a proposal.
> - Task creation already checks the saved proposal decision.
> - Native completion used the general completion policy and could mark
the onboarding parent Done without that decision.
> - This PR checks the trusted decision before completion feedback and
again when the native status is committed.
> - The first task stays in review until a saved human decision permits
closure. Ordinary completion and acknowledged refusal keep their current
behavior.
> - The Product E2E guard also retains closed scalar evidence so future
failures show which boundary condition was observed.

## Linked Issues or Issue Description

Refs: #17914. Profile compatibility follow-up to #17922.

**What happened?**

A native onboarding run can submit a valid low-risk Done result after
only the opening answer. The native finalizer then marks the first task
Done even though no human has accepted or rejected a proposal.

**Expected behavior**

The opening answer must not permit completion. A trusted saved proposal
decision must permit it. A saved rejection permits acknowledgment and
closure, but does not authorize new work. A later pending proposal must
keep the task in review.

**Steps to reproduce**

Create a server-owned onboarding first task with an answered opening
question, no proposal decision, and a valid low-risk completion
contract. Pass a Done result through native completion feedback, the
control-plane port, and the finalizer. Before this fix, the persisted
status is Done. The regression expects In review. Ordinary completion
and acknowledged rejection pass as controls.

## What Changed

- Share the trusted latest-proposal and human-response checks with
completion admission. Keep task creation acceptance-only.
- Refuse premature native completion feedback. Keep an already saved
premature result in review during finalization.
- Check the decision again under the existing task and run locks before
committing Done.
- Cover accepted decisions, saved refusals, forged context, pending or
changed proposals, and a real database race.
- Retain a closed scalar receipt when the existing E2E pre-acceptance
guard fails. Validate and display it without task content, IDs,
filenames, or raw rows. Preserve the original failure, blocked
dependents, and historical reports.
- Include the evidence module in the journey definition hash. Bind the
receipt to its exact failure code and check its closed keys against the
full type.
- Repair base-branch profile drift found by the full harness check:
include the active Copilot v66 fixture in image hashing and update stale
Pi version/hash expectations from #17922. Keep all older image inputs
and strict hash checks.
- Update the onboarding feature and agent access maps and E2E evidence
documentation.

## Verification

- Semantic regression before implementation: one failure and two passing
controls on PostgreSQL 18. The failed assertion observed Done instead of
In review.
- The local database uses an owned disposable container with an
immutable image digest. Actual migrations, feedback, control-plane port,
finalizer, and status commit run against PostgreSQL. A temporary test
adapter replaces only the embedded database transport because this host
has exhausted its PostgreSQL semaphores.
- Native control-plane suite: 55 tests passed, including 17 new
controls. Existing task-creation admission: 25 passed. Existing
completion feedback: 19 passed.
- Credential-free E2E support: 206 Vitest suites passed, 4,407 tests
passed, and two skipped. All 137 Node support checks passed. Harness
typecheck passed.
- The failure-receipt regression had 11 failed assertions before capture
was implemented. Two failure-code binding assertions fail without their
gate. Eight placement/binding cases first validate the receipt-free
control, then reject the misplaced receipt.
- The untouched base reproduced the three profile compatibility
failures. The narrow repair passed all 83 affected tests before the full
harness run.
- Private workflow preparation and credential-free onboarding preview:
nine compatibility checks passed. Ownership, recovery, evidence,
shared-contract and workflow compatibility: 77 passed. The actual
provider preview also confirms immediate success deletion, earlier
declared failure eligibility, limits, and zero retries without
credential access. Map checks and git diff checks passed.
- Required repository typecheck passed for the product fix. The combined
branch build passed. The local full repository suite was stopped after
repeated PostgreSQL startup failures; a separate initdb probe confirmed
host SysV semaphore exhaustion. No shared IPC resources were changed.
[Hosted
CI](https://github.com/paperclipai/paperclip/actions/runs/40591020873)
passed the full database suites, typecheck, build, runner checks,
serialized suites, and browser shards on final head
`1ac4c23605a03bfd1f1f8a017b14ce29fda85f6b` (55 success, two expected
skips, one advisory neutral).
- Independent source review approved the product guard, atomic race
regression, evidence contract, and maps with no actionable findings.
Both automated reviews are 5/5 on final head
`1ac4c23605a03bfd1f1f8a017b14ce29fda85f6b`; prior findings are fixed and
resolved. Final CI is green and the PR is conflict-free.
- No Cloud workspace, provider call, release publication, or deployment
is part of this verification. These tests do not identify a historical
Cloud failure or qualify live onboarding.
- Local dependency installation uses the existing CI-generated lockfile
from #17811. No lockfile change is included.

## Risks

- Existing onboarding runs without a trusted saved proposal decision
remain in review even when the agent reports success. This is the
intended approval boundary.
- Decision changes can race completion. The status commit checks the
decision under its existing locks and uses the existing status-race
recovery path.
- A saved refusal permits closure only. Creation admission still rejects
it.
- Evidence readers reject malformed receipts and unrelated failure
codes. The version-1 key registry is checked against every receipt field
at compile time. Existing attempts do not gain evidence after the fact.

## Model Used

OpenAI GPT-6.1 Sol (`gpt-6.1-sol`), ultra reasoning, through Codex. Used
repository inspection, code execution, and collaborating coding agents.
The runtime did not report a context-window size.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes:` / `Closes:`
/ `Refs:` OR (b) described the issue in-PR following the relevant issue
template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub references)
- [x] My branch name describes the change and contains no internal
ticket or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

---------

Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-10-27 17:07:50 -05:00
DottaandPaperclip a967d479bd fix(e2e): retain verified onboarding artifact evidence (#17370)
Retain the bounded verified onboarding download and independent oracle in
private normalized results before cleanup. Preserve the receipt when later
readback or trace checks fail without marking the journey as passed.

Refs #17262. Refs #17253.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-10-23 14:23:08 -07:00
DottaandPaperclip 5ef385f7e6 Run reusable Product E2E journeys across deployment targets (#17262)
## Thinking Path

> - Paperclip manages agents and their work.
> - Product E2E tests check complete user journeys.
> - The current harness prepares self-hosted instances.
> - Hosted workspaces need separate authentication, setup, and cleanup.
> - The same in-app story should run on either deployment.
> - This pull request adds deployment targets and explicit
prerequisites.
> - The private Cloud adapter owns fleet access and lifecycle
operations.

## Linked Issues or Issue Description

**Subsystem affected**

Product E2E harness, fixture registry, and reports.

**Problem or motivation**

Self-hosted test setup cannot qualify a deployed Cloud workspace.
Copying each story into a second harness would make its assertions
diverge.

**Proposed solution**

Add explicit deployment targets, setup recipes, and ordered campaigns.
Reuse a no-model task-properties story on both deployments. Let fresh
Cloud onboarding provide verified context for that same story. Keep
Cloud lifecycle and credentials behind a private target provider.

**Roadmap alignment**

This supports Cloud deployment qualification and the existing agent eval
system. It adds no application endpoint or scheduler. Related work:
#17112. The separate onboarding gateway UI prerequisite is #17253.

## What Changed

- Add explicit target configuration and a credential-free preparation
preview. Keep historical selectors and the current `--all` matrix
unchanged.
- Resolve requested fixture prerequisites, including a run-owned backlog
task prepared before measurement. Reuse verified onboarding context
without counting recipe setup as onboarding coverage.
- Add task assignment persistence and the actual onboarding parent/child
first-task journey, with an independent artifact oracle and native trace
requirement.
- Preserve failed boundaries and blocked dependents, deployment
identity, costs, phase outcomes, and private evidence in the existing
dashboard.
- Validate success assertions and accounting before successful cleanup.
Bound collection by the campaign deadline and cleanup/evidence hooks by
a separate ten-minute grace, with cancellation and stop-only fallback.
- Stage dashboard rendering separately so a timed-out renderer cannot
overwrite retained failure results. Add evidence finalization hooks so
the private provider can save evidence before target deletion and lease
release.
- Reject private journey bundles in the public history publisher.
Browser-only results have no model or provider.

## Verification

- The unchanged task-properties story passed on managed self-hosted and
a registered testing Cloud workspace. Authentication, setup, journey,
collection, and cleanup passed. Model calls: zero. Earlier attempts
remain private and retained.
- Final journey and report tests: 96 passed in eight files. Catalog
compatibility: 39 passed. The wider focused run exposed three stale
master catalog expectations; these now match the already shipped
case-handoff v4 metadata and four-cell matrix. The default 385-cell
selection is unchanged.
- Review regressions reproduced premature success for a zero-request
receipt and a missing required assertion. Both now fail before success
cleanup while retaining cost receipts. The initial lifecycle fixes
passed 33 checks. A subsequent review exposed a late renderer write that
could erase saved failures; rendering now writes into isolated staging
and publishes HTML only after it settles. Combined campaign,
fixture-contract, and retained-report checks: 67 passed, including late
writes, delayed timer callbacks, stalled collection, release, stop,
evidence hooks, and browser close. Harness typecheck passed after the
fixes.
- A broader harness unit attempt completed 3,601 passing cases, two
failures, and two skips. The failures exposed a stale Pi count and an
omitted active Copilot fixture in the Daytona image input closure. The
focused compatibility fixes passed 83 tests. After all source fixes, the
full harness support suite passed: 160 files, 3,621 tests, two skips,
plus 128 native-source checks. The earlier failures remain recorded.
- Harness typecheck, repository typecheck, repository build, map checks,
and Storybook catalog checks passed on the rebased branch.
- The required full `pnpm test:run` attempt timed out after 35 minutes.
It had 1,195 completed passing cases and one chat integration failure
before its first suite completed. That case and nine adjacent cases pass
in isolation. The original failure remains unresolved and retained; this
is not a full-suite pass.
- Current-head remote checks
(`39b2a1ed8c49222fabd1ba8e225cac81bff5c6f7`): 53 passed, two skipped,
none pending or failing. Greptile completed successfully at 5/5 with no
unresolved review threads.
- Fresh paid Cloud onboarding, dependent reuse, and disposable cleanup
have not been qualified live. They require deployment of the separate UI
prerequisite and actual Cloud gateway budget admission. The trusted
Cloud workflow remains disabled.

- Final live verification at `39b2a1ed8c`: the unchanged shared story
passed on managed self-hosted and the registered testing Cloud stack
using the prepared backlog-task recipe. Both cleaned up successfully
with zero model calls. Independent private S3 checks confirmed final
evidence and released QA identity/stack leases. Cloud evidence remains
private.

## Risks

- A deployed UI or Cloud control-plane change can invalidate selectors
or provider contracts. Version drift fails the attempt.
- Cloud evidence and lifecycle recovery are private-provider
responsibilities. A pending cleanup or evidence upload must keep the
target unavailable for reuse.
- No release is deployed or pinned by this change. No automatic story
retry is added. The initial pilot retains its explicit $10, one
disposable workspace, and 30-minute bounds.

## Model Used

OpenAI GPT-6 through Codex, with reasoning, repository tools, code
execution, and delegated agents. The runtime does not expose a more
specific deployment model identifier or context-window size.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [ ] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

---------

Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-10-23 06:27:49 -07:00