Reconcile the actual squash ancestry while preserving the complete qualified recovery and upstream source tree.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Co-Authored-By: Paperclip <noreply@paperclip.ing>
* commit '45c6a9b8352b12262027dab3aca7d9cfcd919d60':
feat(workspaces): keep remote files off the webserver disk (#18403)
Co-Authored-By: Paperclip <noreply@paperclip.ing>
* commit '5e4cc0107324f1af9432d3f1f40e9ecf2e742bd9':
feat(workspaces): keep remote files off the webserver disk (#18403)
Keep native sandbox workspace files independent of the webserver disk. Use encrypted saved versions and Postgres ownership so a replacement server can recover files and continue work. Enable the path by default for new eligible workspaces when durable storage is configured.
Preserve explicit opt-outs and existing host workspaces. Include safe snapshot repair, Files access, import, migration and retention. Bound saved-Files resources, preserve imported Git recovery, reject unfinished Git operations, publish immutable concurrent captures, and verify permanent object-version deletion.
Validated 471 targeted local controls, build/typechecks, all 40 CI partitions, fresh Greptile 5/5 and security review. The PR records original failed attempts and scoped retries.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Resolve the current identity only on admitted work, retain unchanged connector negotiation, and replace removed or rotated identity configuration. Prove real signed enrollment and encrypted event delivery without recreating the registered worker or adding idle polling.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Preserve all qualified backup blobs and exactly the eight incoming runner E2E test and documentation paths.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Keep provider activation signals and external refresh intent in the same owning transaction. Preserve all other qualified owner and incoming master blobs.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
## Thinking Path
> - Paperclip is the open source app people use to manage AI agents for
work.
> - Product E2E journeys test the browser, native work and saved
outcomes on a selected deployment.
> - The Stop journey must interrupt real work before it sends a new
direction.
> - Its old boundary accepted a turn-start event before any command or
usage report.
> - A stopped attempt with incomplete usage correctly blocks later work
under the existing budget policy.
> - This pull request waits for a live native command and bound usage,
then checks actual accounting settlement before it sends the redirect.
> - The provider reports first usage after its initial command
completes, so the fixture finishes a harmless readiness call before the
long interruptible hold.
> - The benefit is a stronger test of Stop and continuation with the
same three-run limit.
## Linked Issues or Issue Description
Refs: #18098, #18345, #18354. Related accounting work: #18035.
Integrated upstream prerequisites: #18387, #18465 and #18409. Duplicate
selector PR #18472 was closed as superseded by actual merged #18409.
**What happened?**
A QA attempt clicked Stop soon after a native turn started. The owned
event stream had no command or usage report. Its cancelled run retained
incomplete accounting. The saved redirect received a skipped wake, and
no third run started. The budget guard must keep that missing usage
visible.
**Expected behavior**
The journey must first prove that actual native work is active and that
its current turn has reported complete usage. The fixture must finish a
harmless readiness command before it starts a separate bounded hold.
After Stop and physical cleanup, it must verify a complete accounting
receipt and saved settlement before sending the redirect.
**Steps to reproduce**
The fresh staging attempt failed before Stop because its first 90-second
command ended before the provider emitted its first complete usage. Its
only later eligible commands lasted less than one second. The controlled
browser sequence reproduces that ordering without accepting it.
Completed readiness usage followed by a separate still-active hold
qualifies under the unchanged oracle. Startup alone, command alone,
usage alone, partial usage, incomplete accounting and a missing
settlement timestamp still hold the next action.
## What Changed
- Request a harmless `printf` readiness command first. Wait for its
result, then request `sleep 90` exactly once in a separate shell call
before file edits. This gives the provider an opportunity to emit
current-turn usage before the interruptible hold.
- Reuse the strict native-command observer. Require a bound current-turn
complete usage report with valid nonzero token counts. Reject stale,
partial, foreign and semantic-tool evidence.
- Wait for the stopped run's complete accounting receipt,
`accountingReceiptReady: true`, `costAccountingPending: false` and a
valid saved settlement time before redirecting. A receipt already ready
before Stop is intentional only when the exact cancelled run is actually
accounted with no pending debt; no source/sequence advance or callback
clock order is assumed.
- Exclude canonical raw, partial and complete `item.completed` usage
only when the API row and PRP envelope match the authoritative owned
run, company and agent, and their source event ID, instance ID and
positive sequence agree. Missing context keeps the strict work check. A
self-consistent accounting source can change after Stop. Keep the
original snapshot and reject real tools, turns, messages and other item
events, including productive output from a new source.
- Retain private boundary and accounting proof. Source and sequence
observations do not impose unsupported controller or clock order.
Include the new oracle in the suite definition hash. Keep existing
success-check IDs, exact three runs, model, budget, deadline, Stop proof
and final outcome checks.
- Reuse one binding validator in the active-work boundary and post-Stop
filter. Pre-Stop keeps its current Runner/current-turn restriction. Add
focused evidence tests and a standalone Chromium/control-API sequence
check. The optional pre-Stop hook leaves existing classic callers
unchanged; they do not call the accounting filter.
## Verification
- Current source is `47578138ad357fc11b8b346bfada36d6aa5ab484`, one
narrow fixture commit on reviewed
`b9668ccfba61c59eb496ba18269aee06e2921d8f`. Only the prompt constant,
two ordering controls, the existing Chromium sequence and the journey
documentation changed. All oracle functions, run counts, model, budget,
deadline and check IDs are byte-identical to b966. There is no new
upstream merge or app change.
- Fresh staging failure is preserved in the [sanitized
report](https://pages.paperclip.ing/evals-qa-smoke-41227920892-1/). It
measured harness `5d3f143d0aed4dc7cf472b7891ea3d4d95ab843b` against app
`b7f1c3769c00a107ffe4128b48b0ef8cc452cf3f`; the reviewed Stop helpers
and its flow were unchanged in that harness. The original grade has
`stop_boundary_already_settled`, two succeeded native runs, and complete
cleanup. Authentication, setup, collection and cleanup passed; the
journey failed. This attempt remains failed.
- Causal timing evidence: the first shell command started at event108
and completed at111 about 90 seconds later. The first structured
complete current-turn usage arrived at113, after the hold ended.
Replaying the exact retained event metadata never qualifies that hold.
The only later eligible command intervals lasted about 0.90 and 0.18
seconds. The emitter publishes positive usage when the provider sends
its assistant-message usage update. The fixture now completes a harmless
first call before requesting the long hold; no usage is supplied or
invented by setup.
- On current source, all 137 focused tests and journey contracts passed.
Use `node node_modules/vitest/vitest.mjs run --config
tests/runner-e2e/vitest.config.ts
product-journeys/stop-redirect-evidence.test.ts
product-journeys/agent-evidence.test.ts
product-journeys/active-followup.test.ts native-event-envelope.test.ts
product-journeys/contracts.test.ts --maxWorkers 1`. New controls reject
every prefix when first usage arrives only after the hold completes.
They accept the same-turn sequence of completed readiness, genuine
complete usage and a separate active hold, and reject it after that hold
completes.
- Manual Chromium qualification passed: `node --import
./cli/node_modules/tsx/dist/loader.mjs
tests/runner-e2e/stop-redirect-boundary.browser.mjs`. The browser does
not click Stop for the failed ordering or completed readiness alone. It
clicks once for a separate active hold with bound usage. It sends one
redirect only after actual settlement. Foreign usage, productive output
and missing accounting still fail. This isolated control uses controlled
responses and does not call a model or the deployed app.
- Strict scoped TypeScript, maps, diff and secret checks passed. The
official credential-free Node24 QA runtime-import preflight passed
without network access. Full local E2E typing previously encountered old
borrowed workspace declarations; clean CI typecheck passed on b966. A
full local repository build/test was not repeated for this four-file
fixture change. Fresh canonical CI must supply the clean full gates.
- Historical binding proof remains valid: the exact old d499 filter
failed 17 of the final61 Stop tests. The shared validator checks
authoritative run/company/agent plus consistent row/envelope source
identity. Bound raw/partial/complete accounting is allowed after Stop,
including a consistent source change; productive output remains strict.
Pre-Stop still requires its current Runner and turn, complete nonzero
usage and a running command.
- Historical b966 CI `41224054720` passed all59 terminal checks, with
exact-head Greptile and Paperclip Review each5/5 and no open findings.
These are not approvals of current475. Current475 has fresh exact-head
Greptile5/5 and Paperclip Review5/5, with zero unresolved findings and
no omitted thread pages. Canonical CI
[`41229185200`](https://github.com/paperclipai/paperclip/actions/runs/41229185200)
passed on exact475. All59 checks are terminal:55 success,3 expected
skips and1 optional neutral review, with zero failed or pending checks.
No old job was retried. Fresh normal staging run41229965802 passed. Its
[sanitized
report](https://pages.paperclip.ing/evals-qa-smoke-41229965802-1/)
agrees with the independently read final original grade:11 checks, all5
phases, exactly3 native runs and cleanup passed. The final manifest is
complete, with cleanup complete and no pending evidence. Smoke, report
publication and Slack outcome jobs all succeeded.
- The live pass measured harness
`6be20bef6d0c5077adc1ae99562ad84e756ab167` against app
`b7f1c3769c00a107ffe4128b48b0ef8cc452cf3f`. Its Stop oracle, flow,
shared binding validator, unit cases and Chromium control are
byte-identical to reviewed475. The shared agent-flow file adds only the
hiring import and early hiring dispatch; all remaining bytes match. This
records the actual harness and app identities separately.
- Canonical run readback confirmed the first run succeeded, the second
was cancelled and the third succeeded. The cancelled run had a ready
native-producer accounting receipt, no pending accounting and a saved
settlement time. After verified file copyback, Core queued final
destruction and followed its normal five-minute cleanup backoff. The
exact lease naturally reached expired/cleanup-success with a bound
destroyed receipt before the third run started. No operator cleanup,
source change, timeout extension or workflow retry was used. The earlier
failed staging attempt remains failed.
- Current475 is ready for the normal reviewed merge and QA admission
process. Source stays frozen; merge and configuration changes belong to
that process.
## Risks
- Some provider profiles may not expose a valid current-turn usage
report while the command runs. The stronger boundary fails closed in
that case.
- Accounting may remain incomplete after Stop. The redirect stays unsent
within the original deadline. This change does not waive missing debt,
treat it as zero, raise a budget or change provider behavior.
- This repairs the test boundary. It does not prove or repair a general
provider shutdown-usage issue. A separate local late-usage ordering
control is not attributed to this QA incident.
## Model Used
- OpenAI Codex, GPT-6 family. The exact deployment variant and
context-window size are not exposed in this session. Used code
reasoning, repository tools, test execution and browser automation.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
---------
Co-authored-by: Paperclip <noreply@paperclip.ing>
Preserve all 15 qualified confirmation files and exactly the 23 incoming master UI, documentation, and test paths.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
## Thinking Path
> - Paperclip is the open source app people use to manage AI agents for
work.
> - Basic task journeys must prove that people can answer an agent and
receive saved work.
> - The question journey asks for a choice, then a typed reference, then
a saved note.
> - A native choice card can offer a real written-answer control as well
as predefined options.
> - The old observer rejected that form before a person could type the
reference.
> - This pull request accepts that explicit native control and keeps
exact answer and work evidence.
> - The separate text-only and named-tool qualifications keep their
stricter contracts.
## Linked Issues or Issue Description
Refs #18346 and #18456. The integration inherits the reviewed fixture
prerequisite #18387 and Agent Chat recovery #18465 through their actual
merged parent. The producer fix in #18456 is separate from this basic
journey contract correction. Public duplicate PR and issue searches
found no other correction for this form equivalence.
**What happened?**
The basic question journey requires the reference card to have
`answerMode: text`. It rejects a native single-select card even when its
canonical form explicitly enables a written answer. This makes the
observer test a widget shape in addition to the requested behavior.
**Expected behavior**
The person must make a real choice and type the complete reference. A
native card with an explicit written-answer control can satisfy the
second step. Selecting a predefined option cannot satisfy it. The agent
must resume the bound work and save both actual answers in its own task
document. The document must survive reload.
**Steps to reproduce**
Use the focused recording and real QuestionForm browser test in this PR.
Keep the reference as a single-select native question with one
predefined option and `customAnswer.enabled: true`. The previous grader
rejects `question-resume.forms`. The previous browser helper rejects
`single_select` before it uses the written-answer control.
**Paperclip version / commit**
Original source base `f2db909393de124caf6a5380a52d4e0e1d621661`. Current
integration `a417fd827347ed6f7998774a9de6aee70b76d867` merges exactly
`12b0cc630471ee151ec5bc8e41a34f09236d6723` into reviewed question source
`faec4ce6d775a34d303d200987e4e84d6dc26caf`. The scheduled failure on
`82d15946c5844d3ae41c6ade62fa224053f20a9a` remains a failure. Its saved
card had no canonical written-answer capability and would still fail
this change. The retained normalized events do not prove whether the
original provider flag was omitted or false.
**Deployment mode**
Attached native task journeys, including QA Cloud. This PR changes the
observer and grader. It does not change the app, provider prompt, model,
budget, timeouts, cleanup, or runtime deployment.
## What Changed
- Accept one provider-bound single-select reference card with explicit
canonical custom answers and valid, distinct options. Keep pure-text
reference support.
- Make the browser select the actual written-answer control and fill the
real rich input. Opt in only for the basic question journey.
- Keep the exact no-option typed response, immutable card, board actor,
native request and continuation, saved agent document, reload, model,
environment, checkpoints, and existing one-to-three-run checks.
- Reject missing or disabled custom capability, inferred legacy
capability, malformed or extra questions, foreign native identities,
changed cards, substituted options, and wrong or missing reference text.
- Add a real production QuestionForm and TaskChatRichInput Chromium
probe. It first selects a predefined option, then proves the helper
clears it and submits only the exact custom text.
- Document the contract correction and preserve the historical failed
attempt and its separate cleanup outcome. Keep necessary-question and
named-tool documentation qualification unchanged.
## Verification
- Before the observer change, the focused grader regression failed only
the new valid-written-reference case; the other 108 cases passed.
- Before the browser helper change, real Chromium passed the text
control and four rejection controls but failed the valid native
written-answer control at the old pure-text assertion.
- Initial focused Runner E2E unit selection at `af07f4de`: **256 passed
across 9 files**. This includes question/resumption, clarification
evidence/flow/collection/deadline, necessary question, documentation,
contracts, and report catalog tests.
- Initial real Chromium selection at `af07f4de`: **12 passed**. Six new
production QuestionForm/control checks and all six existing
document-readiness checks pass. No form or rich-input component is
mocked.
- Historical test-only head `faec4ce6d775a34d303d200987e4e84d6dc26caf`
adds a direct canonical-absent legacy `freeText` grader negative and
renders the actual legacy presentation in the browser. All four
production helper blobs remain identical to the reviewed head. A
temporary legacy inference mutant makes the new negative fail. After
restoring production source, **179 focused unit tests and all 6 real
QuestionForm checks pass**. The six document-readiness specs and their
helper are unchanged.
- Original [CI run
41205748589](https://github.com/paperclipai/paperclip/actions/runs/41205748589)
failed the staged-listen Runner handoff test; that failure is preserved
and was not retried. Its Runner source closure was identical to an
earlier passing canonical lane. The symptom also recurred on other heads
and is tracked independently; no infrastructure attribution or live pass
is claimed.
- Current integration `a417fd827347ed6f7998774a9de6aee70b76d867`
preserves **all 12 question files byte-for-byte** from faec. Every other
tracked path is identical to exact merged parent
`12b0cc630471ee151ec5bc8e41a34f09236d6723`, which contains actual
prerequisite `baf651c8d0122efc93f3ef03e891919eeb666215`. There is no
manual conflict resolution or additional production edit.
- On that integrated head: **257 focused Vitest tests across 9 files,
206 required Node source/reporter tests, and 12 real Chromium tests
pass**. Map/module-boundary checks and catalog discovery pass. The
actual `--preview` command passes with a synthetic question target and
an intentionally unavailable adapter; it performs no credential read,
adapter loading, provisioning or model call. It retains maxRuns3, a
600000ms campaign bound and zero retries.
- Exact-head [CI run
41210806950](https://github.com/paperclipai/paperclip/actions/runs/41210806950)
passes, including official typecheck, build, all eight browser shards,
both Runner Vitest lanes and aggregate verify. All 59 current PR
contexts are terminal with no failures. Fresh [Greptile
summary](https://github.com/paperclipai/paperclip/pull/18459#issuecomment-6543878408)
explicitly reviews `a417fd827347ed6f7998774a9de6aee70b76d867` at 5/5
with no findings; its exact-head check succeeds and all threads are
resolved. No fresh deployed journey pass is claimed yet.
- Catalog discovery lists the existing question journey. Map checks and
module-boundary checks pass. Diff checks pass.
- `tsc -p tests/runner-e2e/tsconfig.json` was attempted. The fresh
integrated checkout still lacks compiled Runner, plugin SDK, and adapter
declarations. The attempted local check reports 344 diagnostic lines
from dependency/type closure and zero diagnostics in all 12
question-owned paths. Official exact-head CI establishes the full
typecheck/build gates. Full repository build, typecheck, and test suites
were not repeated locally for this observer change.
- The first broad local report selection lacked the CLI loader and then
hit sandbox IPC restrictions. Locked dependency installation and an
authorized local IPC run resolved those setup errors; the full selected
256 tests pass. The initial localhost probe also needed the normal
local-listen permission.
- No fresh QA pass is claimed. The coordinator must qualify the final
reviewed runtime and harness together. Prior failed results remain
preserved.
## Risks
The basic journey accepts one additional form with explicit native
provenance. It still rejects the original closed card without a
written-answer capability. The separate producer default fix must reach
the selected remote provider pack before it can affect a deployed run.
Local browser and grader tests do not prove that artifact served or that
a model completed the live journey. Existing cleanup and physical-stop
obligations remain separate.
## Model Used
OpenAI Codex, GPT-6 family, with reasoning, source inspection, browser
testing, and code execution. The host does not expose the exact
underlying model version or context-window size.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used with available version and
capability details
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
related work above
- [x] I have described the issue in-PR following the bug template
- [x] I have not referenced internal/instance-local Paperclip issues or
links
- [x] My branch name describes the change and contains no internal
ticket or instance-derived details
- [x] I have run the selected tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation
- [x] I have considered and documented risks
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
## Thinking Path
> - Paperclip is the open source app people use to manage AI agents for
work.
> - Task conversations must show the saved instruction and recent
replies quickly.
> - Compact task reads already limit the saved message window.
> - The conversation still waits for completed run transcripts even when
a saved reply contains the result.
> - Removing that wait alone can insert activity after the reader starts
reading.
> - This pull request defers that output until the reader opens history
and keeps required output in the initial reveal.
> - The benefit is a useful conversation sooner, with a stable first
layout and a working composer.
## Linked Issues or Issue Description
Refs #17593, #18092, #18312, #18358, #18422.
**What happened?**
Opening a task with a long saved investigation can wait for native
events or legacy logs before showing its existing replies. A slow
transcript request can hold the conversation behind the loading screen
until the 15-second fallback.
**Expected behavior**
Show the bounded saved conversation without reading completed output
that already has a usable saved reply. Keep that output available
through the existing history controls.
**Steps to reproduce**
1. Create a task with many completed runs and long saved agent replies.
2. Delay its run events and logs.
3. Open the compact task directly. Before this change, the transcript
read blocks the saved replies and composer.
## What Changed
- Defer completed successful run transcripts on compact task opens when
a usable saved reply is present. Load that output through the existing
history controls.
- Keep required output on the initial path: live and failed runs,
yielded runs, pending interactions, placeholder/progress-only replies,
explicit anchors, chats, and full history. Retain output already
selected during this visit when its run completes.
- Keep saved plans visible when their owning run output is deferred or
still loading.
- Keep the same composer and draft through history expansion. Offer
**More run output** when a single saved run has deferred output.
- Position same-task comment links after their target arrives. Wait only
for a missing target, with a 15-second limit. Unrelated stalled metadata
cannot block an available target after the reveal deadline.
- Preserve the reading anchor when a queued scroll event arrives during
a properties-pane width transition.
- Add a 200-reply/200-run PostgreSQL browser fixture with a saved plan,
covering both task views on desktop and mobile. Correct stale browser
setup for current routes and the shared mobile scroller.
- Remove a random company-prefix collision in the isolated privacy test
fixture that failed during CI.
## Verification
- Final revision `fba3f2fcbb`: 386 focused thread/scroller unit cases
and all 32 production-browser journeys passed. The browser cases cover
both task views on desktop/mobile, saved plans, delayed transcripts,
history, comment links, Back, drafts, retry, avatar continuity, media
and pane resizing. The 25 privacy fixture cases also passed against
PostgreSQL.
- Workspace typecheck and full build passed with Node 24. A broader
local UI run passed 10,220 cases across 849 files before the final
navigation/plan review fixes; the changed components were then rechecked
in the 386-case focused run.
- Five alternating pairs compared master `12b0cc6304` with this
revision, using 200 long saved replies and 200 completed native runs.
Both production UI builds used the same loopback API/database, Chromium
151.0.7922.34, 1440 × 900, fresh browser contexts, service workers
blocked, no CPU throttle, and a controlled 3-second events/log delay.
Builds and other suites were stopped during measurement. No page errors
occurred.
| Useful conversation + editable composer | Baseline median (range) |
Fixed median (range) |
| --- | --- | --- |
| Cold direct open | 3.570s (3.538–3.616s) | 1.056s (1.022–1.141s) |
| Task-list navigation | 3.373s (3.342–3.394s) | 0.899s (0.885–0.915s) |
| Back | 22ms (22–25ms) | 25ms (25–28ms) |
- Median paired savings: 2.519s cold, 2.470s from the list.
Completed-output requests: two per baseline sample, zero per fixed
sample. Recent-comments API control medians were 13.6ms for both, with
ranges 12.1–18.7ms and 11.6–50.8ms. No Back improvement is claimed; an
earlier revision's run also included one 1-second Back outlier, retained
in the local evidence.
- The full local default test command did **not** pass: it stopped on
the existing chat test line-selection error. After restoring embedded
PostgreSQL library symlinks omitted by an install with scripts disabled,
Node 24 passed 672 cases in the first two chat shards, then failed to
select the third. This is separate from the passing focused suites and
remote CI.
- Earlier CI failures were addressed: the privacy prefix collision is
fixed; the delegated task-completion reply case passed locally after
merging master's reply-recovery fix (#18465). Browser fixture
corrections retain the original behavior assertions. Red tests
reproduced the loading, navigation, resize and saved-plan regressions
before their fixes.
- Map, module-boundary, token-gate and added-line token checks passed.
The full-tree token scan still finds pre-existing active-username
fixtures; this PR adds zero forbidden token lines.
- Greptile: **5/5**, final revision, all four review threads resolved.
The final-revision PR CI workflow passed, including build, typecheck,
all server/chat/workspace test shards, all eight E2E shards, and every
Runner lane. GitHub reports 55 successful checks and three skipped
checks. The separate **Paperclip Review** check remains queued with
**Waiting for the assigned agent**; it has not produced an assessment
and has not been bypassed. The branch has no merge conflicts.
## Risks
- The default compact task omits completed transcript details when the
saved result is sufficient. The reader must open history to inspect
them.
- Required structural data remains inside the initial reveal boundary.
Slow server responses for that data remain visible latency.
- Link positioning falls back after 15 seconds when its target never
arrives. The conversation remains readable.
- The measurements use a controlled local delay. They do not establish a
deployed staging speedup.
- No API, schema, authorization, or migration changes.
## Model Used
OpenAI Codex, GPT-6, with tool use and code execution.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [ ] I have run tests locally and they pass (focused suites pass; the
full default wrapper has the existing selection error documented above)
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [ ] All Paperclip CI gates are green (code CI passed; the separate
assigned-agent Paperclip Review remains queued)
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
---------
Co-authored-by: Paperclip <noreply@paperclip.ing>
Normal parent merge; only the five independently reviewed retention repair paths change. Preserve every other owner and master blob.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Normal parent merge; only the five independently reviewed retention repair paths change. Preserve every other owner and master blob.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Normal parent merge; only the five independently reviewed retention repair paths change. Preserve every other owner and master blob.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Normal parent merge; only the five independently reviewed retention repair paths change. Preserve every other owner and master blob.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Normal parent merge; only the five independently reviewed retention repair paths change. Preserve every other owner and master blob.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Normal parent merge; only the five independently reviewed retention repair paths change. Preserve every other owner and master blob.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Share the canonical human/open predicate with the feed, retain source visibility and actor authority, and preserve manual controls for existing rows. Prove ordinary retry exhaustion remains visible after a denied pre-archive.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
