Retry the normal Agents link within a bounded deadline and use the ordinary dismissal control if the asynchronously loaded announcement covers it. Preserve the company-isolation and history assertions.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Reproduce the page/sidebar mismatch after a real manual switch and browser history navigation. Dismiss covering announcements through the normal UI. Preserve dense ZIP bytes with a CRC table and bound cold CLI health inside the existing setup budget.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Co-Authored-By: Paperclip <noreply@paperclip.ing>
* codex/hermes-native-runner:
fix(ui): scope canonical agents to their authorized company
test(server): drain runtime writes and load routes in setup
Co-Authored-By: Paperclip <noreply@paperclip.ing>
* codex/hermes-routines:
fix(ui): scope canonical agents to their authorized company
test(server): drain runtime writes and load routes in setup
Keep alias caches and redirects on the agent company. Defer remembered UUID paths until canonical resolution and verify organization switching with a delayed public alias response.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Hash all three Hermes setup inputs. Keep the PR below the review limit by moving the unchanged public setup and account-cache test files to the stacked qualification follow-up.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Require saved image checks to pass after account and billing evidence is collected. Advance the explicit image definition to version 2.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Bind the expired card to its original unanswered request and require the canonical zero-answer cancellation result. Preserve the failed live measurement and advance qualification definitions.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Bind usage to the admitted native session and turn before cancelled prompt settlement. Check its durable PRP carrier and harden qualification receipt identity and budget capture.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Use the canonical question converter for durable fallbacks. Retire pending native input only on its confirmed cancelled turn. Pass cancelled status to shared account and billing checks and retain the original browser acknowledgement before polling.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Use the canonical saved question presentation when submitting recovery answers and record current Mac qualification evidence.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Preserve file-level provisioning evidence before cleanup without weakening reviewed closure admission. Record the original cloud failure and the passing current-source native fixtures on macOS 26.5.2.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Build both native targets on standard cloud runners. Keep fixtures credential-free, validate host and binary architecture, and publish exact source, runtime, tool and binary provenance for acceptance without local Rust builds.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Capture pinned SDK wire attempts, carry closed versioned receipts through ACPX and PRP, and bind reported subtotals to native turn accounting. Keep incomplete attempts unpriced and require settled cost plus budget health in the live OpenRouter oracle.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Map GEMINI_API_KEY only for the selected paid matrix credential. Extend the trusted-workflow credential checks to prevent ambient Google secrets in unapproved workflows. This fixes the reviewed Google cells startup failure.
Validation: all 15 workflow security tests, actionlint, and diff checks pass.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Require one attempt and public readback of scoped 200-cent company and agent budgets before the paid API task is created. Reject unlimited or foreign budget records. Preserve unknown usage as unknown.
Record all five successful paid Linux browser workflows and verified temporary AWS host/access cleanup. The complete support suite passes 1,833 Vitest tests and 128 Node assertions, with one skipped Vitest test. Product E2E TypeScript and diff checks pass.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Add ten explicit pending API-account browser cells and independently grade the selected account, native harness, and exact model. Keep fixture credential staging on the shared Connections path. Carry candidate metadata into CI so every selected Hermes profile receives verified runtime assets before secrets.
Record the private AWS image build and three actual Linux browser passes without promoting Hermes. Product E2E support typecheck and all 102 affected tests pass; the broader support suite passed 1,826 Vitest tests and 128 node assertions before the final oracle refinements.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Trigger credential-free Linux native fixtures for shared Runner sources, Rust and build manifests, dependency patches, and workspace inputs. Verify actual glob matching for attachment, backend, transport and dependency changes. Paid workflow authority is unchanged.
Validation: 15 workflow security tests and actionlint passed. Also record 26 passing real-database authority tests, the expected old-lock negative proof, and 143 passing ACPX lifecycle regressions.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Remove group/world write bits from the dedicated CI job's Node interpreter,
matching the protected paid workflow setup. Preserve the Rust launch verifier
and record the first Linux fixture result and interrupted PR checks.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Give Hermes native session opening a 60-second bound for verified private
runtime copying and ACP initialization. Allow controller startup and per-turn
restoration overhead while preserving ordinary command and stop deadlines.
Add delayed-admission regressions and credential-free Linux native fixture CI.
Record the failed final-head paid campaign without promoting qualification.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Select candidate assets consistently for immutable image identity and remote packs; provision local Linux assets before the protected paid step exposes credentials. Preserve default-branch dispatch and qualification gates.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Keep history reconstruction without publishing restored text and tools as live output. Version the changed Cursor contract as profile 16 and retain replay compatibility.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Reject replaced learned-state parents, include authenticated run attachment and the advertised native transport fixtures in this candidate. Keep paid browser campaign definitions in the qualification PR.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Add a personal primary agent per company and user. Initialize it from the first human-created agent, expose profile-only switching with confirmation, and use it after recent choices for task and Chat defaults.
Persist authenticated preferences, preserve lifecycle and membership rules, keep selections out of shared audit events, and document the API contract. Include the reviewed Storybook surfaces and regression coverage for concurrent choices, onboarding, cross-device updates, and browser journeys.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
## Thinking Path
> - Paperclip coordinates work for AI agents through server-managed
tasks and heartbeats
> - Signoff policy tests exercise stage transitions that wake the next
participant
> - A stage transition can defer a wake while the previous run still
holds the issue execution lock
> - The test helper used a fixed wait and could fail before the server
released that lock
> - This pull request waits on the server deferral signal and verifies
the returned run identity
> - The benefit is a stable test with clear failure details and no
repeated wake request
## Linked Issues or Issue Description
**What happened?**
The signoff policy end-to-end spec failed intermittently with `No
issue-bound heartbeat run became available for agent <id>`. The server
had deferred the wake while another run held the issue execution lock.
**Expected behavior**
The test helper waits for the named blocking run to finish, then reads
and verifies the new run for the requested agent and issue.
**Steps to reproduce**
1. Run `npx playwright test --config tests/e2e/playwright.config.ts
tests/e2e/signoff-policy.spec.ts`.
2. Exercise a signoff stage transition while the previous stage run
still holds the issue execution lock.
3. Confirm that the helper waits on the server deferral signal and
returns only a matching run.
This change relates to [PR
#11299](https://github.com/paperclipai/paperclip/pull/11299), which also
touches the signoff policy end-to-end spec.
## What Changed
- Call the wakeup endpoint that reports the server deferral reason.
- Wait for the named blocking run instead of using a fixed delay.
- Verify that each returned run belongs to the requested agent and
issue.
- Bound read and wait loops and report the last server signal and lock
fields on failure.
- Keep one wakeup request per helper call.
## Verification
- `npx playwright test --config tests/e2e/playwright.config.ts
tests/e2e/signoff-policy.spec.ts` passed locally.
- All five signoff policy cases passed locally.
- The spec keeps all 60 assertions.
- The diff contains only `tests/e2e/signoff-policy.spec.ts`.
- The full CI end-to-end shards must pass before merge.
## Risks
- The helper now depends on the wakeup endpoint's deferral fields.
- A server change to those fields can fail the test with a named
diagnostic.
- The change affects end-to-end test behavior only.
## Model Used
OpenAI GPT-5 Codex, exact runtime model `gpt-5-codex`, with tool use and
code review assistance. The runtime does not expose a separate
context-window value.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
---------
Co-authored-by: nickyleach <331803+nickyleach@users.noreply.github.com>
Co-authored-by: Paperclip <noreply@paperclip.ing>
