Terminate tracked runtime services after each workspace-runtime test so manual-lifecycle fixtures do not leak listeners into later test runs.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Retry transient transport failures while ensuring a work-folder root exists. Preserve bounded attempts, directory confinement, and single-attempt handling for other mutations.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Keep service mocks hoisted and reuse the loaded route modules across cases. Include captured route exceptions in failed status assertions so intermittent HTTP 500s are diagnosable.
Co-authored-by: Paperclip <noreply@paperclip.ing>
Classify required repository preparation failures as workspace validation blockers and retain completed checkouts for explicit retry. Do not schedule interaction infrastructure retries for these failures.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Keep all 500 requests, shared-scan bounds, and health latency assertions while avoiding hundreds of temporary Supertest servers. Always settle requests and close the owned listener on failure.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Reuse the periodic recovery policy so an operator-cancelled run does not immediately dispatch a replacement and resume its sandbox. Keep explicit deferred wake promotion intact.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Bind remote CLI and ACP processes to host-owned cancellation scopes, wait for teardown and final saves, and distinguish deliberate bridge shutdown from transport loss.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Open up to sixteen response streams while keeping queued bodies paused and preserving ordered publication and cleanup. This addresses the storage-response waits measured on cold staging runs.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Add opt-in bounded OpenTelemetry diagnostics across host preparation, scoped files, repository checkpoints, transport phases, and native execution. Preserve context parentage and stream cleanup, and retain diagnostic batches without per-file log writes.
Build qualification packs through the canonical frozen provider stage so lockfile, interpreter, and compiled bytes match the sandbox image. Keep ignored untracked repository files out of durable checkpoints.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Match the native runner's approved external-sandbox mode so Codex tools can reach the loopback API and Git credential bridge. Preserve local and restricted permission modes; verify the serialized launch environment.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Retry bounded read-only transport failures and resolve uncertain bulk writes through atomic signed receipts without replaying claimed batches.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Honor the native duplex opt-in and align repeat-safe credential acquisition with the file bridge response budget, without retrying Git commands.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Normalize the provider-pack layout independently of runnerd build order and compare verified content rather than revision provenance, avoiding unnecessary multi-gigabyte uploads.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Keep runtime-owned command snapshots reusable until cleanup and observe optional prompt-start rejection without hiding it from callers.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Use the same controller-owned runner file for identity and remote staging, including packaged server vendor layouts.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Record controller-owned rotation events and require an exact run transition before accepting a new process fingerprint. Preserve stable sandbox, runner and provider-session checks.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Expose the existing finalization timestamp through the scoped sync API and reject periodic-only or out-of-run saves.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
