Keep the source-bound fixture regression, runner preservation proof, required map synchronization and pending full gates in the existing dated record.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Retain source-bound regression and preview evidence, current pending gates, and the independent prerequisite split.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Keep the discovery fixture truthful for unknown platforms and add a measured GNU2.39 ARM64 control. Record existing managed fixture, cost reporting and route qualification evidence without claiming missing live acceptance.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Keep explicit Legacy permission choices through automatic selection, import editing, draft reset and policy display. Use company-scoped measured immutable-image facts for automatic sandbox defaults without allocating resources during creation or discovery.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Co-Authored-By: Paperclip <noreply@paperclip.ing>
* codex/runner-native-platform-prerequisites:
fix(runner): close review gaps in setup and platform qualification
Read inert exact-source target data before selecting hosted native jobs. Bound registration teardown and retain unconfirmed recovery state. Record company-scoped sandbox platform facts only for immutable OCI images after confirmed cleanup; preserve existing connection and runner behavior.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Extract the tested runtime and installed-package prerequisite without changing agent creation defaults or experimental gates.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Use the controller override only for matching remote OS and CPU, preserving explicit remote priority and strict target header verification.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
## Thinking Path
> - Paperclip manages AI agents and their work.
> - Chat channels connect that work to provider conversations.
> - Provider workflows still fill the shared service.
> - Their authority and recovery rules need clear homes.
> - This PR lands five reviewed extractions into channel folders.
> - Shared authorization, state and worker lifetime stay explicit.
## Linked Issues or Issue Description
Refs #15976, #15996, #15999, #16001 and #16002. This root PR now
contains all five extractions from batch three. The four upper PRs were
merged into their parents. The combined tree matches reviewed stack head
`789e918b5af49ec1958076ce4d22d31006205302` exactly.
## What Changed
- Extract Slack session status and accepted-file receipt recovery.
- Extract Telegram publication drafts and Stop handling.
- Extract Photon events and native responses.
- Extract Teams file-transfer authority.
- Reduce `chat-channels.ts` from 29,897 to 26,461 lines (3,436 lines,
11.5%).
- Preserve function bodies, runtime-map identity, leases and transaction
boundaries.
## Verification
- All 117 selected public-service cases passed before and after their
respective extractions.
- All 30 moved declarations and remaining service statements preserve
normalized syntax across the five slices.
- Server typecheck, module boundaries and whitespace checks passed.
- Cumulative `pnpm -r typecheck` and `pnpm build` passed. Combined-head
CI and review are pending on `5de1b0b99d71049a72440e8c131bf4bb30bdf3f3`.
- Fixtures exercise assembled services and disposable databases, not
live third-party providers.
- Cumulative local `pnpm test:run` on
`789e918b5af49ec1958076ce4d22d31006205302` exited 1: 32,414 passed, 125
skipped, one failure. `company-skills-routes.test.ts:1691` (`stars,
forks, and comments on skills through company-scoped endpoints`) failed
with `socket hang up`; that test and its route are unchanged by this
stack. The same 58-case suite then passed in isolation without code
changes. The original command did not reach 111 later serialized suites;
its failure is retained, so the full-local-test checklist remains
unchecked.
```sh
pnpm exec vitest run server/src/__tests__/chat-channels.integration.test.ts -t 'Slack session|Slack turns to Idle|signed Slack session stop|denies guest Slack stops'
```
- Combined-head CI attempt 1: five runners received a shutdown signal at
19:13:08 UTC (server shard 10/12, serialized shards 2/9 and 7/9, E2E
shards 3/8 and 7/8). These jobs stopped during execution without a
failing test assertion. [Original
workflow](https://github.com/paperclipai/paperclip/actions/runs/38293566028).
The affected jobs will receive one unchanged retry after the other jobs
finish.
## Risks
- Changes cross durable provider recovery and authority boundaries. The
moved bodies preserve syntax, and 117 focused public-service cases
passed before and after their extractions.
- Shared workers, timers, runtime maps and generic authorization remain
in the service.
- The full local test run failed in an unchanged company-skills route
test; its result and the unrun suites are recorded above.
## Model Used
OpenAI Codex, GPT-6 family, with reasoning and repository tools. The
exact runtime model ID and context-window size are not exposed in this
session. No separate agent was used.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [ ] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [ ] All Paperclip CI gates are green
- [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
---------
Co-authored-by: Paperclip <noreply@paperclip.ing>
Retain both hosted cache scopes. Use shared test-home teardown and restore owned directory permissions for the observed Mac ENOTEMPTY failure while keeping unrelated errors visible.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
## Thinking Path
> - Paperclip manages AI agents and their work.
> - Chat channels connect that work to external conversations.
> - The shared chat service still contains provider-specific workflows.
> - Those workflows are hard to inspect in a 34,000-line file.
> - This stack extracts Telegram, Slack, GitHub and Discord workflows
into their channel folders.
> - Shared authorization and service lifetime remain explicit.
## Linked Issues or Issue Description
Refs #15823, #15834, #15836, #15844 and #15845. Root of the second
behavior-preserving channel-folder refactor stack. The dependent PRs
#15979, #15981, #15985 and #15987 have merged into this branch; this PR
lands all five extractions on master.
## What Changed
- Move Telegram maintenance and subscription repair into
`chat-channels/telegram/maintenance.ts`.
- Move Slack session stopping and task starts into
`chat-channels/slack/session-stop.ts` and `task-start.ts`.
- Move GitHub webhook intake and recovery into
`chat-channels/github/webhook-ingress.ts`.
- Move Discord command registration and handling into
`chat-channels/discord/commands.ts`.
- Share type-only runtime records while preserving shared authorization,
transactions, live lease checks and worker ownership.
- Reduce the original service from 34,603 to 29,897 lines, removing
4,706 lines (13.6%).
## Verification
- All 205 selected integration cases passed before and after their
respective extractions: Telegram 41, Slack session stop 2 multi-step
scenarios, GitHub 84, Slack task start 25 and Discord 53. Each dependent
PR records its focused reproduction command.
- Server typecheck, module boundaries and whitespace checks passed.
- Per-slice syntax comparisons passed for moved declarations and
remaining service statements, allowing only the documented live callback
substitutions.
- Tests exercise the public service with disposable databases and
fixture provider transports. They do not claim live third-party
execution.
- Cumulative workspace typecheck and build passed on the final stack.
- Current-head CI passed on the combined stack commit
`d5b37dbe512e3e199932b6608cdc17639eda555a`; Greptile is 5/5 with no
unresolved threads.
- The [original serialized
shard](https://github.com/paperclipai/paperclip/actions/runs/38266518817/job/114870022249)
timed out in unchanged `adapter-auth-signal-routes.test.ts`. The exact
case passed locally without changes, and the [single job
retry](https://github.com/paperclipai/paperclip/actions/runs/38266518817/job/114874019933)
passed. The original timeout remains recorded.
Reproduce the original Telegram slice’s focused suite:
```sh
pnpm exec vitest run server/src/__tests__/chat-channels.integration.test.ts -t 'Telegram durable private draft Stop|Telegram maintenance|Telegram webhook|Telegram.*(pause|remove)|Telegram.*commands'
```
- Cumulative local `pnpm test:run` exited 1: the first server group had
**18,770 passed, 105 skipped, and one timeout** in unchanged
`server/src/services/workspace-git-snapshot-streaming.test.ts:56`
(300,000 ms on macOS). The fail-fast runner did not reach its later
workspace and serialized groups. An unchanged isolated rerun passed
using the existing timeout; this does not turn the original full run
green. The test and its Git utility code are outside this refactor; all
current-head CI jobs passed.
- Reproduce that diagnostic alone: `pnpm exec vitest run
server/src/services/workspace-git-snapshot-streaming.test.ts`.
## Risks
- Credential lease ownership and provider-confirmation ordering must
remain unchanged. Existing rotation, lease-loss, recovery and durable
Stop cases pass.
- The channel factories create no workers or timers and preserve live
runtime, shutdown and gateway-ownership reads.
## Model Used
OpenAI Codex, GPT-6 family, with reasoning and repository tools. The
exact runtime model ID and context-window size are not exposed in this
session. No separate agent was used.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [ ] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
---------
Co-authored-by: Paperclip <noreply@paperclip.ing>
Preserve Codex GNU libc eligibility and Linux ARM64 behavior; keep Claude automatic selection limited to Apple Silicon.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Isolate actual Codex resolver fixtures from global bridge lookup and preserve host qualification blockers with literal evidence.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
## Thinking Path
> - Paperclip is the open source app people use to manage AI agents for
work.
> - Its Skills library imports reusable instructions from GitHub.
> - Some skills depend on shared files and sibling skills outside their
folders.
> - Directory-only imports lose those dependencies.
> - This pull request keeps repository files together and lets users
select which skills appear in the library.
> - Agents receive the original files and paths through the existing
skill delivery system.
## Linked Issues or Issue Description
Refs #14713. Related: #13656.
**Current behavior**
GitHub imports copy independent skill directories. Shared scripts,
policies, helper skills, and credit files can be omitted. One
shared-file error can block every skill.
**Proposed behavior**
New imports keep repository files together at the scanned commit. Show
all skills with their folders and select every skill by default.
Collapse individual package files. Omit unsupported or oversized files
with a warning. Import available content without repair choices or an
extra confirmation. Keep warnings on the saved source.
**Reason and benefit**
Skills can read their shared repository files after Paperclip delivers
them to an agent. Original instructions stay unchanged. Users can
inspect included files and understand omissions before and after import.
## What Changed
- Store immutable company-scoped repository snapshots and associate them
with skill versions. Regenerate the migration after merging master.
- Preserve original bytes, binary encoding, and executable modes.
Shared-file changes version each usable selected skill. Pinned versions
retain their original files.
- Deliver a discovery wrapper with the original tree under
`.paperclip-repository/`. Preserve invocation policy when present. Fork
and create-from-existing retain repository files.
- Keep repository files together for new UI imports. Show every skill,
select all by default, and collapse package files. Remove the
packaging-mode menu. Keep the mobile import footer visible.
- Warn about symlinks, submodules, oversized files, missing references,
and invalid optional manifests. A malformed skill remains selected with
a Needs setup warning. Usable skills still publish, and its original
file remains repository support content. Source warnings persist through
refresh. Unsafe execution and secret-disclosure findings omit the
affected files before snapshot publication.
- Expose saved repository files in the installed skill viewer, including
binary encoding and executable flags. Reads use the immutable
company-scoped snapshot; relative instruction links resolve from their
original repository directory.
- Audit delivered inventories and derive trust from all repository
files. Accept evaluation prose while retaining dynamic-execution
findings. Read blobs in one bounded Git batch and check budgets before
reading support files. Imports never execute setup commands.
- Add scanner, database, delivery, UI, and browser regressions. Update
Storybooks, screenshots, and documentation.
## Verification
- 69 focused scanner, Git snapshot, delivery, and PostgreSQL lifecycle
tests passed. They cover partial imports, warning persistence, missing
references, binary files, executable modes, copies, pinned versions,
cancellation, company isolation, and batched Git reads.
- 110 import, skill-detail, selection-tree, saved-file link, and
Markdown renderer tests passed. A file-switch regression failed before
the resolver fix and passed afterward. Browser walkthroughs cover the
all-selected open tree, repository preview, non-blocking warnings,
missing references, setup problems, warning persistence, and mobile
layout.
- Full workspace typecheck and build passed. Runner E2E TypeScript
checks and design-token gates passed. The full serial local suite was
attempted and stopped after over an hour. The existing 40,000-file Git
streaming stress test failed after 303 seconds on macOS; the broad local
suite is not counted as passed. All 55 applicable PR checks passed on
the final commit, including the full sharded CI suite. Two optional
Storybook workflows were skipped; the five local Storybook walkthroughs
passed.
- On October 12, live campaigns imported the private Poteto repository
through the production GitHub Sources UI, selected architect and bro,
and invoked them with native Codex on local and Daytona. The source
connection was disabled before invocation. Independent filesystem
inspections matched every supported Git blob, size, and executable mode.
Both tasks completed and cleanup passed. Campaigns:
`local-2026-10-12T15-07-39-504Z` (both environments),
`local-2026-10-12T16-08-39-682Z` (local), and
`local-2026-10-12T16-03-33-938Z` (Daytona). Each of the two selected
skills received all 234 supported repository files. Later changes only
affect the installed-file viewer and documentation. This qualifies skill
delivery and instruction reads, not every Poteto workflow or adapter.
- A manual source-checkout test drive imported a synthetic private
GitHub repository with a symlink, an oversized file, a missing
reference, and malformed skill metadata. Available skills published with
their shared checklist. The walkthrough found duplicate warning text
after import; the final UI fix removes that duplicate. The file viewer
exposes saved repository dependencies and resolves authored relative
links without changing the instructions. A follow-up live refresh
omitted unsafe helper files with warnings, preserved every safe file
byte, and survived a server restart.
Screenshots below use the production UI with Storybook fixtures. They do
not replace the live GitHub and runtime checks.
<details>
<summary>All skills visible and selected by default</summary>
</details>
<details>
<summary>Import stays available with warnings</summary>
</details>
<details>
<summary>Repository file inspector</summary>
</details>
<details>
<summary>Mobile import</summary>
</details>
## Risks
- Each selected skill carries a repository copy in the runtime. The
database stores each snapshot once. Runtime transfer and storage
increase with the number of assigned skills.
- Runtime budgets remain: 9,990 repository entries, 1 MiB per file, and
61 MiB total. File omissions are recorded as warnings. Source-access or
download failures retain installed versions.
- Import success does not prove that every skill can run. Environment
dependencies, credentials, delegation tools, and schedules still need
configuration. Imported setup scripts are not executed.
- Live runtime coverage is native Codex on local and Daytona. Other
adapters use the shared delivery path but were not exercised in these
campaigns.
The roadmap marks Skills Manager as shipped. This extends the existing
importer. Related pull requests were checked.
## Model Used
OpenAI Codex, based on GPT-6, with repository inspection, code
execution, automated tests, and browser tools. The exact deployment
identifier and context-window size were not exposed in this session.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [ ] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
Keep daemon ABI admission separate from CLI login and preserve restricted Docker installation checks before native host startup.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Preserve actual target selection, record the GNU libc baseline, and retain primary installed-startup failures for ARM qualification.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Preserve the user-approved Codex Linux ARM64 default and keep Claude automatic selection limited to Apple Silicon.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Carry Claude effort through versioned native admission and recovery. Preserve existing connections and saved runner choices, and price Opus 5.5 API receipts.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Retire duplicate ACPX and Codex proof after migrating unique assertions to their behavioral owners. Consolidate repeated fixtures and exact case matrices while preserving lifecycle, protocol, company, credential, approval, and ordering contracts. Remove the unused runtime-controls compatibility path and document test ownership and preservation evidence.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Ship a source-bound ARM64 daemon alongside Linux x64 and both Mac targets.
Use native hosted builds and the existing clean npm/native startup verifier.
Read target requirements from the immutable source to preserve historical
three-target promotions. Keep Codex payloads as official npm dependencies.
Resolve ARM64 creation and login through the shared platform contract. Share
the existing legacy CLI permission calculation with import previews without
changing execution behavior. Record targeted checks and live Mac evidence.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
## Thinking Path
> - Paperclip manages agent work and sends results back to chat.
> - A failed chat run can be retried only while its original source
remains authorized.
> - That decision includes persisted source evidence and native runtime
state.
> - Retry claims also share in-flight promises and depend on service
shutdown.
> - This PR groups retry authorization, execution and notices in one
module.
> - The service retains the live admission, runtime and shutdown
boundaries.
## Linked Issues or Issue Description
Refs #15844, #15836, #15834 and #15823. Stack slice 5 of 5, based on
`codex/chat-publication-replacement`.
Merge each predecessor first, then retarget this PR. Do not merge the
stack out of order.
Stack order: #15823 (provider messages) → #15834 (resource
reconciliation) → #15836 (identity links) → #15844 (publication
replacement) → #15845 (failed-run retries). GitHub native stack merging
preserves this order and automatically restacks the remaining branches.
## What Changed
- Extract failed-run retry admission and coordination while keeping the
in-flight map, cursor, error class and authority registrations scoped to
one chat service.
- Move the exact Teams uncertain-file continuation proof into
`microsoft-teams/file-transfer-source.ts`.
- Pass the existing transaction, explicit source identifiers and denial
factory. Return only the proven publication ID.
- Keep committed-result, complete source-batch, ancestor and
other-uncertain-effect checks in shared `failed-run-retry.ts`.
- Keep native execution recovery together; its provider references
describe runner backends, not chat channels.
- The retry coordinator is 1,825 lines and the Teams proof is 149 lines.
Restack on revised #15844 and record the reassessment.
## Verification
- Baseline: 59 retry cases and six negative Teams authority cases
passed. The combined 65 cases passed after the move.
- Cases cover retry ownership, service restart/lifetime, ambiguous Teams
receipts, sibling unknown effects, changed source authority and active
attempts.
- Teams guard, joins, locks, attempt checks and selected ID match after
explicit input substitutions. The shared coordinator retains its state
and cleanup ownership.
- Server typecheck, module-boundary and whitespace checks passed.
- Integration uses disposable databases and fixture provider transports;
no live third-party execution is claimed.
- Fresh Greptile review is 5/5 on
`4f7151409717458717633aa270441a8faf33664e`, with a successful check and
no open review threads.
- Final-stack `pnpm -r typecheck` and `pnpm build` passed at
`57ec5ba94aecd860471f9b14db46f99120c7c790`.
- All CI checks passed on `57ec5ba94aecd860471f9b14db46f99120c7c790`.
- Full local `pnpm test:run` stopped in the general-server group: 18,763
passed, 105 skipped, and one test timed out after 20 seconds in
unchanged `workspace-runtime.test.ts` ("does not accept an occupied
allocated port when listener ownership is unavailable"). The same case
passed in an isolated rerun without code, assertion or timeout changes
(1 passed, 175 excluded). The original timeout is retained as a failed
full run; later workspace and serialized groups were not reached. The
full local gate remains unverified.
- Merge verification on the restacked tree: 118 focused identity,
publication, Photon and retry integration tests passed; server typecheck
and module-boundary checks passed. GitHub’s rebased trees exactly match
the previously reviewed file contents.
- All current-head required checks passed on
`4f7151409717458717633aa270441a8faf33664e`: full CI; Greptile 5/5 with
no unresolved threads.
## Risks
- Authorization must remain fail-closed across committed output and
retry admission. The helper proves only the Teams transfer; the caller
still checks the complete source and result in the same transaction.
- In-flight promises, error-class identity, registration cleanup, cursor
state and the live shutdown getter must remain per-service. Their code
is unchanged by this channel-folder move.
- This PR depends on #15844. Merge and retarget in stack order.
## Model Used
OpenAI Codex, GPT-6 family, with reasoning and repository tools. The
exact runtime model ID and context-window size are not exposed in this
session. No separate agent was used.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [ ] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
---------
Co-authored-by: Paperclip <noreply@paperclip.ing>
## Thinking Path
> - Paperclip publishes agent progress and results back to chat.
> - Some updates replace an earlier message while others need a new
message.
> - The current outbound link and task generation determine that
authority.
> - These decisions are spread through the large chat service.
> - This PR groups publication replacement and supersession decisions in
one module.
> - Reviewers can follow those decisions without reading provider
transport code.
## Linked Issues or Issue Description
Refs #15836, #15834 and #15823. Stack slice 4 of 5, based on
`codex/chat-identity-links`.
Merge the predecessor first, then retarget this PR. Do not merge the
stack out of order.
Stack order: #15823 (provider messages) → #15834 (resource
reconciliation) → #15836 (identity links) → #15844 (publication
replacement) → #15845 (failed-run retries). GitHub native stack merging
preserves this order and automatically restacks the remaining branches.
## What Changed
- Extract shared publication replacement and supersession queries from
the large service.
- Keep exact outbound ownership, run/wake scope, consumed progress,
interaction replacement and retained-source authorization together.
- Put the iMessage typing-versus-progress policy in
`imessage-photon/publications.ts`.
- Preserve endpoint lookup timing and all ownership query bodies. The
multi-provider close allowlist remains shared dispatch metadata.
- Restack onto the revised #15836 and record why this boundary remains
mostly shared.
## Verification
- The same 49 existing publication and Photon integration cases passed
before and after the provider-policy move. Other cases were excluded by
the filter.
- Cases cover close-owned progress, ambiguous delivery, interleaved
Slack control, Telegram confirmation, FIFO replacement and Photon
channel behavior.
- Server typecheck, module-boundary and whitespace checks passed. Only
the iMessage predicate/reason moved; ownership queries are unchanged.
- Historical server shard 2 hit a cleanup deadlock; its unchanged
[isolated rerun
passed](https://github.com/paperclipai/paperclip/actions/runs/38134431077/job/114457999409).
[Original
failure](https://github.com/paperclipai/paperclip/actions/runs/38134431077/job/114455332022).
- Tests use disposable databases and fixture provider transports, not
live third-party execution.
- Fresh Greptile review is 5/5 on
`8e2da97b6dc11eb446128b61c789edb529c50d5a`, with a successful check and
no open review threads.
- Final-stack `pnpm -r typecheck` and `pnpm build` passed at
`57ec5ba94aecd860471f9b14db46f99120c7c790`.
- Historical pre-restack CI failed on `ci / General tests (server
(11/12))` and its aggregate `ci / verify`. All 1,255 tests passed, but
worker-exit cleanup in unchanged
`server/src/__tests__/setup-supertest.ts:32` failed with EACCES removing
a temporary `paperclip-vitest-home-*` directory. The [original
job](https://github.com/paperclipai/paperclip/actions/runs/38256549828/job/114836065382)
and the [single unchanged
rerun](https://github.com/paperclipai/paperclip/actions/runs/38256549828/job/114839735273)
failed the same way. No further reruns were requested. After GitHub
automatically restacked the branches, the full cumulative run on #15845
passed this server shard. This middle PR uses the repository’s
policy-only stack CI scope; the top PR runs all suites.
- The final full-local-suite outcome for this cumulative stack is
recorded in #15845; do not infer that gate from the focused tests above.
- Merge verification on the restacked tree: 118 focused identity,
publication, Photon and retry integration tests passed; server typecheck
and module-boundary checks passed. GitHub’s rebased trees exactly match
the previously reviewed file contents.
- All current-head required checks passed on
`8e2da97b6dc11eb446128b61c789edb529c50d5a`: policy CI (middle-stack
scope; full cumulative suites passed on #15845); Greptile 5/5 with no
unresolved threads.
## Risks
- Splitting shared ownership queries per channel would duplicate
authorization rules. They remain in the shared module.
- Preserve the issue-to-run lock order and retained-source callback. The
factory creates no worker or mutable state.
- This PR depends on #15836. Merge and retarget in stack order.
## Model Used
OpenAI Codex, GPT-6 family, with reasoning and repository tools. The
exact runtime model ID and context-window size are not exposed in this
session. No separate agent was used.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [ ] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
---------
Co-authored-by: Paperclip <noreply@paperclip.ing>
## Thinking Path
> - Paperclip connects provider identities to company members.
> - A confirmed identity determines whose permissions apply to chat
messages.
> - Token consumption and membership checks must remain atomic.
> - These operations currently share the large chat channel service.
> - This PR moves identity linking into one module with explicit runtime
callbacks.
> - Reviewers can inspect the complete identity-link flow together.
## Linked Issues or Issue Description
Refs #15834 and #15823. Stack slice 3 of 5, based on
`codex/chat-resource-reconciliation`.
Merge the predecessor first, then retarget this PR. Do not merge the
stack out of order.
Stack order: #15823 (provider messages) → #15834 (resource
reconciliation) → #15836 (identity links) → #15844 (publication
replacement) → #15845 (failed-run retries). GitHub native stack merging
preserves this order and automatically restacks the remaining branches.
## What Changed
- Extract company-scoped identity linking into shared
`identity-links.ts`.
- Move Slack connect receipt queries, access requests and
confirmation-notice staging into `slack/identity-links.ts`.
- Move GitHub identity fields into `github/identity-links.ts`.
- Preserve shared token consumption, link locks, membership checks and
revocation.
- Stage the Slack notice inside the original confirmation transaction.
Schedule delivery after commit. Keep runtime and public URL callbacks
live.
- Restack on the revised resource PR #15834 and record the architectural
reassessment in the plan.
## Verification
- Four existing service integration cases passed before and after. The
Slack connect case covers discovery, preview, access requests, duplicate
requests, member confirmation, provider notice, consumed tokens and
endpoint isolation.
- Receipt queries, the access-request transaction and notice payload
match the previous implementation with explicit parameter substitutions.
- Server typecheck, module-boundary and whitespace checks passed.
- These are local database and fixture transport tests, not live Slack
execution.
- Fresh Greptile review is 5/5 on
`7b44962f09fe8043c77ed40e05f761f31c64b33c`, with a successful check and
no open review threads.
- Final-stack `pnpm -r typecheck` and `pnpm build` passed at
`57ec5ba94aecd860471f9b14db46f99120c7c790`.
- All CI checks passed on `62ee045a4728da2d756be3d2e40d13e592a0b5a9`.
- The [original workspace
shard](https://github.com/paperclipai/paperclip/actions/runs/38256203686/job/114834873234)
timed out waiting for the CLI import/export test server health endpoint.
Its [single unchanged rerun
passed](https://github.com/paperclipai/paperclip/actions/runs/38256203686/job/114838954081).
The original timeout remains part of the evidence.
- The final full-local-suite outcome for this cumulative stack is
recorded in #15845; do not infer that gate from the focused tests above.
- Merge verification on the restacked tree: 118 focused identity,
publication, Photon and retry integration tests passed; server typecheck
and module-boundary checks passed. GitHub’s rebased trees exactly match
the previously reviewed file contents.
- All current-head required checks passed on
`7b44962f09fe8043c77ed40e05f761f31c64b33c`: full CI; Greptile 5/5 with
no unresolved threads.
## Risks
- Confirmation must retain transaction and token ownership. The Slack
helper receives the existing transaction and stages the same effect;
scheduling remains after commit in the shared coordinator.
- This PR depends on #15834. Merge predecessors and retarget before
merging this PR.
## Model Used
OpenAI Codex, GPT-6 family, with reasoning and repository tools. The
exact runtime model ID and context-window size are not exposed in this
session. No separate agent was used.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [ ] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
---------
Co-authored-by: Paperclip <noreply@paperclip.ing>
