The provider was suspended for a fixed 8 s and the grader required the
message before the Stop ACK, which the product writes after a 2 s cleanup
grace. That made the case a timing race. The fixture now keeps the old
provider stopped until the follow-up message is durably saved, verifies
the hold is still in place, and only then releases it. The grader
requires the message inside the held interval, no successor start before
release, and one successor after cleanup. Reply wording checks are
replaced by the saved single-page artifact and a non-empty reply.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Chat guidance gave agents the paths for tasks, approvals, runs and agent
profiles, but did not say how to write them. An agent wrote a bare
/<prefix>/approvals/<id> path, which the chat does not turn into a link,
so the person could not open the approval to decide it. Say to write each
company link as a Markdown link.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The pending-phase check matched reply wording with regular expressions.
Replace it with structural evidence: each request's own reply renders a
link to the exact pending approval the person must decide. Early worker
execution stays graded from saved state and runs. Bump the case oracle to
paperclip.chat-catalog.runtime-hiring.v3.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An OpenCode agent hired by another OpenCode agent got no credential, so
approving the hire left it failing verification with harness_auth_failed.
Credential inheritance covered Claude, Codex and Grok but not opencode_local.
Add OPENROUTER_API_KEY, the key AI connections bind for opencode_local.
Only secret references are copied; plain values such as
OPENCODE_CONFIG_CONTENT still stay with the parent.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The reply check required the frontmatter name verbatim, so a correct
reply naming "Accessibility Review" with a link to the saved skill
would fail. Accept the saved name or a link to that skill's page; a link
to another skill still fails.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An agent asked to add a skill from a vetted local directory searched the
company library, found no match, read "existing skill" as "already in
the library" and saved a managed copy with create_skill. The copy lost
its source locator, so update, audit and reset flows cannot follow it.
State in the create_skill contract that a SKILL.md in a local directory,
repository, URL or catalog is an existing skill even when the library has
no match, and must be imported rather than copied.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Attachment links in chat now open the in-app preview panel instead of
starting a download, so the result check timed out waiting for a download
event after the panel had correctly shown the blue preview. Follow the
visible path: click the answer's link, then use the panel's Download control
for that file (a direct download still counts) and check the filename.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The baseline run returned the selected preview correctly but failed twice on
grader assumptions: it re-registered the byte-identical file as a new
attachment (grader required the original attachment id), and it asked the
clarification through a pending ask_user_questions card (grader only read
comment replies). The grader also matched reply wording with regexes.
- Identify "that preview" by downloaded bytes and filename of the attachment
the canonical answer links, verified against its stored digest.
- Accept a clarification that ends the turn as a reply or a pending question
card created by that phase's own run; require that run to create no
attachment, work product or document revision.
- Require no follow-up task (neither request asked for one) instead of
matching "blue" in task text; drop all reply-wording regexes.
- Bump oracle to paperclip.chat-catalog.runtime.remember-preview.v3.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The unrelated Research card asks for the project's biggest blockers, but
its only task was a backlog follow-up. The summarizer searched for
blockers that did not exist, and its pre-query generation took 171-182s
against the 180s limit, failing setup in 2 of 4 runs. The Research
project now has one blocked task, as Launch does.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The create route's cleanup also wrapped the activity record written after
the compile was queued, so a logging failure deleted the card and left
its generation task queued. Only enqueueCompile failures now remove the
card; a regression test fails the creation activity record and checks
that the card and its uncancelled generation task remain.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A failed company read for the href ran inside the create route's cleanup
path, which deleted the new card while its compile task stayed queued.
The issue prefix is now read before the card is created; a regression
test makes that read fail and checks that no card or task is left.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Archive and restore responses carried no board route and the PATCH
operation had no description, so a chat agent that archived a card could
only tell the person to 'clear archived' via the API. Single-card
responses (create, get, patch) now include href, the company-scoped
Status page route, and the PATCH description explains that archive keeps
the card and history, that a person restores it from the Status page,
and that restoring starts a fresh summary.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The archive-restoration-truthful check pattern-matched the reply: a
truthful 'archived, not deleted' failed on the word 'deleted', and
'refreshes'/'refreshed' missed /\brefresh\b/. Saved state already proves
archive-not-delete and preserved history; the reply is now graded on
giving a usable route (the archived card or the status cards page,
where Restore lives). Bumps the oracle to status-card.archive.v2.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An agent refused termination relayed the profile path as plain text. The
denial now carries a Markdown link to /<prefix>/agents/<id>, so the agent
can send the person straight to the Terminate control. POST /terminate now
resolves the agent before the board check, so the link names the target.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Creating an issue with status done or cancelled and an agent assignee queued
an issue_assigned wake, so the agent got a run for finished work (and it
queued behind any run the agent already had). The update path already treats
restoring an assignee on closed work as not a reopen request, and create-time
fast responses already skip done and cancelled. Apply the same guard to the
create-time assignment wake.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
PATCH /api/agents/:id with status "terminated" ran the lifecycle terminate
command after only the agent-config update check, so an agent that could
configure a peer (or itself) could terminate it after POST /terminate
returned 403. Both routes now share one board-only gate whose denial names
where a person can terminate the agent.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The baseline and second runs both had a third Morgan run, queued by creating
the done historical task. Assert in setup that Morgan's only run is the
active assignment, so this shows up as a setup defect, not a candidate one.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Replace the reply keyword/regex check with the exact link to the intended
agent's profile, where the person uses Terminate. Probe the PATCH status
route as well as POST /terminate, since the baseline agent terminated the
worker through PATCH after POST was refused. Bump the oracle version.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
POST /api/companies/{companyId}/imports/preview and /imports/apply registered
no request body, so agents reading the catalog could not learn the source,
target, collisionStrategy or nameOverrides fields. Register the existing
preview and import schemas and describe the safe-route limits.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit 1171878148)
Chat guidance said to derive the link prefix from the returned task
identifier but never said how. A CEO agent reasoned that RUN-1 "doesn't
give the prefix directly", invented /runner-e2e/agents/<id>, and every
agent profile link in its reply opened "Organization not found". State
that the prefix is the identifier part before the final hyphen and number,
that all company links share it, and that it is never built from names,
slugs, hostnames or paths.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit 0e7a64cdf0)
The baseline attempt failed although the agent only previewed: the
before-choice check compared the existing agent's full configuration
response, whose lifecycle status and updatedAt change after setup
(preparation and harness budget funding). Compare the configuration
without those fields (configurationRevision, the product's own content
hash, stays). Replace the conflict/choice keyword regexes over the reply
with structure: the first turn ended waiting on the person with no import
activity, and the reply names the setup-chosen conflicting employee.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The revision request attaches its source task, so the shared result-navigation
check's requirement for a rendered task link rejected a correct reply that
returned both version downloads. The case still opens the returned download and
both versions' library stacks.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The revise-delivery grader rejected a correct revision for four eval reasons:
the fixture footer marker ended in the nonce's attempt suffix (-1), which the
agent reasonably bumped as a version label on website-v1.html; it required a
link to the source task the person had attached; it required the revision on
the source task although the chat run's register_deliverable files it on the
requesting conversation; and it graded revision context with keyword regexes.
Hash the marker, accept the source task or the conversation, and grade
revision context structurally: a separately titled registered version plus a
returned route to the retained original.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The concurrent phase required the reply to say Casey, offline and
prototype, and the approval check scanned reply words. The read and
final phases now accept a revision identified by id or number, the final
phase accepts naming the intervening edit by revision or editor, and
saved state decides restore versus preserve. Approval is checked from
activity only.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An agent asked to read the current plan fetched the revision it had just
restored by id and reported it as the latest, missing a newer edit by
another person. The exact-revision read now carries the document's
latestRevisionId, latestRevisionNumber and isLatest, and its API
description points to the current-document read.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The grader required either a copied attachment or an attachment URL in
the delegated task, so it rejected the agent copying the complete brief
verbatim into the task description, which the chat guidance itself
recommends ("copy the relevant existing content into the handoff") and
which gave Morgan everything needed to build the site.
- Accept the complete exact brief text (setup-chosen literal, tolerant
only of line endings, indentation, blank lines and quote markers) in
the full saved task description or its documents, and require Morgan's
own bearer to read it there.
- Read the saved task in full; company issue listings shorten
descriptions to 1200 characters, which could also hide a reference.
- Drop the website/landing-page keyword check on the model-written title.
- Bump the case oracle version.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Chat agents asked to change the person's own display name had no route to
offer, so they searched the API, tried the human-only profile endpoint and
ended with vague "profile/account settings" directions. Tell chat where the
personal profile editor lives and that agent credentials cannot change it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The account popover check failed in strict mode because the profile page now
has its own display-name heading; scope it to the popover. Accept 401 as well
as 403 for the agent's denied profile write (a non-session credential is
unauthenticated on the human-only route). Replace the reply keyword and
negative wording regexes with a required rendered link to the person's
profile editor, which the person follows to save the name.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A chat request such as "Mark the landing-page task as high priority" with
two accessible tasks of that title left the agent deliberating between
picking one, changing both and asking, until the run was cancelled. Chat
guidance now says to ask which candidate is meant, with links and the
distinguishing detail, before changing any of them.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The clarify-before-write check required a question mark or one of
which/choose/select/clarify in the free-form reply. A valid question
phrased as "Tell me the one to raise" failed it, and the keywords proved
nothing the saved state and links do not. The check now relies on no
early mutation of either task and links to both candidates; the later
checks still reject picking the first match, changing both, or the wrong
task after the selection.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The edit-instructions oracle matched the saved rule and the reply against
phrase regexes. It now requires the agent's own audited save to add guidance
on top of the prior and concurrent human revisions, and a link to Morgan or
the saved revision. An unsaved rule fails whatever the reply says.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Completion feedback forbids guessing routes when no href was returned, and
the instruction tools returned none, so chat replies after an instruction
edit could not link the edited agent. Save and restore receipts now carry a
resourceLinks entry with the agent's real profile href and state that runs
starting after the save use the new instructions.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
POST /exports and /exports/preview registered no request body, so agents that
discover operations through the API catalog sent none. The defaults export
only the company and agents, and an agent then told a user that the company
had no projects or skills to export. Register companyPortabilityExportSchema
and describe the include defaults, as the legacy /export route already does.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit e7b5673439)
The export-company oracle could never pass: an inline import preview never fills
manifest.source, the product exports secret_ref inputs as valueless optional
inputs by design, and the reply was matched against keyword regexes. Grade
provenance from the package's own COMPANY.md company entry, foreign scope from
manifest agents/projects belonging to the source company, and require the reply
to name the setup-chosen omitted credential (key or secret name).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A failed private chat cell lists its HTML report's trace viewer program
files (codicon .ttf, playwright-logo .svg, manifest.webmanifest) in its
evidence manifest. The campaign report copied them into
normalized/evidence/<id>/attempt-N/html-report/trace/, where the trusted
generated-report seal refuses those carrier types, so the whole merged
report was lost with "Unsupported packaged evidence carrier".
The report no longer stages a cell file whose type that seal refuses; the
merged report keeps its own authenticated trace viewer and the cell archive
keeps the files. Before sealing, the transfer now names the first refused
carrier with a closed category (font, svg, webmanifest, image, source map,
no extension, other, trace viewer asset or bytes), never its path. The seal
itself, its limits and its scans are unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Playwright's HTML reporter copies every attachment, including the failure
trace and video, into html-report/data/<sha1>.<ext>, while the same bytes
stay in playwright-output. Private chat cells seal both into the original
and the packaged trees, so a large failed attempt carried the trace four
times outside the blob report and lost all private evidence once the
bundle crossed the 256 MB allowance.
Before packaging, drop a playwright-output file only when html-report/data
holds an independently verified, byte-identical regular file under its
content-derived name, and record what was dropped in a snapshot receipt.
The HTML report, its trace viewer and the blob report are unchanged.
Framework-JSON cells, which register playwright-output attachments by path,
are left untouched. No trusted transfer file, limit or scan changes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Match the registered run route path and the runsForIssue select block's
runId field instead of a full JSX line and a fixed character window, so
harmless refactors do not break the guidance regression test.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit a490180801)
The sidebar Search item links to the full search page, so it does not keep
the person's place. The palette sends only free text, so operators filter
only after the Search all handoff. Correct both statements and test them
against the sidebar and palette source.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit ff83378b26)
GET /api/issues/{id}/runs returns the run ID as runId, not id. Name the
field each response returns so chat can build the run link, and pin the
listing's field name in the regression test.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit 123d7fb940)
The trusted transfer printed one fixed line for every refusal, so a refused
attempt kept no evidence and no reason. Report a closed refusal code: a slug of a
fixed literal message from the trusted evidence modules, a Node error code, an
error type, or 'dynamic'. Message text is never printed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Since #19535 the agent profile h1 is the editable title ("Frontend
engineer"), and the name is secondary text. The runtime result check
waited for a heading named "Morgan" and failed on the correct page in
run 42406653921. Identify the profile by the header portrait, which
the page labels "<name> avatar".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The resume-agent grader required phrase lists in both replies. A valid
reply such as "Morgan hasn't started the work yet" failed the
no-invented-execution regex. Grade the first resume by its attribution to
the first request's own run, keep the no-worker-run check, and require
a bound reply for each phase.
Add no-agent-budget-override: in run 42404423330 the CEO lifted the
board's budget hard stop through PATCH /api/agents/{id} after the budget
route refused it. That outcome must fail even when the reply explains it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Chat guidance defined only the task-link template. Asked to resume an
agent, the chat agent resumed it and reported the result but never
linked the agent, leaving the person no direct route to check its
saved availability.
Tell chat to link an affected agent's profile at
/<prefix>/agents/<urlKey or id>, and keep that link distinct from an
agent:// mention, which notifies the agent.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit 5324cfc4df)
Configuration preparation on current master publishes passive work
hints through db.execute, so the empty object mock from #17857 throws
before the budget assertions run.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
