Keep all 500 requests, shared-scan bounds, and health latency assertions while avoiding hundreds of temporary Supertest servers. Always settle requests and close the owned listener on failure.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Reuse the periodic recovery policy so an operator-cancelled run does not immediately dispatch a replacement and resume its sandbox. Keep explicit deferred wake promotion intact.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Bind remote CLI and ACP processes to host-owned cancellation scopes, wait for teardown and final saves, and distinguish deliberate bridge shutdown from transport loss.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Open up to sixteen response streams while keeping queued bodies paused and preserving ordered publication and cleanup. This addresses the storage-response waits measured on cold staging runs.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Add opt-in bounded OpenTelemetry diagnostics across host preparation, scoped files, repository checkpoints, transport phases, and native execution. Preserve context parentage and stream cleanup, and retain diagnostic batches without per-file log writes.
Build qualification packs through the canonical frozen provider stage so lockfile, interpreter, and compiled bytes match the sandbox image. Keep ignored untracked repository files out of durable checkpoints.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Retry bounded read-only transport failures and resolve uncertain bulk writes through atomic signed receipts without replaying claimed batches.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Honor the native duplex opt-in and align repeat-safe credential acquisition with the file bridge response budget, without retrying Git commands.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Normalize the provider-pack layout independently of runnerd build order and compare verified content rather than revision provenance, avoiding unnecessary multi-gigabyte uploads.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Use the same controller-owned runner file for identity and remote staging, including packaged server vendor layouts.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Record controller-owned rotation events and require an exact run transition before accepting a new process fingerprint. Preserve stable sandbox, runner and provider-session checks.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Expose the existing finalization timestamp through the scoped sync API and reject periodic-only or out-of-run saves.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Accept bounded Codex deprecation notices after a settled turn and require that capability before reusing a sandbox image runner. Stage replacement artifacts atomically so existing launchers and image symlink targets survive interrupted uploads.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Mock the native shutdown boundary in the startup unit test and wait for the persisted process identity before allowing the runtime readiness fixture to listen.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Park idle native sandbox sessions before app shutdown, adopt retained legacy workspaces without restaging Git, and carry explicitly bound GitHub access through both OpenCode launch filters.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Validate paginated legacy lease candidates before choosing a workspace, preserving Postgres timestamp precision. Recover failed saves through a new authorized run and cover post-save finalization failures without replaying terminal cleanup.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Bundle the task disposition helper with the installed Paperclip skill. Retry transient read-only file transfers within a fixed deadline and retain sandbox RPC caller provenance for staging failure diagnosis.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Recognize dispatched pre-folder runs and v1 leases while excluding new scoped preparation failures from the compatibility path.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Keep established tasks on their original filesystem and session layout. Recover version-1 lease identity from host run records, preserve configuration checks, and retain old work when ownership or resume cannot be verified.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Reproduce Codex plugin-cache repositories with real Git and preserve private-runtime exclusions before validating directory entries.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
A failed final flush does not erase an earlier successful periodic checkpoint. Cover interrupted continuations and replacement sandboxes for both saved and failed prior runs.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Report incomplete terminal saves without hiding the latest successful checkpoint, including same-sandbox continuation and replacement failures.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Align durable journal validation with the transport bound, preserve authorization on cached storage clients, and avoid Cloud session gates for native Git callbacks.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Require a reviewed lock digest for staging migrator and app builds so registry drift fails before lifecycle-enabled installation.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Preserve migration SQL hashes when renumbering and keep sandbox HOME with managed GitHub shell profiles.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
