Persist generic stop intent before provider dispatch, use the exact pinned StopLease capability for release and restart recovery, and retain saved allocations when capability or stop confirmation is unavailable.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Version new plugin-pinned intents and recover v1 from the exact lease recorded plugin without driver-key fallback or accepting mismatched explicit pins.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Refuse a duplicate driver key or unavailable original plugin during stop-only recovery; preserve the pending intent and fence later provider rebinding.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Hard uninstall removes plugin bindings but preserves the managed agent and its instruction history. Revalidate the registered stable-key declaration and refresh provenance atomically when relinking, so explicit reset can use its canonical revision authority.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
An explicit stock reset now compares the observed configured entry and target revision, preserves earlier entry history, and restores the declared canonical entry atomically. Retained historical entries do not masquerade as stock drift.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Record explicit managed-agent instruction resets through the canonical revision CAS path under exact plugin ownership and capability checks. Preserve prior content and plugin audit identity without synthetic user authority.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Use the committed database snapshot for native instruction bundles when disk projection is stale. Restage completed stopped working copies from the current head, while preserving live warm owners and original CAS fences for uncollected edits. Cover native stale projection, repeated stopped retries, resolved candidates, and no silent rebasing.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Exercise a 190 MiB journal made of individually bounded event frames and document off-thread proof quotas, retained evidence, and nonblocking file admission.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Project ordinary semantic outputs and unused event headers away while preserving completion, process, and warm-transition authority. Account retained JSON bytes rather than discarded parser work, and open proof inputs without blocking on special files.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Exercise both scan and projection through a warmed real worker. Verify a writer-less FIFO is rejected and close completes, with a controlled finally writer release so the pre-fix blocking-open regression cannot strand CI.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Use one off-thread proof reader with a bounded queue, monotonic deadlines, heap limits and joined termination. Preserve raw hashes and canonical base64 fingerprints, and prove event-loop responsiveness on a 190 MiB journal.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Stream proof reads through a fixed buffer, retain only authority evidence, and preserve full-file digests and warm-transition fingerprints. Fail closed when essential evidence exceeds the bounded projection budget.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Preserve terminal unsafe-archive repairs and future retry delays when an earlier reconciler snapshot enters after the live owner releases copyback.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Add native read, update, history, and restore operations with server-bound identity and revision compare-and-swap safety. Register the default catalog and API discovery paths; cover real authority authorization and exact revision restore.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Implement PAP-66 foundation: exact content history, transactional compare-and-swap saves, current responsible-user authorization, recoverable materialization, and editor history. Keep run staging and cleanup integration with PAP-63.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Preserve the accepted result and retained sandbox, distinguish repairable unsafe paths from missing sandboxes, and keep transient copy-back failures retryable.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Keep large response artifacts inspectable through the existing authenticated API route. Preserve company and run authority, UTF-8 boundaries, and transfer limits. Reproduce the artifact loop through real HTTP and add an explicit full-stack fixture.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Preserve native coordinator ownership while accepted results await workspace
copy-back, assessment, or arbitration. Check that ownership in the terminal
update so a coordinator recorded after the liveness read is also protected.
Keep terminal task authority and exhausted-retry cleanup unchanged.
Validation: 28 focused recovery tests, local typecheck/build, 52 passing CI
checks, and Greptile 5/5 with no open findings.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Keep assigned app tools accessible when the combined Runner catalog exceeds
its operation or byte limits. Reserve task and completion tools, then expose
bounded discovery and call tools for large catalogs. Fetch oversized schemas
in reauthorized chunks without blocking later search results.
Retain task ownership, work-mode restrictions, pinned assignments, current
gateway authorization, approvals, and audit. Small catalogs stay direct.
Validation: 46 focused server tests, two Runner capacity tests, local
typecheck/build, 52 passing CI checks, and Greptile 5/5 with no open findings.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
