Files
PaperClipAI/packages/db/src/native-runner-recovery-migration.test.ts
T
Dotta 7b094724e6 fix(runner): recover native sessions across restarts (#12845)
## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work.
> - The Paperclip Runner keeps durable run and provider state outside
one server process.
> - A server restart can leave that runner alive or can interrupt it
after a provider checkpoint.
> - The old startup path used handoff intent and PID evidence, but it
did not reconstruct native ownership.
> - That gap could block the issue, create a replacement run, or start
duplicate provider work.
> - This pull request adds durable same-run recovery for coordinated and
uncoordinated restarts.
> - The benefit is exact recovery of the run, runner, session, provider,
steering, and finalization state.

## Linked Issues or Issue Description

Refs #9628. That pull request added earlier local-adapter hot-restart
work. This change adds native PRP authority reconstruction and same-run
provider resume.

Refs #10935. That pull request handles missing hot-restart snapshots.
This change also supports hard restarts with no snapshot.

Refs #11624. That pull request prevents unsafe retry after an adopted
legacy process exits. This change reconciles native terminal evidence
before provider recovery.

Refs #12070. That pull request improves process liveness checks. This
change also binds recovery to a process-start fingerprint and fails
closed on ambiguity.

**What happened?**

The server could record hot-restart intent, but startup did not rebuild
native runner ownership. A live runner could not re-register its PRP
authority. A dead runner could not resume the exact native and provider
session on the same heartbeat run. Generic recovery could then block the
issue or create replacement work.

**Expected behavior**

A live native runner must reconnect with the same PID and logical
identities. A dead runner must resume the same durable session and
heartbeat run with only a new operating-system PID. A proposed or
terminal result must finalize once before any provider turn starts.
Ambiguous process or session evidence must stay blocked without a signal
or duplicate spawn.

**Steps to reproduce**

1. Start a Paperclip Runner heartbeat and wait for an active provider
turn.
2. Restart only the Paperclip server, with or without a hot-restart
marker.
3. Observe that the old startup path does not reconstruct the native
control-plane authority.
4. Kill both the server and runner after a provider checkpoint.
5. Observe that the old path cannot resume the exact native session on
the original heartbeat run.

**Paperclip version or commit**

The defect was reproduced from commit
`1991f31fd53e7f7794d5c2e4b93be384ade2b41d`. This branch is rebased onto
the current `master`.

**Deployment mode**

Local development and self-hosted server deployments that use the local
Paperclip Runner.

## What Changed

- Added correlated hot-restart requests and version-compatible native
handoff fields.
- Added controller boot identity, process-start identity, controller
generation, recovery state, request id, and bounded history to the
native finalization ledger.
- Added transactional recovery claims for live-runner reattach,
dead-runner resume, and incomplete bootstrap.
- Added fail-closed ownership takeover rules and process identity
validation.
- Added live runner adoption to the local runner transport without a
duplicate spawn.
- Added same-run provider checkpoint resume and legacy retry-row
compatibility.
- Reconciled proposed and terminal results before runner or provider
recovery.
- Bound the HTTP and PRP listener before startup recovery and delayed
scheduling and generic reapers until classification completes.
- Added restart-aware health diagnostics, run-log recovery transitions,
durable runner diagnostics, and bounded shutdown finalizer draining.
- Moved restart-survivable diagnostics into runner-owned, pre-redacted
bounded writes; raw stdout and stderr are never persisted.
- Added process-start fencing for controller, runner, and provider PIDs;
startup classifies every candidate without an implicit cap.
- Added crash-recoverable, contention-safe development restart-request
coordination and failed-startup listener cleanup.
- Added a credential-free real-process restart suite for eight restart,
scale, and identity scenarios.
- Documented native restart operation, persistence, diagnostics, and
verification.

## Verification

- The documented native restart commands passed. They ran eight
real-process/database recovery scenarios and the live runner adoption
transport test.
- Native executor tests passed: 111 tests.
- Heartbeat recovery tests passed: 124 tests.
- Hot restart, health, and shutdown tests passed: 52 tests.
- The broader affected server suite passed: 350 tests.
- Focused native recovery and startup tests passed: 49 tests.
- Runner transport and control-plane tests passed: 63 tests.
- Runner-owned diagnostic tests passed for write-time bounding,
credential redaction, private file modes, and raw stream
non-persistence.
- Development restart coordination tests passed: 11 tests.
- Database migration checks and the partial-application/replay
regression test passed.
- Server, database, and Paperclip Runner typechecks passed.
- `git diff --check` passed.
- Full Paperclip PR CI passed, including build, canary, all five general
server shards, all five serialized server shards, all three browser E2E
shards, workspace suites, and release-registry verification.
- Greptile completed at 5/5 with no outstanding findings,
recommendations, follow-ups, or open review threads.

## Risks

- Moderate risk. This changes startup ordering and ownership transfer
for active native runs.
- The migration adds nullable columns and does not rewrite existing
rows.
- Recovery fails closed when process or durable session identity is
incomplete or contradictory.
- The first implementation supports the local Paperclip Runner. Remote
targets keep their existing behavior.
- The real-process suite covers cleanup and asserts that no runner or
provider process survives each test.

> For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and
discuss it in `#dev` before opening the PR. Feature PRs that overlap
with planned core work may need to be redirected — check the roadmap
first. See `CONTRIBUTING.md`.

## Model Used

- OpenAI Codex with GPT-5. The runtime did not expose a more specific
model revision or context-window size. Repository editing, shell
execution, database tests, and real-process test execution were enabled.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
2026-09-04 15:03:53 -05:00

156 lines
4.6 KiB
TypeScript

import { readFile } from "node:fs/promises";
import { afterEach, describe, expect, it } from "vitest";
import postgres from "postgres";
import {
EMBEDDED_POSTGRES_TEST_TIMEOUT_MS,
getEmbeddedPostgresTestSupport,
startEmbeddedPostgresTestDatabase,
} from "./test-embedded-postgres.js";
const cleanups: Array<() => Promise<void>> = [];
const support = await getEmbeddedPostgresTestSupport();
const describeEmbeddedPostgres = support.supported ? describe : describe.skip;
afterEach(async () => {
while (cleanups.length > 0) await cleanups.pop()?.();
});
describeEmbeddedPostgres("native runner recovery migration", () => {
it(
"repairs a partial application and can be replayed without changing the schema",
async () => {
const database = await startEmbeddedPostgresTestDatabase(
"paperclip-native-recovery-migration-",
);
cleanups.push(database.cleanup);
const sql = postgres(database.connectionString, {
max: 1,
onnotice: () => {},
});
cleanups.push(async () => sql.end());
const migration = await readFile(
new URL(
"./migrations/0238_graceful_infant_terrible.sql",
import.meta.url,
),
"utf8",
);
const statements = migration
.split("--> statement-breakpoint")
.map((statement) => statement.trim())
.filter((statement) => statement.length > 0);
// Model an interrupted migration: earlier statements committed, but one of
// the later columns did not. Reapplying must skip completed work and repair
// only the missing portion.
await sql`ALTER TABLE "native_run_finalizations" DROP COLUMN "recovery_request_id"`;
for (const statement of statements) await sql.unsafe(statement);
const columnsAfterRepair = await sql<
{
columnName: string;
dataType: string;
isNullable: "YES" | "NO";
columnDefault: string | null;
}[]
>`
SELECT
column_name AS "columnName",
udt_name AS "dataType",
is_nullable AS "isNullable",
column_default AS "columnDefault"
FROM information_schema.columns
WHERE table_schema = 'public'
AND table_name = 'native_run_finalizations'
AND column_name IN (
'controller_boot_id',
'controller_pid',
'controller_process_started_at',
'controller_generation',
'recovery_state',
'recovery_request_id',
'recovery_history'
)
ORDER BY column_name
`;
for (const statement of statements) await sql.unsafe(statement);
const columnsAfterReplay = await sql<
{
columnName: string;
dataType: string;
isNullable: "YES" | "NO";
columnDefault: string | null;
}[]
>`
SELECT
column_name AS "columnName",
udt_name AS "dataType",
is_nullable AS "isNullable",
column_default AS "columnDefault"
FROM information_schema.columns
WHERE table_schema = 'public'
AND table_name = 'native_run_finalizations'
AND column_name IN (
'controller_boot_id',
'controller_pid',
'controller_process_started_at',
'controller_generation',
'recovery_state',
'recovery_request_id',
'recovery_history'
)
ORDER BY column_name
`;
expect(columnsAfterReplay).toEqual(columnsAfterRepair);
expect(columnsAfterReplay).toEqual([
{
columnName: "controller_boot_id",
dataType: "text",
isNullable: "YES",
columnDefault: null,
},
{
columnName: "controller_generation",
dataType: "int4",
isNullable: "NO",
columnDefault: "0",
},
{
columnName: "controller_pid",
dataType: "int4",
isNullable: "YES",
columnDefault: null,
},
{
columnName: "controller_process_started_at",
dataType: "timestamptz",
isNullable: "YES",
columnDefault: null,
},
{
columnName: "recovery_history",
dataType: "jsonb",
isNullable: "NO",
columnDefault: "'[]'::jsonb",
},
{
columnName: "recovery_request_id",
dataType: "text",
isNullable: "YES",
columnDefault: null,
},
{
columnName: "recovery_state",
dataType: "text",
isNullable: "YES",
columnDefault: null,
},
]);
},
EMBEDDED_POSTGRES_TEST_TIMEOUT_MS,
);
});