Files
PaperClipAI/server/src/__tests__/native-cancellation-delivery.test.ts
T
DottaandPaperclip 16787e4167 Qualify rolling web deployments and preserve Stop through handoff (#18526)
## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work.
> - The web server owns request handling and remote execution
coordination.
> - Deployment must start a ready replacement while the old server still
serves.
> - An outage test does not prove that two live servers can overlap
safely.
> - This pull request adds a separate Product E2E cell for that
boundary.
> - The existing run, file, recovery, and retained-session checks still
apply.

## Linked Issues or Issue Description

Refs #18518. The runtime prerequisite is merged; this PR qualifies its
ephemeral server and deployment contracts.

## What Changed

- Add the explicit `rolling-web-deployment` Codex Daytona workflow.
- Start independent A/B/C homes and compiled builds behind a test
ingress.
- Wait for readiness before routing, then drain and delete the old home.
- Observe active authority before handoff and use the existing read-only
recovery oracle.
- Require ordinary reads and saves to succeed throughout replacement.
Read back every accepted save exactly once.
- Preserve the five-minute outage suites and their existing validators.
- Add a model-free supervisor smoke and an unready replacement control.
- Require graceful exit before deleting an old home; forced cleanup
cannot satisfy the oracle.
- Preserve a durable Stop through lease release/expiry until the
recovered execution owner acknowledges it. Permit only fenced
reattachment of the original execution for Stop cleanup; submit no new
turn.
- Exclude events saved by A during shutdown from evidence of B making
progress.

## Verification

- E2E TypeScript check passed.
- Affected harness checks: 143 passed. Catalog, fixture and report
checks: 120 passed.
- Actual supervisor smoke passed two replacements: 436 reads, 45 saves,
zero request failures, and confirmed owned resource cleanup.
- B became ready in 18.7 seconds; C became ready in 109.2 seconds. A
prior C timeout remains failed evidence.
- Fresh browser proof: 11 checks passed, 246 reads, 50 acknowledged
saves, zero failures, 1,058ms reconnect, both old homes deleted and
cleanup confirmed.
- Stop lease-gap regression: three PostgreSQL delivery tests passed with
a simulated provider edge. Current server TypeScript build/vendoring
passed.
- Full harness: 5,814 passed, 17 failed, four skipped. Two shutdown
races passed the focused file; two report timeouts passed an isolated
42-test rerun. Onboarding/workflow-security/Pi/date-expired fixtures are
unchanged on inspected master; the host embedded PostgreSQL fixture
remains a setup limitation. This is not a green full local suite.
- CI at `172509b8be` passed all gates. Greptile is 5/5 with every review
thread resolved. The earlier access-service race failure passed its
isolated regression and the subsequent full CI.
- Final review corrections: six focused executor cases, three PostgreSQL
command-delivery cases, 19 harness cases and server/E2E typechecks
passed.
- Three live attempts failed before agent creation: two harness setup
gaps were fixed, then provider authentication failed. The saved OpenAI
key returns 401; a refresh is pending. The Daytona probe reported
cleanup uncertain, and no sandbox with that attempt label was found
through the authenticated staging manager. No live model execution is
claimed.
- Live Runner overlap, released-container qualification and hosted
deployment proof remain pending. Merging this opt-in qualification lane
does not claim those results.

## Risks

- The source lane shares workspace dependencies and does not establish
container packaging correctness.
- The live workflow needs an explicitly owned S3 bucket, PostgreSQL,
pinned remote image and provider credentials.
- Qualification cleanup stops all owned processes after failure. A
failed replacement must not be reported as a pass.

## Model Used

OpenAI Codex, GPT-6. Tool use, code execution and repository review. The
runtime does not expose a more specific model ID or context-window size.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

---------

Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-11-01 02:53:27 -06:00

97 lines
7.4 KiB
TypeScript

import { randomUUID } from "node:crypto";
import { eq } from "drizzle-orm";
import { afterAll, beforeAll, beforeEach, afterEach, expect, it, vi } from "vitest";
import { agents, companies, issues, heartbeatRuns, nativeRunFinalizations, createDb } from "@paperclipai/db";
import { startEmbeddedPostgresTestDatabase } from "./helpers/embedded-postgres.js";
import { createDeliveryWorkCoordinator } from "../services/delivery-work-coordinator.js";
import { deploymentNotifications } from "../services/deployment-notifications.js";
import { nativeCancellationHasUnsettledOwner, notifyNativeCancellation, registerNativeCancellationDelivery, waitForNativeCancellation } from "../services/native-runtime/native-cancellation-delivery.js";
import { currentNativeControllerIdentity } from "../services/native-runtime/native-restart-recovery.js";
import { setNativeExecutionActive } from "../services/native-runtime/native-active-runs.js";
const provider = vi.hoisted(() => ({ stop: vi.fn() }));
vi.mock("../services/native-runtime/native-session-executor.js", () => ({ cancelNativeSession: (...args: unknown[]) => provider.stop(...args) }));
let database: Awaited<ReturnType<typeof startEmbeddedPostgresTestDatabase>>;
let a: ReturnType<typeof createDb>, b: ReturnType<typeof createDb>;
let companyId: string, runId: string, intentId: string;
let bridgeA: ReturnType<typeof deploymentNotifications>, bridgeB: ReturnType<typeof deploymentNotifications>;
let coordinatorA: ReturnType<typeof createDeliveryWorkCoordinator>, coordinatorB: ReturnType<typeof createDeliveryWorkCoordinator>;
let worker: ReturnType<typeof registerNativeCancellationDelivery>;
const errors: unknown[] = [];
beforeAll(async () => {
database = await startEmbeddedPostgresTestDatabase("cancellation-delivery-");
a = createDb(database.connectionString); b = createDb(database.connectionString);
companyId = randomUUID(); runId = randomUUID(); intentId = `native-cancellation:${randomUUID()}`;
const agentId = randomUUID(), issueId = randomUUID(), identity = await currentNativeControllerIdentity();
await a.insert(companies).values({ id: companyId, name: "Cancellation fixture", issuePrefix: "STOP" });
await a.insert(agents).values({ id: agentId, companyId, name: "Remote fixture" });
await a.insert(issues).values({ id: issueId, companyId, title: "Stop fixture", status: "in_progress" });
await a.insert(heartbeatRuns).values({ id: runId, companyId, agentId, runtimeMode: "native", status: "running", nativeIssueId: issueId });
await a.insert(nativeRunFinalizations).values({ runId, companyId, issueId, phase: "executing", controllerBootId: identity.bootId,
leaseOwner: "fixture-owner", leaseExpiresAt: new Date(Date.now() + 60_000) });
coordinatorA = createDeliveryWorkCoordinator({ owner: a, canRun: () => true, onError: error => errors.push(error) });
coordinatorB = createDeliveryWorkCoordinator({ owner: b, canRun: () => true, onError: error => errors.push(error) });
bridgeA = deploymentNotifications(a, coordinatorA, { directDatabaseUrl: database.connectionString });
bridgeB = deploymentNotifications(b, coordinatorB, { directDatabaseUrl: database.connectionString });
await Promise.all([bridgeA.ready(), bridgeB.ready()]);
setNativeExecutionActive(runId, true);
provider.stop.mockImplementation(async (id: string, _reason: string, options: { db: typeof a }) => {
expect(id).toBe(runId); expect(options.db).toBe(a);
// Simulated provider edge; the production consumer, PG transport, owner
// selection, intent and accepting-server ACK wait are exercised for real.
await a.transaction(async tx => {
await notifyNativeCancellation(tx);
await tx.update(heartbeatRuns).set({ resultJson: { nativeCancellation: { intentId, dispatchState: "acknowledged", dispatched: true,
acknowledgementAuditId: "fixture-audit" } } }).where(eq(heartbeatRuns.id, runId));
});
});
worker = registerNativeCancellationDelivery(a, coordinatorA); await worker.ready;
}, 90_000);
beforeEach(() => { provider.stop.mockClear(); });
afterEach(() => vi.unstubAllEnvs());
afterAll(async () => {
setNativeExecutionActive(runId, false); await worker?.stop();
await Promise.all([bridgeA?.stop(), bridgeB?.stop()]);
await Promise.all([coordinatorA?.stop(), coordinatorB?.stop()]);
await Promise.all([a?.$client.end({ timeout: 1 }), b?.$client.end({ timeout: 1 })]); await database?.cleanup();
});
it("routes a committed Stop from B to its live owner A and returns only A's acknowledgement", async () => {
await b.transaction(async tx => {
await notifyNativeCancellation(tx);
await tx.update(heartbeatRuns).set({ resultJson: { nativeCancellation: { schema: "paperclip.native-cancellation.v1", intentId,
scope: "run", dispatchState: "pending" } } }).where(eq(heartbeatRuns.id, runId));
});
await expect(waitForNativeCancellation(b, { companyId, runId, intentId })).resolves.toEqual({ dispatched: true, decisionId: null, auditId: "fixture-audit" });
expect(provider.stop).toHaveBeenCalledTimes(1); expect(errors).toEqual([]);
});
it("fails closed on a different intent and never accepts a no-op acknowledgement", async () => {
await expect(waitForNativeCancellation(b, { companyId, runId, intentId: "wrong-intent" })).rejects.toThrow("intent_conflict");
await b.update(heartbeatRuns).set({ resultJson: { nativeCancellation: { intentId, dispatchState: "acknowledged", dispatched: false,
acknowledgementAuditId: "not-dispatched" } } }).where(eq(heartbeatRuns.id, runId));
await expect(waitForNativeCancellation(b, { companyId, runId, intentId }, 50)).rejects.toThrow("pending_recovery");
});
it("keeps Stop pending across lease release and delivers after normal ownership resumes", async () => {
vi.stubEnv("PAPERCLIP_EPHEMERAL_SERVER", "true");
expect(await nativeCancellationHasUnsettledOwner(b, runId)).toBe(true);
await b.update(nativeRunFinalizations).set({ controllerBootId: "another-controller" }).where(eq(nativeRunFinalizations.runId, runId));
expect(await nativeCancellationHasUnsettledOwner(b, runId)).toBe(true);
await b.update(nativeRunFinalizations).set({ leaseExpiresAt: new Date(0) }).where(eq(nativeRunFinalizations.runId, runId));
expect(await nativeCancellationHasUnsettledOwner(b, runId)).toBe(true);
await b.update(heartbeatRuns).set({ resultJson: { nativeCancellation: { schema: "paperclip.native-cancellation.v1", intentId,
scope: "run", dispatchState: "pending" } } }).where(eq(heartbeatRuns.id, runId));
const acknowledged = waitForNativeCancellation(b, { companyId, runId, intentId });
const identity = await currentNativeControllerIdentity();
// Simulate only the normal recovery owner's claim; no test-owned dispatch or
// acknowledgement. Production delivery must consume the durable pending Stop.
await a.transaction(async tx => {
await notifyNativeCancellation(tx);
await tx.update(nativeRunFinalizations).set({ controllerBootId: identity.bootId, leaseExpiresAt: new Date(Date.now() + 60_000) })
.where(eq(nativeRunFinalizations.runId, runId));
});
await expect(acknowledged).resolves.toMatchObject({ dispatched: true, auditId: "fixture-audit" });
expect(provider.stop).toHaveBeenCalledTimes(1);
await a.update(heartbeatRuns).set({ status: "cancelled" }).where(eq(heartbeatRuns.id, runId));
expect(await nativeCancellationHasUnsettledOwner(b, runId)).toBe(false);
vi.stubEnv("PAPERCLIP_EPHEMERAL_SERVER", "false");
expect(await nativeCancellationHasUnsettledOwner(b, runId)).toBe(false);
});