Files
PaperClipAI/tests/runner-e2e/LIFECYCLE-BASELINE.md
T
DottaandPaperclip 96bf004a79 fix: use persisted state for lifecycle continuation and retry budgets (#13888)
## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work.
> - Its control plane decides when a task can continue, wait, stop, or
complete.
> - Legacy continuation could change when an agent changed its wording
without changing task state.
> - Shared attempt counts also let repair and infrastructure retries
affect each other's limits.
> - This pull request uses persisted state and separate, bounded
allowances for these decisions.
> - If automatic repair stops, the task explains what happened and
offers a guarded retry.
> - Paired tests and real-provider evaluations verify that Stop,
approvals, ownership, and spending limits remain authoritative.

## Linked Issues or Issue Description

Related work: Refs #13761, Refs #11126, Refs #13610. These cover
obsolete continuation dispatch and retry storms. Open and closed issues
and PRs were searched for related lifecycle, continuation, and retry
work.

**What happened?**
Legacy continuation depended on English wording and progress heuristics.
Repair, failure retry, and productive continuation could consume shared
counts. When bounded repair stopped, the task showed a technical
recovery message without a clear next action.

**Expected behavior**
Persisted disposition and owned execution paths determine the next
action. Missing disposition prompts bounded agent repair. Explicit work
mode determines planning mode. Narrative changes and raw activity counts
cannot replenish allowances. An exhausted repair shows a readable
notice. An explicit retry checks current controls and preserves the
assigned agent.

**Steps to reproduce**
Run `pnpm test:lifecycle-baseline`. The paired probes keep structured
state constant while varying completion, planning, blocker, and progress
prose. Run the explicit `lifecycle-baseline` and
`continuation-accounting` Product E2E suites for real-provider coverage.
In Storybook, open **Design previews / Recovery notice** to inspect the
production component's normal, pending, acknowledged, unavailable,
failure, and mobile states.

## What Changed

- Hide the image attachment button, icon, and drop/paste hint in answer
composers. Image paste and drop support remains available.
- Merge current master and retain both browser regression sets. Use a
production-stamped service worker in the offline recovery browser
fixture.
- Share one state-based legacy continuation decision across immediate,
delayed, and recovered dispatch. Bind bounded repairs to their source
run and episode.
- Remove title and description wording from work-mode authority. Agents
can still write requested plans in execution mode.
- Persist separate failure-retry and productive-continuation counters.
Disposition repair and resource waits cannot consume or reset those
allowances.
- Validate delayed repair identity, then recheck current gates before
provider dispatch. Fence native startup cancellation.
- Show **Agent needs attention**, a plain-language explanation, **Retry
agent**, and expandable details in both task interfaces. Report request
progress, acknowledgement, and errors inline.
- Store typed recovery notice metadata. Recognize older active notices
only through exact stored action and run IDs. Notice text never grants
retry authority.
- Use the existing recovery-action endpoint for retry. Recheck current
action, status, owner, agent availability, dependencies, active runs,
pending questions and confirmations, approvals, pause controls, and
budget. Duplicate requests do not wake twice.
- Add component, page, route, database, contract, and Storybook
coverage. Keep the scenario inventory and executable evals here.
Historical reports and snapshots live in the [commit-pinned
paperclip-evals
archive](https://github.com/paperclipai/paperclip-evals/blob/ce3e5afcd4a1184650f586a2b5b8be5874c66c8b/experiments/2026-09-lifecycle-authority/README.md).
- Preserve unsaved project fields while the same project URL changes to
its canonical alias. Do not reuse data across projects or companies.
This separate fix addresses the repeated repository-editor browser
failure without changing the browser test.
- Keep the development service worker from intercepting Vite module
reloads. Update the connection-intent browser fixture to record progress
and completion through the agent API.

## Verification

Merge preparation on September 25, commit
`c1e8e4b7ddd9fbc4913ed55ce21b8e12906c2f97`:

- Merged master `bd2030932` and resolved the browser test-list conflict
by keeping both sets of regressions.
- Deterministic lifecycle baseline: 1,090/1,090 assertions passed; no
failures, skips, or missing selected evidence. Unit 423, runner 184,
database integration 397, grading 86.
- Browser support: 17/17 passed. The offline recovery test first failed
with an unstamped development worker, then passed with the production
stamp. Its assertions are unchanged.
- Focused interaction UI and offline fallback tests: 19/19 passed.
Verified the custom-answer composer in Storybook: no attachment controls
or hint; entering an answer enables Next.
- Recursive typecheck, production build, token gates, and diff checks
passed. The worktree is clean. No new real-provider campaign was run.
- Current CI and review: [Current PR CI
passed](https://github.com/paperclipai/paperclip/actions/runs/36166011243):
55 successful checks and two optional Storybook skips. Greptile scored
this exact commit 5/5. Hiding the question attachment controls is an
intentional UI change; paste/drop remains available.

Earlier recovery UI verification, commit
`21be0fec0e90e86b6d662b8ee4831847cd041cdb`:

- Recursive typecheck, production build, token gates, and diff checks
passed.
- Focused UI coverage: 338 tests passed across six suites (336 before
the interaction guard, with the two affected suites rerun at 149 passed
after it). Covers both task interfaces, the real page mutation,
pending/error acknowledgement, stale state, and unavailable controls.
- Recovery database integration: 352 tests passed before the interaction
guard. The complete recovery-action and mutation-route suites passed 181
tests after it. The two new pending question/confirmation regressions
failed before the fix and passed afterward, including
resolved-interaction controls. Shared validator suite: 31 passed. E2E
catalog suites: 34 passed.
- Browser inspection passed for light/dark themes, mobile layout,
expandable details, pending retry, acknowledgement, failure, and
disabled retry. Storybook renders the production component; its request
is simulated.
- The broad local run hit two chat callback-order wait failures and was
stopped after all CI unit/database/runner shards passed. Both local
failures passed when rerun without the competing full-suite process.
- CI exposed a repeated project-repository draft-loss race during
canonical redirects. A new unit regression failed before the fix; all
nine project-page tests now pass, including controls for other projects
and companies. Both unchanged repository browser tests passed against a
fresh local server. UI typecheck, production UI build, and token gates
passed after this fix.
- [Earlier PR CI
passed](https://github.com/paperclipai/paperclip/actions/runs/36072486798)
on `21be0fec0e90e86b6d662b8ee4831847cd041cdb`: 55 successful checks, two
optional Storybook skips, and no failed or pending checks. The
repository browser shard passed with the production fix. Greptile is 5/5
on this exact commit with no unresolved review threads. The PR is
mergeable.

Historical, source-qualified lifecycle evidence:

- Lifecycle baseline: 1,074 assertions. Native session coverage: 447
tests. Product E2E support: 515 tests. Browser support: 11 tests. Full
earlier verification is retained in the archive.
- [Real-provider campaign: 8/8 passed, zero
retries](https://d1p6rlowie26tp.cloudfront.net/runner-e2e/campaigns/gha-35881382080-1/index.html),
source `e88d210417280140b44a36449027290adcb1aeaa`. Evidence and cleanup
checks passed. This includes deliberately exhausted repair cases that
correctly remain blocked; it does not mean every task finished Done.
This campaign predates the recovery UI change.
- Archive migration verified all 16 original JSON files byte-for-byte
and all 24 checksum entries. App tests do not need private archive
access. [Archive PR
#27](https://github.com/paperclipai/paperclip-evals/pull/27) is merged.

## Risks

- Agents that omit durable disposition receive at most two repair
attempts by default. Prose-only completion exposes missing state rather
than silently changing scheduling.
- A retry is an explicit board action. The server rechecks current
controls. A successful response confirms the task returned to To do; it
does not claim that the provider has already started.
- Existing notice metadata remains valid. Only older active notices with
matching structured evidence receive the new UI. Historical notices
without that evidence keep their existing rendering. No schema migration
is required.
- Old run records require conservative retry accounting. Tests cover old
counters, alternating retry lanes, restarts, and exhausted repairs.
- Historical snapshots require private `paperclip-evals` access. The app
index retains public campaign links. Live campaigns qualify specific
sources and scenarios; no new real-provider campaign has run for the
recovery UI commit.

> This fixes existing lifecycle and recovery behavior and does not
duplicate planned core work.

## Model Used

OpenAI GPT-6 through Codex assisted implementation, reasoning, code
execution, and review. The exact serving model ID and context window are
not exposed in this task. Historical real-provider evaluations used
Codex model `gpt-5.6-sol`, separately from the implementation assistant.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change and contains no internal
Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

---------

Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-09-25 15:28:11 -07:00

8.9 KiB

Live lifecycle baseline

This explicit-only Product E2E suite runs real Chromium, Paperclip, an isolated database, the selected runner, and a real LLM. It is distinct from pnpm test:lifecycle-baseline, whose providers are scripted.

Authored selection

lifecycle-baseline has 40 cells: 20 journeys on each of legacy-codex and runner-codex, using their existing qualified model settings and the local fixture. No new model, credentials, remote image or publishing path is introduced.

Journey Cases per runtime Independent evidence
Complete despite background wording 2 Exact visible response, Done, one successful run, no execution lock, recovery, monitor or pending interaction
Remain blocked on a missing dataset 2 Exact quoted response, Blocked, one successful run, structured native blocker/public legacy dependency transition, no invented completion or scheduled work
Ask and consume a changed answer 2 Durable question and original answer identity, revised saved output, no premature output
Clarification is not approval 2 Initial question, answered-but-still-waiting checkpoint, explicit approval, then saved output
Revise a plan without dropping approval 2 Current task/revision-bound confirmation, revision checkpoint before approval, final output
Read useful data from an untrusted handoff 2 Real file reference used; injected instruction rejected
Preserve completed dependency across restart 2 One completed child before the question; same child and run receipts after server restart and answer
Ordinary conversation and stop/new request 2 Existing clarify-reuse and stop-new-resume production browser journeys
Governed service action 4 Approve, decline, remembered permission, restart; actual local service invocation counts and saved decisions

Each two-case pair has neutral and challenge variants. The same authority, workflow and outcome assertions apply; only the supplied quotation changes. Challenges include negation, historical approval, Spanish approval language, completion claims and optional next-step language. Both variants must be retained in a campaign; a single successful cell does not establish invariance.

Continuation probes ask the real agent to post the quotation before the first wait. The grader requires exactly one matching agent-authored comment attributed to a run observed at that checkpoint. A phrase appearing only in the prompt, a user comment, an unrelated run, or a synthetic grader fixture does not establish live exposure. Completion/blocker probes require the exact visible response.

Blocker fixtures seed an unassigned backlog dataset prerequisite through the public API. Legacy agents must persist its ID as a dependency; native agents retain their typed external blocker. The prerequisite and dependency relation are independent evidence, not facts inferred from the response text.

Approval fixtures explicitly name the proposal document plan and require confirmation of its current revision. This keeps the pre-approval output oracle independent of how an agent happens to name an approach; an arbitrary deliverable targeted for confirmation must still fail.

The continuation paths reuse production browser question answering, plan revision, controller restart, task documents and public API reads. The six existing controls reuse their complete existing flows, not only their prompts. Setup and cleanup use the normal fixture registry; no test database writes or scripted providers are used in these live cells. Screenshots and snapshots use the existing sanitized attempt package, source/catalog provenance, usage and cost accounting.

Discover, validate, execute

pnpm test:e2e:runner:typecheck
pnpm test:e2e:runner:unit
pnpm test:e2e:runner -- --list --suite lifecycle-baseline

# Billable: smallest explicit real-provider cell.
pnpm test:e2e:runner -- --id lifecycle-baseline.runner-codex.local.lifecycle-completion-neutral

# Billable: paired question probes on both runtimes.
pnpm test:e2e:runner -- --suite lifecycle-baseline --case lifecycle-question-neutral --case lifecycle-question-challenge

# Billable: full 40-cell baseline.
pnpm test:e2e:runner -- --suite lifecycle-baseline --max-parallel 2

The suite is excluded from --all and generic selectors. Each cell owns an isolated instance and uses OPENAI_API_KEY through the existing secret references. Paired terminal cases budget one provider run and eight minutes; continuation cases inherit their two-to-four-run and ten-minute bounds; governed-action controls inherit their twelve-minute bound. Accounting reports actual usage and missing cost evidence, not prompt-authored cost estimates. There are no real third-party service mutations: the governed service is an authenticated local fixture exercised by the real LLM through production tool transport.

Status and remaining boundaries

Executed on GitHub Actions. See the live measurement record for the 40-cell Product E2E results, eight protocol eval results, test corrections, source revisions and retained failures. The initial 831-test report predates this suite; its count is not an LLM/E2E pass count.

Authoring validation on 2026-09-21: TypeScript passed, all 437 Product E2E support tests passed, all 4 baseline report/inventory tests passed, and discovery returned 40 cells. The sandbox initially prevented local socket/IPC setup in 10 support tests; rerunning the same support suite with local socket access passed. This was a test-environment restriction, not a provider run or product-behavior result.

The 13-scenario inventory maps all layers. Timing permutations, retry exhaustion, stale ownership, process terminal ordering, monitor due-time policy and cross-company authorization are primarily deterministic runner/service tests. This paid selection does not replace them or claim an exhaustive live Cartesian product. Live monitor protocol coverage remains in the Runner Eval roster; arbitrary process-crash recovery and exhausted-repair races are not new paid model cases.

The earlier native same_agent probes inject an internal compatibility result. The current public paperclip_finish schema exposes response_wake, which waits for a real response. Therefore those two failures do not demonstrate a reachable current model-facing autonomous-continuation defect. This live suite uses supported question/approval/dependency responses and restart boundaries; it does not instruct a model to emit unsupported same_agent output. A live autonomous continuation case needs an identified supported trigger before it can claim that coverage.

Legacy disposition repair follow-up (2026-09-22)

The current suite adds lifecycle-repair-neutral and lifecycle-repair-challenge for legacy-codex only: 42 cells total (the original 40 plus two). Each costs two provider turns. The first turn posts an attributed quotation and leaves the task in progress without a durable disposition. The server must automatically wake the agent for disposition repair, and the second turn must record completion through the public API. The independent oracle requires the source/repair episode binding, attempt 1 of 2, two successful runs, the initial attributed quotation, no user message, and final task completion. Missing evidence or a one-turn completion fails. Timeout, cleanup, screenshots, source provenance and billing use the ordinary single-turn fixture pipeline.

The historical 40-cell campaign records remain unchanged. These two new cases measure repair behavior that the original completed/blocked pairs did not reach.

Explicit work-mode follow-up (2026-09-22)

The current catalog adds lifecycle-work-mode-neutral and lifecycle-work-mode-challenge on both Codex runtimes: 46 cells total. Each new cell costs one provider turn. Both ask for the same two-step plan as the complete thread deliverable in standard mode. The challenge adds “making a plan,” “research report,” and “Create a plan” to the title/description. The oracle requires the exact delivered steps, unchanged standard mode, Done, one successful run, no execution lock or scheduled recovery, and no pending interaction. Missing mode evidence and an unintended switch to planning both fail. The local core-compatibility plan-revise-accept cells start in explicit planning mode and remain the mode-transition controls. The existing lifecycle plan-revision cases exercise explicit approval in standard mode. The new cases do not bypass either kind of approval requirement.

pnpm test:e2e:runner -- --list --suite lifecycle-baseline --case lifecycle-work-mode-neutral --case lifecycle-work-mode-challenge

The historical 40- and 42-cell campaigns remain unchanged. Current verification is tracked in the work-mode plan.