DottaandPaperclip
54cc522e86
## Thinking Path > - Paperclip manages agents and their work. > - Native Runner must bind each provider turn to the selected task, account, model, and instructions. > - Antigravity needs native ACP admission and physical process ownership across continuation. > - A saved conversation must not reuse an old process owner or silently switch its effective model. > - This pull request adds the native candidate behind exact operator admission. > - The default release gate remains closed while qualification is pending. ## Linked Issues or Issue Description Builds on merged #18187. Product account setup and the candidate producer are in dependent #18189. The repeatable browser journey is in #18190. Refs: #12503, #14938; those proposals use legacy CLI adapters. **Agent or provider** Google Antigravity ACP 1.4.3. **Why this adapter is useful** Users need to set up an Antigravity agent and run real work through their managed Google subscription. **How the agent is invoked** Native Paperclip Runner uses the pinned Antigravity ACP runtime. Exact operator admission is required while qualification remains pending. ## What Changed - Add native Antigravity ACP model and instruction admission, selected-account homes, and fenced refresh ownership. - Carry exact candidate authority from the control plane through Runner, Rust, the sidecar, and each current run. Clamp daemon lifetime to the absolute permission expiry, including replacement owners. - Preserve a rotated OAuth refresh token before later identity verification can fail, including failed or cancelled startup admission. Make private lease-close retries safe. - Bound native probe retirement and retry the exact original owner; do not delete credential homes before physical proof. - Preserve Gemini API-key recovery when shared Google subscription capability is added. - Resume the same tagged native conversation with fresh per-turn process ownership and physical native retirement. - Include native manifests in isolated Rust image stages, release cache keys, and dev rebuild detection. The workflow changes only extend existing cache input lists. - Keep current master provider behavior and append Grok 13, Pi 35, and Copilot 84 input identities. Preserve prior identities, including saved Copilot 82 and 83 runs. ## Verification - Runner TypeScript main checks, profile generators, Rust formatting, and offline workspace checks pass. The native backend integration target passes 28 tests. - The complete transport and cleanup group passes 387 tests without unhandled rejections. These checks use local scripted children and actual process and port ownership. - Saved-profile decoding, native-execution parsing, installation, and selected-credential controls pass 208 focused tests. All 109 pre-existing profile identity files remain byte-for-byte unchanged. Copilot, Grok, and shared TypeScript/Rust generation checks pass. - The final recovery fixture passes all seven cases. After the master rebase, the combined recovery and owned-Node-runtime group passes all 10 cases. Each expiry case sets one 45-second absolute grant before startup. It includes the deliberate six-second cold delay, four existing eight-second command budgets, and active-turn headroom. The test proves an active turn before expiry and then checks the daemon, owned process group, child processes, and all three native port fences. The 60-second test deadline does not renew provider authority. - The consolidated model-discovery and pending-release group passes 22 tests. Google credential compatibility and auth recovery pass 25 tests, including existing Gemini API-key recovery. The full product settings test group remains intact in #18189. - Earlier failures remain in their original CI runs and local records. They exposed the Copilot 82 decoder gap, an expired five-second fixture bootstrap ticket, and a fixture grant consumed before activation on loaded CI. Each repair has a separate result. Production ticket limits and admission behavior are unchanged by the final test commits. - An unrelated decision-expiry check failed in [the earlier CI run](https://github.com/paperclipai/paperclip/actions/runs/40941986698/job/123688668997). Its owning code is unchanged from the base. The unchanged suite passes 20 tests on isolated PostgreSQL. A controlled database rollback reproduces the earlier wake: clean startup schedules the 120-second decision expiry, while rollback reconciliation leaves a 30-second continuation-coalescing wake. The decision stays open, with no wake delivery or error. The fresh final-head server shard passes; the failed result is preserved. - Final native commit `ec6bc7e4d77f5ae0cc4946dbba6c662e95a87f5b` passed `ci / verify` and `ci / e2e`. Fresh Greptile and Paperclip reviews both score 5/5, with no open findings. Antigravity retains the recorded native `.5` closure and exact low-model profile. This PR does not claim global or cross-platform qualification. ## Risks - The new transport carries private managed credentials. Exact ownership, account generation, model, instructions, and native retirement are fail-closed. - Only local macOS ARM64 has a verified complete Antigravity runtime. Default Antigravity task execution remains disabled without current trusted operator admission. The Google server sign-in lane and production candidate producer ship in #18189; this native slice does not expose the subscription catalog choice. - Shared launch inputs change provider identities. New identities are append-only; existing recorded identities remain available. ## Model Used OpenAI Codex (GPT-6). The host did not expose the exact model revision or context limit. The model used tools for code edits, tests, and review. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
Paperclip Daytona runner image
Ordinary provider packs now include pinned Cursor assets for Linux x64; no
--candidate-providers=cursor flag is needed. Cursor admission is enabled after
the production readiness gates
passed. The public CLI installation command is paperclipai runtime setup cursor;
it runs explicitly on the execution host and is never an npm installation hook.
This image is the Paperclip Cloud fleet sandbox image plus a source-built
paperclip-runnerd and immutable provider pack. The pack contains Node 24.11,
OpenCode 1.18.34, the compiled OpenCode proxy, ACPX 0.13.1 sidecar, qualified ACP
agents, and the production lockfile. Its manifest digests each executable bridge
and records the runner source revision as provenance. Its interface declaration
allows compatible app releases to reuse it without uploading or installing a pack.
The fleet pins are intentionally copied from
paperclip-cloud/fleet-sandbox-image/Dockerfile.
Update both definitions together until the fleet base is published as a stable
image that this Dockerfile can extend directly.
Harness versions
The October 2026 refreshes pin Codex 0.160.0, Claude Agent SDK 0.3.286 (Claude Code 2.1.286), and OpenCode 1.18.34 in the shared provider pack. Claude Code 2.1.280 is the minimum for Opus 5.5 and 2.1.284 is the minimum for Sonnet 5.5; the pinned runtime also supports Fable 5.1. Codex 0.160.0 ships bundled metadata for the current GPT-6.1 Sol, GPT-6 Sol, and GPT-6 Luna model IDs. The sandbox layer pins Grok CLI 1.0.70, Gemini CLI 0.65.0, Kimi Code 2.3.3, Cursor CLI 2026.10.22-27dcf5f, and GitHub CLI 2.103.3 (October 2026 refresh). The native Cursor provider uses its separately verified distribution, pinned to 2026.09.26-dd393fe; it does not use the sandbox layer’s global Cursor executable. Grok CLI 1.0.70 supports the current Grok 4.7 model family. Hermes stays at 0.19.0, the newest release on PyPI.
Keep the patched ACP bridge versions separate from their CLI runtime pins. Their executable digests do not change when only the runtime dependency changes. Refresh the runtime executable digests from integrity-verified npm release archives for every supported platform, and keep the native runner, provider manifest, and remote controller version checks aligned.
Build and verify
Run pnpm --filter @paperclipai/paperclip-runner test:opencode:qualification
after installing dependencies to exercise the actual pinned OpenCode executable.
It checks health/version, session creation and retrieval, SSE messages, an async
prompt, and session deletion against a loopback mock provider. It uses an
isolated home, starts no paid model request, and retires its process group.
Set PAPERCLIP_TEST_OPENCODE_BINARY to the materialized Linux executable when
qualifying an assembled provider pack.
The fleet image is currently amd64-only because the pinned Cursor and GitHub CLI checksums cover amd64.
content_id="$(pnpm --silent test:e2e:runner:image-id)"
docker buildx build \
--platform linux/amd64 \
--build-arg PAPERCLIP_RUNNER_CONTENT_ID="${content_id}" \
--build-arg PAPERCLIP_RUNNER_SOURCE_REVISION="$(git rev-parse HEAD)" \
--tag "paperclip-daytona-runner:e2e-content-${content_id}" \
--load \
--file docker/daytona-runner/Dockerfile \
.
docker run --rm --platform linux/amd64 \
--entrypoint paperclip-runnerd \
"paperclip-daytona-runner:e2e-content-${content_id}" \
--build-metadata
The metadata must advertise dial_ws_loopback, dial_wss, and listen_ws.
The explicit entrypoint is needed only for this local probe because Daytona's
base image uses its own long-running sandbox entrypoint.
test:e2e:runner:image-id hashes the audited Docker build dependency closure,
target platform, the immutable Dockerfile syntax-frontend digest, and every
immutable FROM reference. It fails before the paid workflow can build when
the frontend or a base is not pinned to a sha256 digest. When updating the
syntax version, resolve and review its registry digest and update both values in
the first Dockerfile line. Git commits that do not change those inputs reuse the
same content tag.
PAPERCLIP_RUNNER_SOURCE_REVISION remains the full Git SHA that built the first
published copy and is retained as provenance rather than cache identity.
Use in Paperclip
Publish the image to a registry Daytona can pull, or use the environment
editor's Configure image flow to produce a Daytona snapshot. Set the
environment image to that immutable tag or snapshot. Paperclip probes the
sandbox user's PATH for paperclip-runnerd and codex and checks
/opt/paperclip-runner/provider-pack for OpenCode and ACPX. It uses the pack
when its selected provider interface and platform are compatible. App source
revisions and unrelated provider pins do not force an update. Startup reads the
small manifest in the existing runner metadata query. It does not scan the pack,
run a version command, or transfer files on this path. Otherwise it stages the pack configured by
PAPERCLIP_RUNNER_REMOTE_PROVIDER_PACK_PATH. Remote OpenCode and ACPX never
fall back to host-local processes.
src/live/provider-pack-contract.json in the Runner package declares the
OpenCode and ACPX interface revisions. Change a revision only for an incompatible
runner/pack boundary change, and qualify the new pack before publishing it.
Dependency versions and Git SHAs remain build provenance. ACPX retains its
selected agent's qualified profile checks.
The image build makes the pack root-owned and non-writable to the execution user. Fast admission requires protected ancestors and manifest, with no writable path alias. Task-owned packs and older packs without an interface declaration keep full content verification. An attached session retains the exact pack and daemon identity admitted at launch. Publish one new image with the interface declaration to enable reuse across later compatible app releases.
Do not promote paperclip-runner-e2e-20260826-v2 for OpenCode or ACPX. Build a
new immutable image or snapshot from a clean committed revision and pass that
full Git SHA as PAPERCLIP_RUNNER_SOURCE_REVISION.
Do not bake provider credentials, Paperclip bootstrap tickets, or Daytona preview tokens into this image. They remain per-run secret material.
The provider-pack build pins the official Linux x64 Node 24.21.0 image by manifest digest. Its bundled Undici is 7.29.1, which fixes GHSA-3wwx-pv8p-q78v. Pi separately verifies its private Node executable and nested npm dependency; changing the outer interpreter does not replace either provider-owned pin.
Provider CLI updates are manifest-only changes: repository CI owns the root
lockfile. Resolve the complete workspace manifest graph in the build context
before invoking Docker, matching CI when a source commit precedes the lockfile
bot. The trusted workflow supplies this resolved lockfile as an immutable artifact.
The complete resolved lockfile must match PAPERCLIP_RUNNER_LOCK_SHA256 before
package installation or lifecycle execution. Review and refresh that digest
with source dependency changes; registry-time resolution drift fails closed.
The Product E2E workflow resolves one lockfile before the image build. It
verifies the downloaded artifact, then passes that artifact's SHA-256 as the
PAPERCLIP_RUNNER_LOCK_SHA256 build argument. The Dockerfile checks the resolved
lock against this value before installation. The fixed Dockerfile default is
for standalone builds; it must not replace a campaign's verified lock digest.
Refresh the default from the clean tracked lockfile using the exact
pnpm install --resolution-only --ignore-scripts --no-frozen-lockfile command,
and verify a second resolution preserves the digest. A lockfile left by a
filtered or incremental install can retain stale importer patch identities.
Refresh exact runtime versions and qualification digests together; do not
download dependencies when a task starts.
Candidate ACP qualification assets
Provider branches can build their pinned assets with
node packages/paperclip-runner/scripts/build-provider-pack.mjs /absolute/pack --candidate-providers=cursor
(or copilot or pi). The source revision must include the named provider's
builder. Assets are installed at build time under provider-assets/<provider>/<platform>-<architecture>.
The pack manifest binds each complete asset tree. Runtime admission separately
checks the provider's source-owned closure pins and copies a verified launch snapshot.
A pack with candidate assets does not qualify or enable that provider.
For an isolated Linux x64 Daytona qualification image, pass
--build-arg PAPERCLIP_RUNNER_CANDIDATE_PROVIDERS=cursor with the normal build arguments.
Compute its content ID with the same selection:
pnpm --silent test:e2e:runner:image-id --candidate-providers=cursor.
Candidate assets and the default pack have distinct image identities. Never reuse
the default image's content ID for a candidate build.
Use each provider branch's recorded version and explicit model. Keep credentials
out of images. Paid qualification requires bound provider and Daytona credentials,
inspectable spend, and the shared $100 ceiling recorded in the capability report.
The pack builder tests its copied Node interpreter after relocation. Use a
standalone Node distribution if the host interpreter depends on a package manager's
private shared libraries. Pi additionally pins its complete portable interpreter
and npm dependency graph.
Refresh exact runtime versions and qualification digests together; never download
dependencies when a task starts. Grok's additive native ACP profile keeps its
qualified 1.0.13 executable at the verified sandbox prerequisite path. It does not replace the
legacy adapter's grok command on PATH.
Native Grok is an image prerequisite at /opt/paperclip/providers/grok/1.0.13/grok.
Its checksum-verified provisioning is separate from the provider pack, which ships
only the built-in launcher. Public npm installation never downloads this binary.