DottaandPaperclip
07721e33f7
## Thinking Path > - Paperclip lets people manage agents and shared company skills. > - Agents can author new skills or add existing skills from approved sources. > - Source import and catalog install retain the source used by update, audit and reset flows. > - The create_skill tool described saving complete Markdown, without explaining this choice. > - An agent can therefore read an existing source and create an unrelated managed copy. > - This PR explains the distinction in the existing tool contract and tests its actual model-facing projections. ## Linked Issues or Issue Description **What existing behavior does this improve?** The model-facing description of create_skill and the choice between authoring and source import. **Current behavior** The tool says it saves a complete single-file skill. It does not distinguish new authored content from adding an existing skill. The Company Skills reference already directs external sources to import and catalog skills to install. **Proposed behavior** The tool explains that it saves newly authored content. It directs existing-source work to the existing import or install APIs through search_api and call_api. It retains the existing assignment and retry guidance. **Reason and benefit** A managed copy does not retain the original source locator. Clear guidance helps an agent choose the source-aware operation without adding a tool or changing permissions. This is a guidance repair. It does not claim that the import backend failed. ## What Changed - Clarify the canonical documentation, live descriptor and scenario descriptor for create_skill. - Test the actual discovered contract and provider projection, including API claim and company-boundary negatives. - Refresh generated descriptions and the seeded catalog digest and manifest entry. ## Verification - A focused regression fails on the parent because the actual discovered contract lacks the authoring versus import distinction. - Three focused pure suites pass: 48 tests. They include existing skill creation, retry, schema and authorization controls. - The source-owned serializers and protocol fixture validator regenerated the inventories without an app or native build. - Both generated inventories change only create_skill description. Arguments, required claims, modes, idempotency and all other tools remain byte-equivalent. - Current head `bca441726a6cba80e6e7da0321db59e27183c5b8` passes required `ci / verify` and `ci / e2e`; the full main CI run has 49 successful jobs. Windows, Docker, security and review checks also pass or are intentionally skipped. Greptile and the final Paperclip review are 5/5, with zero unresolved threads. This PR remains deliberately unmerged for the separately reviewed evaluation candidate. - Original head CI preserved: one unrelated UI clipboard-confirmation assertion failed after the clipboard call passed; 47 other executions succeeded and the final verify check failed as its dependent. The two UI owners are unchanged from the base. Exact React scheduler/timer timing is unknown. No unchanged-head retry was used before the necessary master conflict sync. - The conflict sync preserves incoming task-assignment guidance and regenerates metadata. It is not a fix for the UI test failure. The synchronized current head passes CI and review. No same-head recovery was consumed. ## Risks The description changes model context and the catalog digest. It may affect tool choice, but actual same-request and same-model acceptance is still pending. The change does not alter authorization, API behavior or grading. Local checks did not run the app, database, native runner, full graph typecheck or build. Intermediate test-fixture claim and placement mistakes were corrected; the final focused run passes. Do not treat these pure controls as a feature pass. ## Model Used OpenAI GPT-6.1 Sol (`gpt-6.1-sol`) through Codex, with reasoning, source inspection and tool execution. The host does not report a context-window size. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs; narrow create_skill/import and skill-import-guidance searches found no duplicate. - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge Co-authored-by: Paperclip <noreply@paperclip.ing>
PRP v1/v2 Contract
The JSON Schema files in schemas/ are the language-neutral source of truth for
Paperclip Runner Protocol versions 1 and 2. The fixtures in fixtures/ define
accepted and rejected compatibility cases.
Compatibility
protocolVersion,fixtureVersion, andevent.schemaVersionare required.- A consumer fails closed when a required version or schema discriminator is not supported.
- A v1 envelope can contain an unknown optional property when its schema marks that object as extensible.
- A consumer ignores an unknown optional property until a later contract gives it meaning.
- A required field, enum value, or typed structured-input field is not optional.
- Question and answer identifiers are stable across the provider boundary.
- Peers negotiate the highest mutually supported protocol version. Existing v1 runners remain compatible but cannot receive v2-only session-goal commands.
The unknown-optional-fields.json fixture must be accepted. The
unsupported-required-version.json fixture must be rejected.
Session goals (v2)
PRP v2 adds a provider-neutral durable session-goal lifecycle. Every v2
capability snapshot includes sessionGoals, even when its availability is
unsupported or policy_disabled. Paperclip sends controls only when the
negotiated capability advertises the corresponding action.
Commands:
session.goal.getsession.goal.setfor objective, status, and optional token budget changessession.goal.clear
Events:
session.capabilities.updatedsession.goal.snapshotsession.goal.updatedsession.goal.cleared
Goal state is separate from Paperclip's company/business goal hierarchy. The
snapshot distinguishes the durable status from workingNow, because an active
goal can be idle between autonomous turns. A runner emits the full capability
and authoritative snapshot after every session open or resume. Missing v1
capability is unsupported; clients do not infer support from an adapter name.
Harness credential updates
auth.credentials.updated is a P0 runner event available in the v1, v2, and v3 event
schemas. Its payload uses paperclip.auth.credentials.updated.v1 and contains
only provider, bindingId, revision, and detection. No tokens, account
identifiers, credential paths, or credential fingerprints are permitted.
An updated consumer opts in with observeCredentials: true in run.prepare,
before session.open. The bundled runner transport opts in for fresh sessions;
set its observeCredentials option to false to disable observation for a
fresh session. Older hosts that omit the field receive no new event. Consumers
must update their schemas before opting in: an event-enum addition is not an
unknown optional property. Existing runner binaries ignore the optional flag
and do not provide observation; absence of an event does not establish support.
The current Unix runner observes native Codex's managed CODEX_HOME/auth.json
and the Codex/Grok ACPX session homes. It uses a non-recursive directory watch
plus a one-second polling fallback, so atomic file replacement is handled.
Grok's initial inline subscription credential is the baseline, allowing a
refresh during launcher startup to be detected. A first valid credential file
without a prior baseline establishes the baseline without claiming a refresh.
Account identity changes also emit updates, even when token values stay the
same, and establish the baseline for later refreshes on the new account.
Hosts must evaluate the current credential through their private credential
channel and account checks; the event does not authorize an account switch.
Metadata-only changes, partial writes, and deletion do not emit updates.
Unsupported harnesses and refreshes retained only in memory need
their own observer or native-hook integration; adding this event does not make
them observable.
bindingId: "harness-auth" identifies the selected harness authentication
within the envelope's normalized session. Revisions increase for that binding
and survive runner restarts and warm run attachments. The baseline fingerprint
and pending event are persisted together in a private runner state file. Source
retries retain the same event identity until the durable PRP outbox accepts it.
Hosts should commit an idempotent reaction or durable work item through
onCommittedEvent before returning and advancing the cumulative ACK.
The bundled transport exposes onCredentialsUpdated(event) for this commit.
It awaits the callback before ACK, including during warm idle, attachment, and
provider cleanup. Callback failures leave delivery unacknowledged for retry;
callbacks must therefore deduplicate by the original source event identity.
When configured, credential updates bypass the turn notification queue.
Paperclip commits them directly to the run log in a separate credential source
namespace, preserving the original PRP envelope and avoiding collisions with
the driver's normalized event sequence. A turn-only notification consumer
cannot reliably handle idle or cleanup updates; use this callback instead.
detection: "credential_store" reports an observed credential change, not proof
that an OAuth refresh succeeded. Multiple changes between observations can be
coalesced; this is not an audit of every refresh exchange. The schema also
allows native_hook for integrations with an explicit signal. Observation
continues during warm idle and checks at turn terminal and close boundaries,
including Grok's private refresh handoff after live-store cleanup. Retained
runner observations enter the durable outbox before a suspend or shutdown
command completes, without draining the provider backlog. A final check after
provider cleanup also enters the outbox and waits for the host ACK. The runner
retains its terminal recovery fence if that delivery fails.
The event authorizes no credential access or write on its own. A host that needs rotated token values must use a separately authorized handoff with its existing account-identity and freshness safeguards. The default Paperclip credential copy-back behavior remains in place.
Scope
The first provider descriptor and adapter fixture cover Codex only. The schemas for provider-neutral events and semantic receipts do not enable those actions. Discovery and authorization are separate contracts.
The conformance manifest records every source file and its SHA-256 digest. Run
pnpm generate:protocol-manifest from this package after a source change. CI
runs the same generator with --check to reject drift. This check also compiles
the JSON Schemas and validates every replay, question, and cross-language
conformance fixture against its declared schema.
The files in fixtures/replay/golden/ are deterministic reducer oracles. Each
accepted replay fixture has a complete session snapshot and a compact parity
summary. pnpm generate:replay-goldens updates them after an intentional
reducer change; package build and CI fail when they drift.
The files in fixtures/local-runner/scripts/ drive the package-local fake
harness. They cover successful, failed, interrupted, interactive, duplicate
terminal, process-cleanup, and oversized-frame behavior without starting a
production adapter.
runtime.activity.recorded is a P1 Runner event in v1, v2 and v3 with exactly
{ namespace, activityKey }. Both opaque identifiers contain 1–160 Unicode code
points and exclude C0 controls and DEL. namespace groups a producer's activity
types; activityKey names an activity within that group. Consumers use the pair
to select a response to activity in the run. The authenticated outer envelope
provides run and session identity, source sequence and emission time. Core resolves
the run's company, task and agent through its existing authorized run binding;
callers cannot supply those identities in the payload. Recording activity does
not independently verify the reported action or grant access to any resource.
The event uses the ordinary durable outbox, acknowledgement and replay contract.
Local clients capture an opaque context with paperclip-runnerd notification-context
before an operation and invoke record-activity CONTEXT NAMESPACE ACTIVITY_KEY
after success. Runner publishes its matching absolute executable as host-owned
PAPERCLIP_RUNTIME_NOTIFICATION_HELPER and the stable endpoint descriptor path
as PAPERCLIP_RUNTIME_NOTIFICATION_CONTEXT. Configured task environment cannot
override either value. Context is invalidated on warm attachment and process
recovery, so a caller cannot attribute a later completion to a different run.