DottaandPaperclip
9e09d8f51f
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - First-task onboarding requires a saved human proposal decision before child work can start. > - Native proposal tools reject interaction metadata placed outside their advertised schema. > - The existing rejection text focuses on question forms and does not explain the misplaced approval metadata. > - This pull request explains the field placement and keeps approval recovery in its original confirmation or checkbox kind. > - It also retains safe schema guidance in the run log so operators can identify the rejected field. ## Linked Issues or Issue Description Refs: #18025 for native first-task proposal recipes and #16889 for safe native schema guidance. Related open PR #18105 changes separate server API-client guidance. **What happened?** A native first-task confirmation copied `version` and `supersedeOnUserComment` to the tool root. Both belong inside `payload`. The runner correctly rejected the call before execution, but its feedback described question forms. Later calls kept the misplaced field and changed the approval into a question. No proposal card was created. The run log retained only a generic schema error. **Expected behavior** Keep strict validation. Explain the nested field locations. Keep a confirmation or checkbox approval in that kind while correcting its arguments. Save the normal pending card and wait for an actual human decision. Retain bounded schema guidance without storing rejected input. **Steps to reproduce** 1. Send an otherwise valid native confirmation with root-level `version: 1` and `supersedeOnUserComment: false`. 2. Observe the pre-dispatch `invalid_tool_call` rejection. 3. Move both fields into `payload` and keep `interactionKind: "confirmation"`. 4. Verify that the corrected call creates one pending confirmation, exact replay creates no duplicate, and child creation still needs saved human acceptance. **Paperclip version or commit** The observed argument shape and initial regressions came from public source base `c32e1ba6`. The repair is based on maintained master `4a6f6a65`. Public tests use synthetic prompts and identifiers. ## What Changed - Give rejected confirmations and checkboxes approval-specific guidance. It names `payload.version` and `payload.supersedeOnUserComment` without suggesting a question-form recipe. Other human-input errors retain complete question-form guidance and stable question/option ID instructions. - State the allowed native root fields in the first-task skill and put the metadata inside both executable proposal recipes. - Retain the existing safe guidance in `semantic_tool_denied` diagnostics. Keep the original rejection identity and `paperclipExecuted: false`. - Preserve only the exact bounded scalar diagnostic payload after verified event admission. The rest of the envelope and all API request/result bodies keep their existing redaction. - Add a real native Codex transport regression and strengthen advertised-schema, card replay, human-admission, persistence, and privacy controls. Update the execution contract and onboarding maps. ## Verification - Red: the native transport reproduced the malformed confirmation and showed that the old hint omitted the metadata correction. A second red confirmed that approval guidance still included the question-form recipe. The corrected transport case now rejects before execution, retains a safe hint, and dispatches one corrected confirmation that returns a pending card. - Red: both shipped recipe checks lacked explicit nested metadata. All 49 first-task admission tests now pass, including advertised-schema validation, idempotent card replay, actual human acceptance, agent-only rejection, and question-answer controls. - Updated native checks pass on the current repair: 95 native Codex transport tests with 2 existing ignored cases, all 32 provider-bridge tests, and the schema-feedback unit control. - API/case persistence regressions were red before the event-boundary correction. All 71 affected port/redaction tests pass in a clean run at frozen head `3be3a70f`, including the corrected envelope privacy regression. The focused 16-test persistence/privacy group and server typecheck also passed earlier. - Full local `pnpm build` and `pnpm -r typecheck` pass at exact head `3be3a70f` in a clean detached checkout with Node 24.22.0 and pnpm 9.15.4. Exact-head CI passes: [full PR CI](https://github.com/paperclipai/paperclip/actions/runs/40950360142) and [isolated native Runner readiness](https://github.com/paperclipai/paperclip/actions/runs/40950359835). - The full local unit attempt recorded a 15-second timeout in the unrelated Microsoft Teams 100,000-character existing-comment publication case. That failure remains recorded. The exact isolated rerun passed (1 test; 1,814 unselected). The aggregate timeout cause is unproven. That long local run straddled subsequent source edits and also observed the two port regressions during their red phase; it was stopped and is not final-head evidence. The clean affected-suite run above and current-head CI provide the final verification. No timeout or assertion was weakened. - Release-registry CI initially rejected the native test's compile-time schema include outside the release crate's hashed input closure. The guard was reproduced locally. The test now reads the current canonical schema at execution. All 10 crate-cache controls and the real native approval regression pass afterward; the cache guard and workflow keys remain unchanged. - Current-head Greptile review is 5/5 with no unresolved review threads. All required checks pass (56 success, 4 skipped). The advisory Paperclip Review remains neutral/incomplete after one normal re-review request; no completed assessment or score is claimed. - `cargo fmt --check`, map structural checks, and `git diff --check` pass. - Source and scripted-provider checks do not prove that a model will follow the guidance. The original live onboarding attempt remains failed; acceptance at a deployed revision is separate work. ## Risks - This changes repair guidance and shipped instructions. It does not make malformed arguments valid or supply a human decision. - Diagnostic retention adds no rejected arguments, values, or unknown input keys. The API receipt allowlist is unchanged. The validated-event exception restores only the safe scalar payload; optional debug and other envelope metadata still pass through redaction. - The existing 512-byte guidance bound, strict tool schema, company/run binding, idempotency checks, and proposal admission remain effective. ## Model Used OpenAI GPT-6.1 Sol (`gpt-6.1-sol`) through Codex, with tool use and code execution. The context-window size is not exposed to this session. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
15 KiB
Onboarding and first work — agent access
Product map: Onboarding and first work.
Feature ID: onboarding.
Review date: 2026-10-12. Source commit: f981fa3cc10cb8663a87dec60345fbff46d54d0a.
This is a source-reviewed baseline of representative operations and known gaps. Each capability needs operation-level review before its entire scope can be qualified. No live agent execution is claimed. Follow the map contract for format, permission checks, evidence and maintenance.
Scoped runner-default source review: 2026-10-12 at
eee0534154eaf5d0d3f2bbc97c1e24d86f34a5a5, limited to first-agent selection,
selected-runtime validation and draft restoration. Unrelated baseline entries
retain the original source commit; no live agent verification is added.
instance
Capability ID: onboarding/instance.
Review: baseline.
API: not-applicable — Bootstrapping an instance cannot depend solely on an API served
by that not-yet-running instance.
Agent access: operator-only — Existing CLI onboard/run/doctor / test-drive.
Policy: Instance setup is operator work; company creation is board; agent creation/task creation retain their individual permissions.
Evidence: source-only —
implementation at the reviewed
commit above.
Verification: not-run — exercise the listed local workflow in an authorized, owned
operator environment. Verify its isolation and result; do not count local machine
authority as company-agent API access.
Gaps: Bootstrapping an instance cannot depend solely on an API served by that not-yet-running instance.
company
Capability ID: onboarding/company.
Review: baseline.
API: present — representative operation IDs:
POST /api/companies.POST /api/companies/{companyId}/agents.
Agent access: partial — Board company creation; authorized in-company agent hiring
API.
Policy: Instance setup is operator work; company creation is board; agent creation/task creation retain their individual permissions.
Evidence: source-only —
implementation at the reviewed
commit above.
Verification: not-run — exercise a listed permitted operation with actual agent
credentials/run context; inspect its result and applicable persistence/attribution.
Assert the relevant denied actor, owner, company or mode from Policy. Review the
remaining operations before qualifying the whole capability.
Gaps: API building blocks exist; an ordinary agent cannot create its parent company with a company key.
adapter
Capability ID: onboarding/adapter.
Review: baseline.
API: present — representative operation IDs:
GET /api/companies/{companyId}/adapters/{type}/models.POST /api/companies/{companyId}/adapters/{type}/test-environment.
Agent access: partial — Permitted agent/model API; operator
provider-account/environment setup.
Policy: Instance setup is operator work; company creation is board; agent creation/task creation retain their individual permissions.
The wizard selects the Codex harness and lets the server resolve an automatic
new-agent runner; explicit Legacy remains available. Supported-platform and
immutable sandbox evidence follow environment probe policy.
Creation/discovery do not provision a target to determine this default. Adapter
setup validation requires agents:create, plus saved-agent update access when
testing an existing agent; interactive account login additionally requires a
board user and owner-bound session. An agent's right to hire is not login or
instance-environment administration authority.
A name-only, held setup has no provider selection yet, so the wizard omits its runner choice until the provider is chosen. The existing board-only setup and saved-agent update permissions remain; normal runner compatibility validation is unchanged. No runnable legacy fallback is created.
Scoped source-only runtime preparation: the existing authorized adapter test
prepares the default Claude CLI in its already acquired sandbox when the image
version is too old for the selected model. It installs a pinned package into a
workspace-private versioned prefix and verifies the executable before the hello
test. This adds no installation API, account grant, environment authority or
engine fallback. Cloud UI omits manual shell debugging and legacy operator hints
while retaining check messages and details. Local, SSH and custom
commands remain operator-managed. Controls:
runtime,
probe, and
wizard. Live managed
authorization and subscription execution remain not-run for this change.
For fresh managed Codex Auto setup, the wizard's explicit Connect path can call
POST /api/environments/{environmentId}/probe?companyId={companyId} before
selected-runtime testing, then refresh scoped adapter discovery. This reuses the
existing board instance-admin/local-implicit probe gate; agents:create alone
is insufficient. A 403, absent proof, changed configuration, missing response
identity or unconfirmed cleanup remains visible. No probe is added to creation
or discovery, no agent/company grant is broadened, and provider authentication
errors never cause an automatic runner switch.
Native setup derives outer sandbox isolation from the server-resolved execution target, as task execution does. This is an internal transport choice, not a request/configuration permission. Local and SSH setup keep Codex isolation; caller-supplied environment flags do not authorize an external sandbox. Existing company, account, probe and registration-cleanup gates still apply. The bounded hello probe retains read-only permissions and no dynamic tools. Its trusted launch skips project-instruction discovery in the new, empty setup workspace. This grants no filesystem or networking permission and does not change instruction discovery for ordinary task execution.
Scoped source review: 2026-10-13, exact baseline
1a0ca66242121e39d88455aa2b52a07acc4a07d9 plus the privately composed onboarding
correction. Wizard controls
and existing Product E2E observer controls
exercise mocked allowed/denied setup and sticky unknown cost coverage. They do
not prove live actor authorization or provider execution. The explicit manual
confirmation-replies.runner-codex.daytona.task-card-accept case requires an
eligible immutable OCI target and the existing probe authority, two identified
setup leases and separately authorized paid/cleanup reservations. Its fixture
neither prequalifies the environment nor creates the agent. Actual Cloud named
snapshot binding, warm/cold signup and live allowed/denied agent checks remain
not-run.
Evidence: source-only —
implementation at the reviewed
commit above.
Scoped Evidence: source-only — wizard/default selection,
creation resolver and
setup/login authorization at the scoped
commit. Existing agent/approval execution preservation follows
hiring access; no live onboarding proof is claimed here.
Verification: not-run — exercise a listed permitted operation with actual agent
credentials/run context; inspect its result and applicable persistence/attribution.
Assert the relevant denied actor, owner, company or mode from Policy. Review the
remaining operations before qualifying the whole capability.
Gaps: Account authorization, environment administration and model selection need separate checks.
Verify automatic onboarding without a post-hire runner change, explicit Legacy,
saved configuration after reload and the actual selected runtime's useful task
plus follow-up. Assert denied agent login/probe and foreign-company account or
environment access separately. These agent-context checks remain not-run.
first-task
Capability ID: onboarding/first-task.
Review: baseline.
API: present — representative operation IDs:
POST /api/companies/{companyId}/issues.POST /api/issues/{issueId}/children.
Agent access: available — Native create_task / agent REST / CLI issue.
Policy: Instance setup is operator work; company creation is board; agent creation/task creation retain their individual permissions.
An authenticated run bound to the server-created onboarding first task must
obtain persisted human acceptance of the latest ordinary proposal before creating
new tasks through native create_task or REST. Its authenticated run determines
this admission even for an explicit standalone task. A card decision or a saved
conversational resolution with a genuine later same-task user message supplies
acceptance; an agent-only resolution does not. A plan approval must name the
current same-task revision. Newer pending/rejected proposals stop new creation.
Already admitted task replay and ordinary delegation retain their existing rules.
Native proposal metadata version and supersedeOnUserComment stays inside
request_human_input.payload. Invalid root metadata is rejected before dispatch;
repair guidance keeps the approval kind instead of replacing it with questions.
The shipped recipes are checked against the advertised schema and the real
interaction service. Idempotent proposal replay still needs a saved human decision.
An accepted onboarding execution cannot create a new task blocked by its
authenticated onboarding source. Native and REST creation return a recoverable
input error before committing that task or its wake. The same source restriction
applies to later blocker edits, using database UUID identity. A child's own agent
run also cannot add its server-owned onboarding parent as a blocker. Native dependency
edits carry their authenticated run. Empty-list corrections and other blockers
remain available without a new proposal decision. The API keeps its normal
attempt audit. A corrected creation call retains
the human acceptance and can reuse the unconsumed command key. Other blocker
relationships remain available. The child needs self-contained approved inputs;
the parent uses set_dependencies to wait on the child, not the reverse.
Native paperclip_finish does not grant completion authority from an opening
answer. The onboarding parent requires a trusted saved human decision on its
latest proposal. Acceptance permits completion under the existing policy;
rejection permits acknowledgment and closure without authorizing new work.
The native status commit checks this decision again under its existing task/run
locks. This adds no new agent endpoint or cross-company authority. The
native completion controls
check persisted outcomes on disposable PostgreSQL; they are not live Cloud
credential or onboarding qualification.
Source: creation admission.
Controls: native/REST PostgreSQL regressions.
These controls do not qualify a live Cloud provider journey.
Evidence: source-only —
implementation at the reviewed
commit above.
Verification: not-run — exercise a listed permitted operation with actual agent
credentials/run context; inspect its result and applicable persistence/attribution.
Assert the relevant denied actor, owner, company or mode from Policy. Review the
remaining operations before qualifying the whole capability.
Gaps: Task creation is agent-accessible where permitted; scheduling/readiness does not follow from successful creation. The Codex first-task fixture's operator cost guard uses the existing board agent-configuration PATCH before admitting work. This is not evidence of agent permission to update its runtime; the listed agent-context checks remain not-run.
Scoped source review: 2026-10-13, the first-task asset correction against
ea6c8eb5e16d61111968f633a66748b397b64a3e. The existing
first-task instructions
send file-producing work through the child's own execution and existing
dependency/block controls. Native register_deliverable retains its current-task
binding; this adds no cross-task file-registration authority or permission.
Document-only work may use the existing child-document API inline, and plan-only
approval does not authorize implementation. The existing asset tests check
wording only. The literal baseline live attempt failed child-file delivery and
completion reporting; revised live authorization and execution remain not-run.
resume
Capability ID: onboarding/resume.
Review: baseline.
API: not-applicable — No server onboarding-draft API for this browser-local state;
classify explicitly or intentionally make it a cross-client product feature.
Agent access: not-applicable — Browser localStorage wizard draft; persisted resources
use their domain APIs.
Policy: Instance setup is operator work; company creation is board; agent creation/task creation retain their individual permissions.
Evidence: source-only —
implementation at the reviewed
commit above.
Verification: not-run — use the product recipe for the local/developer surface. Verify
listed shared-resource reads separately; local presentation alone is not agent API
evidence.
Gaps: No server onboarding-draft API for this browser-local state; classify explicitly or intentionally make it a cross-client product feature.
Scoped source review of draft restoration preserves harness/runner intent and invalidates obsolete setup-test results after a selection change. Browser draft continuity is not API or live-agent evidence, and opening a saved Legacy agent does not apply new-agent defaults.
The initial matching route opening preserves the authorized saved wizard step on bare and company-prefixed reloads. Explicit new-company or changed-company openings retain their navigation override and clear foreign company resource IDs. Existing component controls exercise these presentation and account boundaries. This scoped correction adds no server draft API, agent grant or proof of live actor authorization. The managed first-task eval still reloads before Get started and remains a separate live acceptance gate. The existing mocked-login browser case also checks the same company-scoped active session and saved selection through route reopening and a real reload, with one login start and no pending-login hire. These fixture assertions do not prove server authorization or live credential use.