PaperClipAI/doc/plans/2026-10-06-default-agent-runner.md

Runner defaults: staged delivery

Current qualification and repair checkpoint — 2026-10-13

Canonical branch: codex/codex-runner-default. Delivery: #15683. The published baseline ea6c8eb5e16d61111968f633a66748b397b64a3e has 53 successful hosted checks, two conditional Storybook skips, required verify and E2E passes, fresh 5/5 review and 30 resolved threads. Its package qualification passes all four native producers and clean Apple Silicon, Intel Mac and Linux ARM64 consumers. All 18 package source manifests and binary hashes match; no Codex payload is bundled. The isolated Apple Silicon install and zero-turn native startup pass, and fresh installed JavaScript applies all 342 migrations through 0343 with confirmed owned cleanup. These are literal baseline results, not proof of the new repairs. Linux remains GNU libc 2.39 or newer on x64/AArch64; Windows, Alpine and 32-bit ARM stay deferred. No warm-cache speedup or paid ARM task is claimed. Docker, Cargo and native builds remain remote.

The single baseline managed attempt fails completion reporting and the physical child-file assertion; its existing report remains red. Two runs execute provider turns. A third callback is falsely marked successful during startup, before any provider turn, because its onboarding parent is already Done. One unstarted child wake is cancelled. Recovery now reuses the existing completed-onboarding handoff validator before applying the issue-terminal backstop. Company, parent origin/status, assignee, completed child and remaining children must match. Process-death and ownership checks remain. Three reproduced baseline failures become 103 passing PostgreSQL controls across the existing recovery suites, with canonical server typecheck passing. Owned test clusters stop and release their slot. The native file tool correctly remains bound to its current task: the original run saved a child document but attached the file to the parent. First-task instructions now send file-producing work through the child's own execution, dependency and block handoff, then verify and link the child's result. Document-only and plan-only paths retain their scope. Two reproduced instruction-contract failures become 15 passing existing asset and greeting controls; these static checks do not prove model compliance.

All seven baseline managed lease rows are released or expired with successful cleanup records, and prior company environment settings are restored. A separate owned-server supervisor reports incomplete descendant cleanup after server exit; its missing nested cause remains unresolved. Lease records do not prove physical deletion or settle unknown charges. Existing cost and cleanup holds remain. Revised-source live acceptance must still check actual turn events, the child's downloaded physical file, source-correlated completion, follow-up and continuity. Do not rerun the known failing baseline or weaken its assertions.

The normal staging preparation and exact baseline Core image build complete, but the deployment check rejects fleet_campaign_staging_requires_master. Current Cloud policy admits only actual master source ancestry, including preview DB artifacts; a pinned, owned single target has no exception. No staging campaign starts and no serving-candidate claim is made. A human sequencing decision is pending: complete Mac and signed managed acceptance before a normal squash, then qualify the actual merged revision on the owned staging stack, or use a separate branch-friendly test environment before merge. Do not bypass this gate or change merge method to preserve preview ancestry. The preview Core image has verified content identity but no verified signature; the managed image signature is separately verified. Actual private Cloud composition and fresh warm/cold signup remain required production-readiness evidence after merge.

Next action: independent matching-source review, affected map checks and publish the two scoped repairs in one source commit. Freeze that head, require fresh full CI and 5/5 review, then repeat the existing package/install and single managed journeys on admitted artifacts. Upgrade the idle local app with full saved configuration, account and recorded-run-profile comparisons; preserve its data. Use a fresh ordinary installed instance for automatic first-agent task/follow-up. The new $100 QA ceiling permits bounded messages with paid concurrency one and 180-second runs; prior unknown-charge and cleanup holds remain separate. Existing runners never migrate. Normal protected merge is authorized once applicable gates and the sequencing decision are satisfied. No production or provisioning-default promotion, local heavy build, new timer or archive is authorized. Earlier checkpoints below retain their historical source attribution.

Current Codex merge checkpoint — 2026-10-13

Current published 1173a859baa78af1d382058aa89c25920da25c3d passes the policy, selector and commitperclip gates and is mergeable; full checks and fresh review remain incomplete. Two reviewed setup findings have treatments: missing forced-Kubernetes environments stay unqualified sandbox targets, so automatic Codex creation preserves Legacy without provisioning and explicit native selection returns qualification guidance. Four baseline failures become 161 passing existing selection/environment controls. Local daemon resolution now precedes credential staging; preparation errors remove only the owned pre-handoff root, while unconfirmed probe retirement retains recovery state. Three original filesystem failures become 96 passing setup controls. Fake credentials and service controls do not qualify live Kubernetes or provider execution. Matching final source review, maps and typecheck are required before publishing the fixes.

Published 2902b72c330d37ddff5d59e07927716dc3e1517c is blocked before main CI by the repository's tracked-lock policy and another master conflict. The generated dependency lock is retained as build evidence; the branch restores master's exact tracked lock, using the existing scripts-disabled CI resolution path instead of bypassing the gate. Normal reconciliation with e0f30a4c7186498b71b2637f253b3399997dac7d preserves controller-loss attribution, creator identity and migration 0343, voice qualification and Apps connection controls. Both test conflicts retain the Codex runner checks and incoming controls. All 45 built-in and 44 controller/run-state controls pass; maps and token gates remain clean. This source requires fresh CI/review and appropriate installed/live qualification. Cancellation is requested for the obsolete 2902 managed workflow before a paid test job is observed; terminal cancellation and unknown remote costs still need confirmation. No unchanged paid test is retried.

Independent inspection verifies the literal 578 fresh Mac journey below: exactly one child, one document revised from one to two, and the same workspace file changed from Saturday to Sunday with both required markers. Five executed runs succeed with no interval overlap; one terminal-child wake is cancelled before starting. Parent session continuity and the separate child session in the same workspace are recorded. Estimated run cost is $1.820721600; setup usage and settlement remain unknown. Reload preserves the completed task and revision. This manual evidence does not relabel the original managed failure or newer source.

The reviewed fixture changes are published as 8d65fd7fc31d8170082f30a314b87c4779f91e8a. Before a main CI merge checkout is created, master advances to edcfcaf3f69abfda12fcbc63225f7346f53450aa. Normal reconciliation retains its repository-skill preparation, signed idle wake deadlines, readiness errors, voice support and migrations 0341/0342. The sole text conflict preserves master's cancelled-lock return semantics and the PR's bounded error-code diagnostic. The dependency lock is completed for the existing server test dependencies and incoming voice dependency, without changing prior resolved versions or running install hooks. Frozen-lock validation, 29 existing native-authority/runtime-skill controls, E2E no-emit, maps and token gates pass. This combined server/UI/DB source requires new package and live qualification; literal 578 results below remain attributed to their actual source.

The separate fresh Mac UI journey on installed 578 selects automatic native Codex, connects an API-key account, creates the first agent, and reaches the ordinary opening card. Accepting its proposal creates exactly one child task with a saved document and workspace file. A follow-up changes that existing document to revision two and edits the same file. Independent content, recorded execution, workspace, session-boundary and accounting inspection remains in progress. The failed managed eval is retained separately; this manual journey does not turn its failed oracle green. All paid work remains bounded by the new $100 allowance, 180-second runs and single-provider concurrency, with prior holds kept.

Canonical branch: codex/codex-runner-default. Delivery PR: #15683. The runtime/install prerequisite #16028 and release repair #16149 are merged. The finish line remains ordinary native Codex onboarding, checked task/follow-up, saved-agent preservation, exact-candidate installation and required checks, then a normal protected merge. Production deployment and default promotion remain outside this merge campaign.

Reconciled head d68f1facf0e174a4f8a771a2055e02c72a47c289 receives a fresh 5/5 review with all 28 threads resolved. Its required E2E check passes, but the aggregate verification check fails two test shards. A retained company fixture collides because it truncates random UUIDs to six characters; full-UUID seed treatment passes 255 existing PostgreSQL controls with zero skips. The existing Runner durable-progress case lacks the diagnostic evidence needed to identify its failure. Bounded failure diagnostics retain the original error, all deadlines, usage, recovery and deduplication assertions. One exact local case passes; controlled delayed-save and early-admission failures show why that pass cannot prove the original cause. Independent review approves these two test-only edits. The next published head still requires its own CI and review.

Literal 578 remote qualification now passes all four producers and the maintained Linux, Apple Silicon, Intel Mac and Linux ARM64 install scopes. All 18 tarballs, source manifests and binary hashes match; no Codex payload is bundled. Native consumer reports cover zero-turn open/close and cleanup, not paid ARM execution. Fresh local installation/native/CLI controls pass. Its fresh DB helper fails before migration with missing bootstrap stderr; its original cause remains unknown. The ordinary existing-data restart separately reports exhausted Mac shared-memory IDs. Releasing exactly two dead, unattached task-owned fixture segments restores the app without changing host settings or other services. Installed 578 applies migration 0340, reaches recovery ready and preserves three full agent execution configurations, eight recorded run identities and safe account summaries, with zero provider work. This proves upgrade preservation, not fresh initialization. A separate ordinary installed CLI entry then starts with a new isolated home and empty data, applies all 339 packaged migrations including 0340 and reaches recovery ready with zero companies and provider actions. This proves fresh startup after the owned resource cleanup; the original test-helper failure and its missing cause remain recorded.

The original managed child-task failure remains red. Explicit first-task skill invocation and delivery source are recorded, but the retained trace cannot prove the model received the child-rule bytes or the complete dynamic-tool schema. Two rejected human-input calls recover through the ordinary API; their rejected argument shapes are not retained. Causality remains provisional. The fresh staging image and protected check pass at literal 578; deployment is blocked by an already active workspace deployment, with no campaign started by this QA request. Wait for that operation before any explicit normal deployment retry. No production or provisioning-default action is authorized.

Historical literal candidate 57881c607fcea782ac30f601b768b2142fc2184b passes all required checks: 53 successful checks, two conditional Storybook skips, fresh 5/5 automated review and 28 resolved review threads. The existing hosted Linux login/reload case passes against its recorded CI merge. The previous failed attempts below remain historical evidence.

Normal reconciliation with master 7eea9d8214fec00dfde32bda7fcf9b20a428e330 accepts its source-annotation Storybook/map migration. All 263 authored suites and 2503 story identities, exports and play counts remain intact. Retired aggregate files and their review history remain in Git; current indexes regenerate as ignored outputs. Durable creation/onboarding annotations describe fixture limits. The 28 existing tooling controls, UI typecheck, token gates and 35-area/175-ID map check pass. Independent inspection finds no change to native execution, defaults, onboarding, credentials, workspace, DB, CLI or packaging source relative to 578. The isolated GitHub review-heading change and Storybook build preparation retain their incoming master source. Fresh published-head CI/review is still required.

Literal 578 remote package qualification has completed successfully. The single managed onboarding attempt passes automatic selection, saved environment qualification, native authentication, hire and reload, then completes two successful native runs with session continuity. It fails the accepted-child assertion: the model puts its document/file on the onboarding parent and finishes that parent despite the delivered first-task skill requiring a child. Preserve this candidate failure; it is not a passing E2E cell or complete task/follow-up proof. The owning verifier records six terminal lease rows with successful cleanup, of which four appear in the selected report; physical deletion and unpriced usage remain unsettled.

The former staging QA stack is archived with a decommissioned database. Its normal preview preparation rejects the lifecycle before deployment. A new owned QA workspace has been provisioned through the ordinary signup path; it still needs candidate deployment and live verification. Previous preview/runtime proof is historical. Heavy builds remain remote, existing-agent data stays preserved, and no production deployment, default promotion or timer is authorized here.

Published e301c68d645eabd9fa7ae3a9450a460f6d2d0439 passes required CI with 52 successes and two conditional skips. Its fresh review finds one linked-login setup defect. Literal executable source 6c0eca871616a110954553d6ff971e7655c85f93 passes remote package qualification, including all four producers and clean Apple Silicon, Intel Mac and Linux ARM64 consumers. Fresh installed JavaScript initializes migration0339. The existing Mac app upgrades while preserving three full agent configurations, eight historical runs and saved account summaries, with no provider work during upgrade.

The managed6c attempt passes the saved environment probe, native account/model hello, native hire and campaign bounds. A legitimate reload then returns onboarding to step one before Get started. Both setup leases and fixture cleanup pass; no task/artifact/follow-up is reached. Preserve this failed attempt. The production draft-restoration fix passes192 existing/new controls and independent source review, including delayed loading, explicit fresh starts, old runner choices and company/account boundaries. The managed fixture keeps its reload assertion. The separately scoped linked-login fix stages checked credentials only for isolated setup and keeps the general no-follow guard, refresh target and bounded retirement contract. Its original source passes both regular-file controls and fails both linked-file controls after the real lower materializer omits authentication. The matching treatment passes69 setup controls and12 unchanged lower controls, server no-emit and independent source review. Private copies retire only after confirmed cleanup; an uncertain close retains owned state and remains a failure.

The reviewed fix commit is 12046f522bca29ded24425be71b856993b4997f7. The normal merge retains exact master 393d1c410862aa93561548e0a39feec3b89df6ff, including migration0340, shared/plugin lifecycle contracts and file recovery. Independent source inspection confirms all four reviewed fix hashes and the incoming executable changes. Storybook reconciliation retains263 suites and2503 authored IDs, both review histories and all four incoming recovery states. Its 27 existing controls, maintained catalog check and35-area/175-ID map check pass. Only JavaScript dependencies are prepared locally; native/image builds stay remote.

The combined736 source passes368 focused checks across10 files with zero final skips. The initial sandbox listener failures are preserved separately; unchanged support probes and owned loopback execution reach the affected tests successfully. Incoming master c7f4b74111d16f0b57112fa6d0b6a59c2d63bfe8 then adds fresh-task workspace source isolation. Its eleven server files remain exact master, and281 affected source/trust/preparation/runtime controls pass without repeating the368. The catalog retains263 suites/2503 IDs and both histories.

An actual task bootstrap check finds a narrow compatibility mismatch: an explicitly configured or operator CODEX_HOME with linked auth can pass setup while task isolation omits that link. Ordinary new defaults create no such link; regular host logins and server-selected managed account homes seed correctly. Keep the general no-follow guard. Use existing server-owned managed credential provenance to reject the unbound linked case with explicit Legacy/managed-account guidance, while retaining checked setup seeding for resolved accounts. The existing fake bootstrap stops before provider launch; it is not live account proof. The existing trusted outer managed credential-home context closes this mismatch without a new schema or permission field. Four linked cases reproduce false setup success before the guard;81 final setup controls, server no-emit and independent source review pass. Regular homes, API-key precedence and resolved-account setup aliases remain supported. Raw configuration cannot provide the trusted provenance.

Published 1d09569b054e0ad9f4bc9e4d92ad1212d4794f7c retains that combined source. Its exact-head review is4/5 with one additional selected-key precedence finding: CODEX_API_KEY still enters subscription validation when the task materializer would use that key directly. Six local/remote selected-key controls reproduce the failure; six OPENAI_API_KEY controls retain their behavior. The two-line correction skips unrelated subscription reads and refresh binding for either selected key. Frozen treatment passes93 setup controls,12 unchanged lower controls, server no-emit and independent source review. The first93-control run's 91 passes and two import-deadline/follow-on failures remain recorded; the unchanged standalone run passes without extending a deadline or weakening an assertion.

The 1d CI run passes build, typecheck and native verification but has two independent blockers. The onboarding browser case expects the obsolete return to the Agent step. Its captured screen correctly restores Connect, Ada and the original authorization link. Update that existing case to verify the exact active session, company, name/harness/Auto choice, one login start and no pending-login hire through both route reopening and actual reload. Independent source review passes. Local baseline reproduces the old assertion; the final local attempt cannot initialize its fresh PostgreSQL cluster before browser execution. Preserve that failure and require the existing hosted Linux E2E case to prove treatment. The chat shard loses its hosted runner connection; no failing chat assertion or test log is available. A new ordinary current-head CI run must replace that incomplete gate. No new image, package or paid live campaign was dispatched during these fixes.

Next action: publish the reviewed narrow corrections together. Require fresh CI/review, affected installed-package and managed first-task proof before ready or merge. Historical receipts keep their literal sources. The following checkpoints are retained history, not the current merge state.

Production preparation checkpoint — 2026-10-13

The runtime prerequisite #16028 is ready for review at 271d434c170e74bdedde65d0b13059a55419c943. CI attempt 2 passes 54 checks with four conditional skips; fresh Greptile is 5/5 and all four threads are resolved. The first attempt's bounded Pi Node archive timeout is retained. The unchanged-source retry passed without relaxing source or deadlines; its underlying network/host cause remains unknown. The passing CI installation records merge source 7a82a37438e6e448abc7cc5caa60dc2519a97be0, distinct from the PR head. The final literal-source package campaign passes all four daemon producers, public Linux assembly and Apple Silicon, Intel Mac and Linux ARM64 clean consumers. The Linux ACPX component probe uses explicit installed authority; normal Mac/ARM native lookup rejects authority overrides. Neither establishes final cloud onboarding/task acceptance. Small report ZIP downloads did not complete in the browser and the CLI token is invalid; no independent current-report rehash is claimed.

GitHub's normal ready-PR gate still requires a code-owner review. On 2026-10-13, normal protected squash auto-merge was enabled for exact 271d434c; approval remains pending and no slice was merged. The user authorizes normal protected sequential merges, not admin bypasses, production deployment or provisioning-default promotion. Codex #15683 remains clean at 1a0ca66242121e39d88455aa2b52a07acc4a07d9, based on the historical 5a9ce11. The parent has advanced and GitHub reports conflicts. Reconcile with the actual merged parent before publishing prepared fixes or claiming final checks. The Claude owner retains its branches, private installed-authority correction and separate $50 qualification ceiling. Those fixes need package and live acceptance; root does not rewrite the Claude branches.

Fresh ordinary managed onboarding currently lacks the saved platform probe before Auto resolution; an unqualified immutable OCI environment selects Legacy. The prepared Codex-only UI correction reuses the existing permission-gated saved probe on explicit Connect, refreshes scoped discovery and validates the selected runtime. It retains actionable failures, explicit Legacy and current creation/ discovery non-allocation. The existing explicit-only Product E2E cell gains fresh wizard-owned qualification, two authoritative setup lease IDs, independently checked physical-file output and follow-up continuity. Its fixture does not create an agent or preprobe. Missing responses preserve unknown cost coverage. No new suite, grader, automatic roster or local-prompt replacement is introduced.

The privately composed source passes 44 targeted onboarding controls and 184 existing Product E2E support controls, UI/E2E no-emit and guarded patch applicability. The earlier full wizard controls pass 117 cases at their recorded source. Independent review found an unanswered-setup accounting gap: four cases fail before the fix; 117 first-task controls pass after. Comment cleanup preserves 353,839 composed executable tokens and semantic ASTs. Required onboarding maps retain IDs, actual probe authority and source-only/not-run limitations; structural checks pass 35 areas/171 IDs. Storybook metadata must be reviewed after actual parent reconciliation; its catalog/script are absent from literal 1a0ca662. This private preparation is not integrated, published or live-qualified.

A private reconciliation rehearsal composes exact Codex 1a0ca662 with exact prerequisite 271d434c without modifying either published branch. It retains master's render helper, moved Storybook paths and additional catalog cases; the managed onboarding cell is added to the existing catalog with 730 total cases. The rehearsal is not an actual post-merge candidate and does not close hosted, installed-package or live Cloud acceptance. Its narrow checks and source manifest remain private until normal source reconciliation is authorized by the actual merge.

The private root review reproduced four cache failures under production staleTime: 30_000: setup omitted fresh availability reads, hid a discovery error, and skipped qualification after an image change. Both managed Codex setup reads now set staleTime: 0. The same existing controls cover cold and production-cache defaults; 53 selected UI controls and matching-source UI no-emit pass on Node 24.19.0. Earlier 44-case results remain tied to their pre-correction source. This correction is private and requires ordinary published-head review and full qualification after the protected parent merge.

Cloud source 23531d729756ab0461a53f9358beb8df5c1781ed uses named Daytona snapshots without a verified final boot-image binding for fresh-company native qualification. A read-only metadata request was rejected before execution because automatic approval review requires explicit use of the particular API key. Authorization is pending; no key was read or provider request sent. The expired GitHub device code needs a new attended sign-in when the human is present. Production Fleet Admin sign-in and a concrete current QA owner grant also remain pending. The existing QA tenant remains pinned/user-managed and unqualified; old auth probes and preview images cannot close the live gate.

The original $250 ceiling and $248.179254104 held/consumed ledger remain intact; unknown charges and cleanup holds are not certified invoice balance or available funding. Codex retains its bounded $2.50 setup/two-task-turn reservation plus $2 cleanup. The expanded manual first-task cell has no separate paid reservation. No provider turn, paid environment allocation, local Docker/Cargo/native build, rollout or default promotion occurred in this preparation. The preserved local preview remains http://127.0.0.1:3125/COD/agents/all, literal behavior source fe1ecf1c3449c21d6e6f0c9d9772d1949b80ea82; its data and recorded runners remain untouched. Root does not upgrade existing agents.

Next gate: obtain actual code-owner review and restored GitHub CLI authentication, then perform the normal exact-head parent merge and reconcile Codex/Claude with its actual master commit. Compose these prepared fixes, retain required maps and fresh review/checks, resolve the Cloud boot-identity boundary through authorized metadata, and qualify the final immutable managed candidate. Actual private Cloud distribution, warm/cold signup, useful task/follow-up, existing-agent preservation and production-image rollback/forward-recovery checks remain open. The stack is not production-ready and production deployment remains unauthorized.

Evidence: /private/tmp/pr2-271d434-final-qualified-ready-receipt.json, /private/tmp/pr2-managed-onboarding-accounting-root-review.json, /private/tmp/ci-artifacts-271d434-installed-native-lookup-audit-receipt.json and private composed source manifests. Public PR bodies contain the exact current checkpoint; historical receipt sources remain literal.

Updated 2026-10-13 UTC.

Fresh cloud onboarding remains unqualified

The source audit found two ordinary-use gaps in the dependent release. Codex onboarding resolves Auto from saved environment facts before setup testing. The normal setup path does not perform the saved environment platform probe. An immutable OCI environment without prior facts therefore creates a Legacy agent. Existing managed E2E fixtures explicitly probe first; those fixtures do not prove fresh onboarding. A private UI correction is being tested against the existing onboarding suite. It uses the existing permission-gated saved probe on explicit Connect, refreshes company-scoped discovery, then tests the selected runtime. Creation and discovery still allocate nothing. Probe errors must stay actionable, and permissions must not broaden.

Cloud master 23531d729756ab0461a53f9358beb8df5c1781ed distributes named Daytona snapshots. Its recorded runtime image digest identifies the app copied into that snapshot, not the final boot image. Current source does not bind a fresh company's qualification to a verified boot identity. The pinned official Daytona SDK accepts snapshot IDs, but does not guarantee a boot-verified digest. A read-only lookup of the existing snapshot was rejected before execution by automatic approval review because direct credential authorization was missing. The exact limited authorization is now requested. No key was read or request sent. Source audits and CLI version probes do not close live cloud acceptance.

These are release blockers for the Codex-default and actual Cloud distribution stages, not new runtime changes in this prerequisite. No source is merged or production-ready. The original budget holds, local preview, existing runners, remote-build boundary and no-production-deployment boundary remain intact.

Held-authorization fixture correction

The ordinary reconciliation candidate dae808fe02694d13d322c535944910813b21f6d6 has fresh Greptile 5/5, all four resolved threads, passing isolated native compilation and the required browser aggregate. Its runner shard passes both previously corrected cases, but fails a different authorize_before_bootstrap cell: the same implicit one-second polling deadline expires before the fixture installs its release callback. The shard records 1,672 passes, one failure and three skips. The exact failure and gate receipt remain: /private/tmp/ci-final-dae808-ci-review-failure-receipt.json.

The existing fixture now signals actual entry after installing the release callback in the exact before-bootstrap authorization hook. Race that signal against the original recovery request under the unchanged five-second bound. All authority, stage, denied-work, command queue, process, provider-state, durable-byte and cleanup assertions remain. On canonical Node 24, controlled 1,250 ms scheduling delay reproduces the old undefined-callback assertion and passes after correction. An injected early recovery error surfaces unchanged. The original hosted cause remains inconclusive; this proves fixture weakness and preserves the next diagnostic. These are historical-mock-binary controls, not final installed runtime qualification. Matching-source independent review is clear. Receipts: /private/tmp/ci-final-dae808-held-authorization-signal-receipt.json and /private/tmp/pr2-dae808-held-authorization-independent-review.json.

The already-running package campaign https://github.com/paperclipai/paperclip/actions/runs/38342104102 is immutable to literal dae808 throughout: daemon, assembly and installed consumer checkouts use its explicit 40-character SHA, while the tooling checkout uses the captured workflow SHA. Publishing this test-only correction cannot change that run's source. Let it finish without rerun or cancellation, keep its receipts literal and overlap fresh current-head CI with its remaining steps. No new package campaign starts until the existing one is terminal.

Both worktrees and root's test-drive data stay preserved. Its loopback health is OK at literal fe1ecf1c34, recovery ready, zero active runs; a sandbox-blocked read was corrected with the authorized read-only loopback path, without restart or build. Root HEAD stays 1a0ca662. Codex and Claude reconciliation/acceptance, normal code-owner approval, private Cloud composition and production baseline remain pending. No merge/deployment/default promotion, paid provider call, new paid host or local native/Docker build occurred.

Final CI fixture corrections and current master

Published prerequisite 16a53254c495f3e49a28cc911f5dcd60c41779fc has fresh Greptile 5/5 and all four review threads resolved. Full CI records 52 successful checks, four conditional skips and two failures: the runner Vitest first shard and its aggregate. The actual failing shard passes 1,671 cases and skips three; its two failures remain recorded in /private/tmp/pr2-16a532-runner-vitest-failure.log.

The durable-resume case exceeded its outer five-second test envelope. Reuse Claude owner's existing correction from c60bf4b6, changing only that case's outer limit to 15 seconds. On canonical Node 24, controlled 3,800 ms fake latency reproduces the old outer timeout, while corrected and ordinary cases pass. Internal 500 ms/5 second turn deadlines, distinct attempts, same thread, effect deduplication and the complete usage assertions remain unchanged. Receipt: /private/tmp/pr2-16a532-durable-resume-correction-receipt.json.

The warm-recovery callback fixture polled callback installation with Vitest's implicit one-second wait, despite its existing five-second request bound. Replace polling with actual callback-entry notification raced against request settlement under that same bound. Controlled 1,250 ms scheduling delay fails the original assertion and passes the correction; an early recovery error now surfaces unchanged. All fence, snapshot, retry and side-effect assertions remain. The original hosted request outcome was hidden, so its underlying cause remains inconclusive until fresh hosted CI. These controls use recorded historical mock binaries and do not qualify a final native package. Receipt: /private/tmp/ci-final-16a532-warm-callback-signal-receipt.json. Independent matching-source review of both test-only changes is clear: /private/tmp/pr2-16a532-fixture-corrections-independent-review.json.

Current master e168512f7bdbb6af6ea01954c6d7ed80b91e903e merges cleanly. Runner/surfaces/server/E2E no-emit checks pass on the composed source. Maps remain aligned at 35 areas/171 IDs and token gates pass. Master changed three activity/inbox/recovery recipes without synchronizing 25 catalog fingerprints. Independent inspection verifies those entries are exact inherited master drift; all 92 declared non-map story/component/wrapper/fixture inputs are unchanged. Only their guarded fingerprints and a source-only review note are synchronized. Existing 24 unreviewed/one current classifications, IDs, fixtures and INDEX stay unchanged. The catalog check passes 223 files/2,210 stories. No new live or visual coverage is claimed for the inherited backend requirements.

The exact 16a532 remote package campaign is https://github.com/paperclipai/paperclip/actions/runs/38338806076. The campaign completed successfully. All four native producers, public Linux package assembly and the Apple Silicon, Intel Mac and Linux ARM64 installed consumers pass. The earlier Intel timeout remains a separate failed receipt; this success does not establish its cause or a diagnostic-code fix. This remains literal source evidence after the current master/test changes. No queued job is rerun or obsolete package result relabeled.

Next action: preserve the completed package result, publish this ordinary master reconciliation with both scoped fixture corrections, require fresh full CI and review, and qualify the final package source. The prerequisite remains draft, auto-merge off, and actual code-owner review is pending. Codex stays 1a0ca662 until actual prerequisite merge and source reconciliation; the Claude owner retains its branches and separate $50 allowance. Final immutable managed QA, actual private Cloud distribution, warm/cold signup and backward-image or forward-recovery evidence remain required. Production Admin sign-in is pending. Nothing is merged, deployed or production-ready. The idle root test-drive and its data are preserved. Paid holds remain $248.179254104/$250; no provider turn, new paid host, local native/Docker build, rollout or default promotion occurred.

Master reconciliation and installed-package checkpoint

The published prerequisite 64c074fb8da1b31f8d6042c4fef48dc4164e759b passes 54 current-head checks with four conditional skips and fresh Greptile 5/5. All four review threads are resolved. The actual hosted transport suite passes 246 tests and startup trust passes 22; this closes the earlier local fake-binary limitation at that literal source. Full workspace checks, Linux DB controls, Rust suites, isolated native compilation and all eight browser shards pass. Receipt: /private/tmp/pr2-64c074-full-ci-review-0144-receipt.json.

The existing final package campaign completed on literal 64c074. All four native producers, public Linux package assembly, Apple Silicon and Linux ARM64 installed consumers pass. Intel Mac fails during initial npm install --ignore-scripts --omit=dev, with ETIMEDOUT after the existing 10-minute bound. It never reaches lifecycle or native runtime assertions. The log establishes an installation timeout, not its network/host cause and not a runner failure. Intel installed execution remains unqualified. Keep the failed receipt; do not relax assertions or relabel the successful platforms as a complete campaign. No automatic retry was dispatched.

Master then advanced to f329b24ee12496e710ad17377ec7716e0eee22ef, adding separately merged durable task workspaces. It conflicts only in the test-home helper/test and the Storybook review record. Both independent additive resolution proposals are preserved. The cleanup keeps guarded read-only permission recovery and its unrelated-ENOTEMPTY negative, adopts master's POSIX error assertion, and retains master's new isolated-home identity/symlink protections byte-for-byte. Both source-only Storybook review appendices remain; the catalog merges without new story/fixture edits or changed review classifications. The task-workspace migration and runtime changes come from master, not this PR's feature scope; final image/migrator and backward-image proof must include them.

The composed worktree passes six existing home controls, with zero failures or skips, plus runner/surfaces/server/E2E TypeScript checks, token gates, both map checks (35 areas/171 IDs) and Storybook structure (223 files/2,210 stories). Only scratch-local TypeScript preparation ran; root's idle test-drive and data stay unchanged. The contribution check has no below-1,000-to-above-1,000 code crossing. The two whitespace lines already in master's unrelated privacy test are not modified; the PR diff against master is clean. The review remains 63 files. These composed checks have their working-tree source identity and are not claimed as execution of the old published commit. Receipts are /private/tmp/pr2-f329-uncommitted-home-controls-receipt.json and /private/tmp/pr2-f329-composed-source-checks-receipt.json.

The existing Mac installer now retains bounded npm timing/progress diagnostics in its already-uploaded receipt path before cleanup. Only allowlisted metadata is retained; argv, URLs, environment, raw stderr and exception text are omitted. At most two 16 KiB file tails and 32 entries per tail are read. Symlink exclusions and the original exception identity remain. Failure is explicitly FAILED, unqualified and runtime-not-attempted. The existing 10-minute deadline and all package, lock, payload, lifecycle and startup oracles are unchanged. Three narrow cases extend the existing suite; all 24 pass on canonical Node 24, and independent matching-source review is clear. This adds diagnostics, not an installation success or explanation of the old timeout. Receipts: /private/tmp/pr2-mac-initial-install-diagnostics-repair-receipt.json, /private/tmp/ci-final-mac-install-diagnostics-independent-review.json and /private/tmp/pr2-f329-install-diagnostics-node24.log.

Next action: publish the ordinary master-reconciliation commit, require fresh full CI/review and exact-source package qualification, then normal code-owner review and merge. Prior 64c074 CI/install receipts remain literal after this source change. The Claude owner is waiting for the exact canonical parent before its next composed campaign; keep all its Claude fixes and separate $50 allowance. Codex remains 1a0ca662 until actual prerequisite merge and reconciliation. Final immutable OCI QA onboarding/task/follow-up, private Cloud composition, warm/cold signup and backward-image or forward-recovery proof remain required. Production Fleet Admin sign-in and code-owner approval are still pending. No slice is merged or production-ready. Paid holds remain $248.179254104/$250; no new paid/provider action, local native/Docker build or rollout took place.

Production readiness: owned startup correction

The human requests production readiness; preparation and normal sequential merges remain authorized. Production deployment and provisioning-default promotion remain separate actions. Nothing in this checkpoint is merged or deployed, and the stack is not production-ready.

Runtime prerequisite behavior is ce23716503a2c9158b5a7ab74ab61571ff4ee7a3 on codex/runner-native-platform-prerequisites, in #16028. Final qualification reproduced close returning before credential preparation drained, followed by registration and launch. Both direct close and real driver cancellation failed on literal 5a9ce11. The initial shared repair from Claude commit 463ebb is reused, with independently identified duplicate-admission, shutdown-readiness and resume ordering corrections. All five source findings are closed in matching source review. Absolute cleanup deadlines, primary cancellation errors, unauthenticated-process protection and existing agents' runner choices remain.

The existing suites pass 32 credential-free controls across three files; both canonical runner TypeScript no-emit checks pass. No new suite, local Rust/Docker build, provider call or credential-content read was used. Actual daemon readiness/recovery controls remain hosted-CI required: local worktrees lack the existing fake-Codex/fake-harness executables. The failed local native attempt never reached the readiness assertion and is not qualification. Receipts are /private/tmp/pr2-463ebb-owned-startup-review-closure-receipt.json and /private/tmp/ci-final-owned-startup-five-gap-closure-review.json.

Normal automatic merge is disabled and the prerequisite is draft while this correction receives fresh full CI, package qualification and 5/5 review. Earlier green checks at 5a9ce11 remain historical. Actual code-owner approval is still required; no protection is bypassed. The updated runs/adapters map pair records source-only scope, bringing the prerequisite review to 63 files after the required Storybook catalog review below.

Codex remains 1a0ca66242121e39d88455aa2b52a07acc4a07d9 in #15683, based on the previous prerequisite. The Claude owner retains its branches, cached guided-setup fix, verification and separate $50 allowance. Coordinate reconciliation of the common repair before rewriting those branches; don't duplicate it in a leaf slice.

The idle local preview still serves literal behavior fe1ecf1c34, recovery ready and zero active runs. Its four saved legacy/native configurations and two historical native records remain preserved; it has not been refreshed to this new runtime. Final local/managed acceptance must use the tested source, independent file checks and follow-up continuity.

The prepared private execution checklist reuses existing evals, installation, Cloud composition and campaign paths. Required holds are final source/image/ migrator, the actual verified-master private distribution, pinned QA onboarding, warm/cold signup, production baseline and previous-image compatibility. Production Fleet Admin sign-in is pending. Current paid holds remain $248.179254104 of $250; unknown/cleanup holds stay reserved, and the unstarted managed envelope is $2.50. No new image, paid resource, rollout or default promotion was dispatched.

Master reconciliation uses 4b958ecbd8f33a7782fe6f29ec825f80f636b833. The new contribution rules are satisfied: 157 added comment annotations were removed from 35 files, with identical executable JavaScript/TypeScript emission, parsed workflow values, 77 action pins and shell commands. No code file crosses from below 1,000 lines to above that limit. Final focused checks pass 248 tests (107 workflow/package, 54 runner, 42 server, 45 E2E support). Both runner no-emit checks and the canonical server/E2E no-emit checks pass with isolated matching workspace dependencies. Only JavaScript/TypeScript preparation ran locally; root preview links and data stayed unchanged. The earlier linked-source failures remain recorded and are superseded only by the new canonical check receipt.

The existing Storybook catalog has 21 source-review fingerprint updates because its declared runs/adapters map input changed. All affected stories, subjects, wrappers and fixtures remain byte-identical to master. Review classifications stay unchanged. The catalog check passes 223 files/2,210 stories; this is structural/source evidence, not visual or live proof. Source receipts are /private/tmp/pr2-9f59-comments-cleanup-receipt.json, /private/tmp/pr2-storybook-owned-final-receipt.json and /private/tmp/pr2-frozen-canonical-noemit-receipt.json.

Next action: publish this reviewed prerequisite correction, require fresh hosted gates, reconcile Codex and Claude with its actual source, then resume the existing remote package/immutable preview and dedicated staging qualification. Merge ready slices normally in the agreed order; actual production readiness requires the private distribution and rollback/forward-recovery evidence afterward.

CI fixture, network policy and map synchronization checkpoint

Runtime prerequisite source is 5a9ce11c49db31440863d633426ebe30bcc850ca with 59 changed files. The hosted static check on literal Codex source eee0534 passed 133 cases and failed one: its isolated assembly fixture omitted the new target JSON, so the helper failed before its existing Cursor-identity assertion. The fixture now copies that exact inert JSON; all negative assertions remain. Baseline provider-pack controls reproduced eight passes and one failure; treatment passes nine, with 16 related provider/assembly controls passing. No local Cargo or Docker build was used.

Codex behavior source fe1ecf1c3449c21d6e6f0c9d9772d1949b80ea82 fixes the fresh no-network P1. Effective Legacy ACP restrictions, including plain or unresolved secret bindings, now fail native selection with field-specific Legacy guidance. The unused flag for an explicitly selected CLI, existing Legacy/native execution, and trusted server-owned native network policy retain their behavior. Five failures reproduced before correction; all 112 selection controls, canonical server no-emit, and independent source review pass. No secret was read or native network authority translated to an agent setting.

The replacement user AGENTS.md requires synchronized feature/access maps in the same change. Eight existing documents now describe the affected behavior and access limits: the environment pair belongs to the prerequisite; agents, onboarding and runs/adapters pairs belong to Codex. The Codex review is 105 files, comprising its original 99 plus six required map documents. Preserve required documentation and useful tests rather than satisfying the lower-priority former 100-file preparation guideline by dropping them. IDs, original baseline review scope and indexes remain intact. Both structural checks pass 35 areas and 171 capability IDs. Scoped source references are separate from live proof; all new agent/provider map recipes remain explicitly source-only/not-run. Independent map and fixture review is clear.

The local preview serves this behavior source as 2026.1005.0+407.git.fe1ecf1c34. Four complete execution configurations and two historical native runs survive the controlled restart unchanged, recovery is ready, active runs are zero, and the deprecated flag remains false. Receipts: /private/tmp/pr2-fe1e-preservation-{before,after}.json. Staged daemon preflight required no source build. Provider actions, Cargo builds and Docker builds are zero. This record's subsequent commit changes documentation only.

Current-source full CI and fresh review remain gates. Prior eee0534 hosted typecheck, build, Rust, Canary and eight E2E shards passed, while aggregates were incomplete; those results are not relabeled as the new head. Prior prerequisite d16eccf had fresh 5/5; the new source requires review again. The Claude owner is carrying these shared changes and owns its separate fixture corrections and verified explicit effort-clear semantics. No final image, merge or production deployment has occurred. Managed onboarding/task/follow-up remain pending.

Codex configuration review closure checkpoint

Runtime prerequisite #16028 advances to d16eccf109b524778ceb896f79ccb3881bc61a9b, with 57 files. Its small shared builder correction preserves saved or selected Codex reasoning effort without adding Codex settings to other providers. All 52 existing builder tests pass in the actual prerequisite checkout. The earlier cae179 fresh 5/5 review is retained historical evidence; this new source requires fresh checks/review.

Codex behavior source is b63b779fe141ffe8db6d200580335de84ee78651, on codex/codex-runner-default; #15683 retains 99 changed files. Review reproduced eight selection failures and six import/builder failures before correction. All six actual ACP aliases now follow Legacy precedence before native compatibility checks. Unsupported settings name the effective source field and offer explicit Legacy; Legacy itself is unchanged. Native imports retain hidden runtime settings and account bindings through ordinary edits. Explicit clears/removals and intentional harness changes remain effective. Existing controls pass: 100 selection, 91 UI, and 52 builder; counts can overlap. Canonical server/UI/adapter no-emit, token gates, and independent source-matching reviews pass. No new suite, schema, or API was introduced.

The local test-drive restarted on this exact behavior source and serves 2026.1005.0+403.git.b63b779fe1. Startup recovery is ready, active runs are zero, and all four complete legacy/native execution configurations and two historical native run records match before/after. The deprecated flag remains false. Prefix-specific receipts are /private/tmp/pr2-b63b-preservation-{before,after}.json. The staged Mac daemon passed preflight with sourceBuild=false and needsBuild=false; startup used JavaScript preparation only. Provider actions, Docker builds, and Cargo builds are zero. This checkpoint's subsequent commit changes only this dated record.

Current-head full CI/review and managed onboarding/task/follow-up remain required. No merge or production deployment has occurred. Keep expensive final previews deferred until the prerequisite merges and Codex is reconciled with actual master. The authorized Claude owner is coordinating its dependent PRs and existing bounded evidence; root retains normal sequential merge ownership.

Metadata review closure checkpoint

Runtime prerequisite source is cae179c21412048d08aeb94e0fe8b0f7844119de, with 55 changed files; Codex remains 99 files. Two fresh metadata review P2s are fixed: explicit null clears user metadata, and saves preserve only the latest private platform proof through an atomic database update. Config/driver updates invalidate proof in the same write; status cleanup retains its existing archive-token behavior. Public callers cannot supply the proof.

The three existing environment suites pass 83 controls. Seven focused tests exercise real PostgreSQL writes between request preparation and save; there are 42 name-filter exclusions and zero host-guard skips. Both canonical server no-emit commands pass. Source hashes match in both worktrees and independent review is clear. A separate read-only audit confirms no actual company/team import bypass or proof export: portability does not copy environment rows, and environment API responses strip the private subtree. No new infrastructure, provider turn, Docker/Rust build or schema/API change was introduced.

Fresh exact-head full CI/review remain required. The verified Mac preview restart at 64d0746f8a preserved four execution configurations and two historical native runs with the deprecated flag false and no provider actions. Refresh the idle preview to the next recorded head; old measurements retain their literal source. Merge the qualified prerequisite first, then reconcile Codex with actual master before the final remote image and managed acceptance. No merge has occurred.

Fixture closure checkpoint

The runtime prerequisite advances to 093b97aa12 with 54 files. The Codex review remains 99 files. Existing managed fixtures now run the saved environment probe before native-generation Codex creation and inspect server defaults only for automatic requests. The owned setup probe lease joins the existing runtime estimator, with unrelated leases excluded from task attribution. The fixture contract records one setup lease per eligible cell, zero provider turns, zero retries, a 330-second HTTP deadline and a 10-second platform command deadline. Archive/release, expiry and failure-cost holds remain unchanged.

Both worktrees pass 36 existing fixture/billing controls and canonical E2E no-emit. Existing catalog/report controls pass 46 cases, and core compatibility discovery succeeds. Affected adapter discovery/setup routes pass 69 controls. Unknown sandbox facts now expect Legacy; measured GNU2.39 ARM64 expects native. All checks use fixtures, not paid provider proof. Exact-head hosted CI/review and real managed onboarding/task/follow-up remain pending. No merge has occurred.

Corrective source checkpoint: ready for fresh CI and review

Runtime prerequisite source is cf19e086ae4a0142c8b4314771c55f73b294805b on codex/runner-native-platform-prerequisites, with 50 changed files. The Codex-default branch codex/codex-runner-default is composed on it and retains 99 changed files. Both reviews remain under 100 files. All four original review findings and the relevant independent-review follow-ups are fixed.

Existing controls pass: release workflow 70, assembly 7, registration 15, measured environment/probe routes 32, UI permission/forms 207, and selection/import 140. Counts describe separate runs and can overlap. Canonical server, runner and UI no-emit checks and token gates pass. Source-matching independent reviews confirm cleanup, immutable-image binding and saved Legacy permission handling. No local Docker/Rust build, new provider turn, or agent migration was used.

Remaining gates are fresh exact-head full CI/review and managed Codex acceptance. The existing managed eval catalog already requires OCI digests. Its image-backed fixture helper must use the existing explicit environment probe before automatic Codex creation and inspect the stored default; explicit-runner coverage remains separate. First-task onboarding fixtures are local-only, so fresh managed onboarding still requires live proof. The pinned fleet tenant currently uses a name-only snapshot and cannot establish native-default compatibility. Use a qualified immutable image-backed QA environment, preserve the tenant pin, and verify the serving commit and independently checked task/follow-up artifacts.

Merge the prerequisite after its applicable checks pass. Then reconcile the Codex PR with actual master, verify its final source, and build the immutable preview and DB/shared pair remotely once. All three cancelled previews remain excluded. The original budget and cleanup holds remain unchanged. Claude owns its separate bounded proof and downstream attestation reconciliation. No merge or production deployment has occurred at this checkpoint.

Final review checkpoint: shared fixes and sandbox qualification

The user authorizes normal sequential merges after the applicable gates pass. Runtime prerequisite #16028 and Codex defaults #15683 remain draft. Their pre-fix sources are 00ac509b0a and 8de43be4cd. The shared SSH argv and verified cold-resume corrections are already composed. Six argv controls, fourteen recovery controls, and actual SSH subprocess checks pass. The separate Claude owner reports real ARM and Linux x64 task/follow-up pairs across controller restarts on its literal installed-package overlays; those results do not qualify an unmodified final Codex package.

The Mac test-drive serves 8de43be4cd at port 3125. A read-only restart comparison preserves four full legacy/native execution configurations and two historical native runs with the deprecated native flag false. Zero provider turns and zero local native/Docker builds were used. The canonical server no-emit passes on the composed root and actual prerequisite worktree.

Both shared fixes are implemented and frozen. The actual workflow selector rejects candidate execution/output injection in real Git fixtures. Its full existing release-workflow suite passes 70 tests; existing target assembly passes 7 tests. Registration passes 15 focused controls and canonical runner no-emit. An independent scoped review confirms bounded teardown and retained private state on unconfirmed release. The first broader local workflow attempt failed only because mock loopback listeners were sandbox-blocked; its loopback-enabled rerun passes. No daemon/provider execution was used by these controls.

The generic sandbox qualification support passes 30 existing probe and route controls plus the canonical server no-emit command. It accepts only OCI digest images, checks the returned cleanup receipt, and reports conditional-update races without claiming a record. Mutable or name-only configurations retain existing connection behavior and receive no native compatibility credit. The default consumer and explicit-permission/import controls are being composed next.

Fresh review found four source defects: candidate-code execution during CI runner selection, unbounded registration teardown, a lost explicit Codex permission setting on automatic Legacy selection, and missing sandbox platform/libc facts. Existing subagents own narrow fixes in parallel. Use inert target data and workflow-owned public labels; preserve primary failures and private state on unconfirmed cleanup; preserve explicit permissions; and use server-measured sandbox qualification bound to its effective image/config and company scope. The existing explicit environment-probe/setup flow owns qualification. Saving and discovery must not provision resources or accept client-authored evidence. Unknown targets retain automatic Legacy with an actionable explicit-native error. No new product API or database migration is planned.

Preview runs 38303434211, 38304889308, and 38306885592 were cancelled as shared source defects changed their candidates. They are excluded from final qualification. Preserve historical evidence and all cost and cleanup holds. The next action is to finish the four fixes, run affected controls, obtain fresh exact-source checks/review, then build the final immutable preview and matching DB/shared pair remotely for the pinned QA tenant. Managed Codex retains its $2.50 setup/task envelope and $2 cleanup within the original $250 ceiling. Claude retains its separate $50 ceiling. No merge or production deployment has occurred.

Latest checkpoint: runtime prerequisite and authorized merges

The user authorizes preparing and merging ready PRs in dependency order. Production deployment and provisioning-default promotion remain separate actions. The Codex-default candidate is preserved at bb7591dfd0c4c8569e2a0b4303ff06de8ca3e9e2; its running test-drive remains at 3125. No existing agent changes runner.

Its qualification work grew the review to 135 files. Extract the independent runtime, installed-package and hosted-build changes onto codex/runner-native-platform-prerequisites, based on master 7d9b93aee2b79b2f035c5838741ce0b94168ec83. This prerequisite contains 39 source files and this record. Creation policy and experimental gates remain identical to that master. README activation text and eight existing default-selection controls stay in the dependent Codex PR #15683, whose expected review is 98 files. Preserve all work and both branches.

The isolated extraction passes 276 existing focused controls. Runner no-emit passes. The standard server no-emit initially finds a linked dependency-output skew: the new master's ACP constants are absent from the old checkout's compiled adapter-utils. A source-aware diagnostic passes; canonical verification remains pending until its matching JavaScript dependency is prepared. Full hosted CI, native compilation and fresh review are still required for the extracted head. Do not count the diagnostic as a passing standard command.

Retained qualification keeps literal identities: four producers and Linux x64 and both Mac consumers pass at a200495; installed ARM native startup passes with scoped stock Ubuntu prerequisites in 38291535914. Those artifacts are not relabeled as the extracted source. The Linux baseline is GNU libc 2.39+, on x64/AArch64. Windows and Alpine remain deferred. Cargo caches and overlapping JavaScript/native preparation use existing hosted workflows. No local Docker/Rust builds or bundled Codex payloads are introduced.

Merge order is runtime prerequisite, Codex defaults, then the existing Claude protocol #15994, default #15993, and platform #15997 PRs. The authorized Claude chat owns its verification and fixes; this task coordinates normal squash merges after applicable gates. The older Grok Cloud PR is an independent lane, with its own missing snapshot-cleanup access and live proof.

The extracted runtime prerequisite #16028 is open at ddcd746eb6a01f2bbe9b4adeec238ba35bde5adb. The default branch is composed on it with all 134 owned implementation/test files identical to bb7591dfd0; this record retains every historical checkpoint. Next action: require current-source CI/review and remotely prepare the exact composed Codex staging image and DB/shared pair. The existing QA tenant remains pinned to old 2dbe43a4. Managed Codex retains its $2.50 setup/task envelope and $2 cleanup; historical unknown holds remain within the original $250 ceiling. Claude has its separately authorized $50 ceiling. Missing live proof remains unresolved.

Retained checkpoint: ARM qualification and master integration

The Rust daemon, protocol, Codex driver, creation policy, and provider requirements remain unchanged from qualified source a200495cc7488f4d59da570407e516cf702e5af8. Its verified 18-package archive retains that literal identity. All four hosted daemon producers, Linux x64 clean installation, and both Mac installed startup/cleanup consumers pass. The original unprepared ARM failure remains recorded; qualified ARM startup passes with stock scoped OS prerequisites and no global restriction change.

The committed-helper consumer passes using tooling 0690801 and literal a200495 packages. Receipt: /private/tmp/ci-final-0690801-integrated-arm-receipt.json. Fresh review at a5b1683 is 5/5, with all 16 threads resolved. That correction loads the helper from the immutable workflow definition rather than an older frozen product checkout that does not contain it. A separate sparse checkout uses job.workflow_repository/job.workflow_sha; both source identities and the helper digest enter the existing report. No mutable branch or caller-source fallback is used. The original product consumer and archive guards stay intact.

The actual final workflow wiring also passes: immutable helper checkout, stock prerequisite preparation, native session, default daemon, read-only model context, and joined cleanup. Its three critical steps are byte-preserved from the delivery workflow. Literal product source is a200495, definition base is a5b1683, and actual tooling source is 8eb3595a. All 18 packages and lock/daemon/official-launcher/native-payload hashes remain unchanged. Global restrictions stay 1/Y/1; scoped profiles stay enforced. No overlay, direct-control substitute, Rust rebuild, credentials, or provider turns were used. Receipt: /private/tmp/ci-final-a5b1683-final-wiring-receipt.json. Normal OS APT installation and paid ARM task/follow-up remain unproven.

Master 82274853729f8c5b0f812da08595020f7eb64d66 requires one test-fixture conflict resolution. Its shared test-home cleanup replaces the duplicate traversal. Real Mac Node 24 tests expose ENOTEMPTY for read-only descendants; the shared helper now retries only after restoring owned directory permissions. Unrelated errors remain visible; symlinks and immutable file modes stay intact. All 84 fixture/selection controls, server typecheck, 80 merged workflow/cache controls, and token gates pass. Both master's general release-crate cache and this branch's native producer dependency cache remain. Receipts: /private/tmp/codex-default-master-home-cleanup-fix-receipt.json and /private/tmp/codex-default-master822748-readonly-audit.json.

Master's heartbeat extraction updates server orchestration. Historical frozen package startup and useful-task evidence remain component proof with literal revisions; they are not relabeled as complete current-server onboarding proof. The last verified preview restart serves 2026.1005.0+352.git.0690801f13 at 3125, preserving all four agent configurations and both historical native runs. The downloaded Apple Silicon daemon requires no source build or binary override.

Fresh review at 665c155 reports three valid findings. Remote sandbox setup and execution now share the existing actual-target OS/architecture resolver rather than selecting the Mac controller's daemon. Thirteen new baseline failures reproduce the issue; 124 target/setup/backend and retained-artifact/version controls pass after the fix, with server typecheck. Header, digest, preinstalled artifact, and remote build-metadata verification stay strict. Foreign artifacts are read/hashed on the controller and executed through the remote launcher. Local and non-Codex paths remain unchanged. Receipt: /private/tmp/codex-default-sandbox-target-fix-receipt.json.

Unchanged saved setup choices now bypass only new-selection resolution, retaining later secret, company/environment, authentication, and runtime validation. The actual disabled legacy baseline returned 422 before its probe. Treatment passes 175 existing controls plus a native-provider switch negative, with server typecheck. New, explicit, draft, and changed-harness choices keep the disabled adapter policy. Receipt: /private/tmp/pr2-disabled-saved-codex-owned-receipt.json.

The actual served Codex guide reproduces stale Mac/ARM legacy text at 665c155. It now uses the shared GNU libc floor, lists qualified Linux/Mac architectures, distinguishes legacy fields, and preserves existing-runner and failure semantics. Adapter typecheck passes; the updated served guide needs final-preview proof. These corrections update server setup/execution and guide source. The qualified a200495 package startup and historical task evidence retain their literal component boundaries; no new managed live proof or paid turn is claimed.

Fresh review at e79254b verifies the preceding fixes and reports one valid development override edge. The common remote resolver now preserves PAPERCLIP_RUNNER_BINARY only when the measured target OS/CPU matches the controller. Explicit remote overrides retain priority; every selected artifact still requires a matching native header. Cross-target selection ignores the controller override. Seven new baseline failures reproduce the defect; 133 target/setup/backend/retained/version controls and server typecheck pass after the correction. Receipt: /private/tmp/codex-default-same-host-override-fix-receipt.json.

The e79254b preview restart preserves all four configurations and both historical native runs. Its actual served guide now reports the shared GNU floor and qualified Mac/ARM targets. No native build, Docker build, or provider call runs locally. Main CI's selector remains unallocated; other PRs share this queue. No environment approval, owned concurrency conflict, or routing failure was found. Org capacity versus GitHub allocation is unconfirmed. Receipt: /private/tmp/pr2-e792-selector-queue-investigation.json. Required final CI aggregates and fresh review remain pending, not passed.

Next action: require fresh CI/review on the final corrected candidate, refresh the matched preview, and publish final conclusions in the canonical PR's evidence index. Human code-owner approval, managed staging onboarding, and actual post-merge Cloud composition remain outstanding. No merge or production deployment is authorized. Historical unknown costs and cleanup holds remain reserved; all Dockerfile/native builds stay remote.

Current amendment: remote build performance and Linux baseline

The user requires Cargo dependency caching and overlapping JavaScript/native preparation in the existing hosted jobs. Dockerfile and native builds must stay off this Mac. Reuse the current child supervisor for concurrent commands and failure/cancellation cleanup; join both outputs before source, header, signature, and hash recording. Cache dependency crates only, keyed by target, OS baseline, compiler, lockfile, and external contract inputs. Only canonical exact-source master pushes may save trusted caches. Preview jobs restore only. Seventy-nine workflow/process controls pass; actual speed or cache hits remain unproven until the final hosted run. Receipt: /private/tmp/pr2-native-cache-parallel-owned-receipt.json.

The exact dcdf09a0f33536fa2b6daaf6e731d921d5711282 four-target qualifier 38268767165 has built all four actual daemons. Linux package installation passes, as does the clean Apple Silicon consumer. ARM64 installs successfully but native session startup fails; cleanup masked the original cause. Ordinary CI passes at that source. Fresh review found a target-daemon selection mismatch for cross-architecture SSH: an x64 controller could select its own daemon for an ARM64 environment. The existing resolver/setup/execution seams now select and verify the actual target header. One hundred four affected controls and both typechecks pass. Setup and execution share the fix; missing or wrong artifacts fail explicitly. Receipt: /private/tmp/pr2-native-ubuntu-ssh-owned-receipt.json.

The existing installed startup fixture now preserves the primary error and separately records cleanup failure. Fourteen controls and E2E typecheck pass. Docker isolation, no-network policy, and zero provider turns stay unchanged. Use the exact failed package artifact 11757308120 from run 38268767165 in one disposable hosted ARM diagnostic job. Keep corrected tooling provenance separate from its literal dcdf09a product source. Verify registry ZIP digest, bounded archive members, source, and every package hash before using the existing consumer. This temporary diagnostic ref adds no permanent test suite or workflow inputs. The primary cause and final ARM startup remain unresolved. Receipts: /private/tmp/pr2-installed-startup-error-preservation-receipt.json and /private/tmp/ci-final-dcdf09a-arm-startup-failure-receipt.json.

Independent inert ELF inspection of both Linux artifacts at this revision confirms required GLIBC_2.39, GNU loaders, libc.so.6, libm.so.6, and libgcc_s.so.1. Neither binary was executed locally. The published Linux baseline is therefore GNU libc >=2.39 on x64/AArch64. Pin current producers to Ubuntu 24.04; clean consumers use the pinned Debian 13 Node image. Do not claim older distribution/kernel qualification. Automatic new-agent selection rejects measured older, musl, or unknown Linux libc; existing native configurations keep their execution. Windows and Alpine/musl remain deferred. Receipts: /private/tmp/ci-final-dcdf09a-linux-arm64-data/elf-dependencies.json and /private/tmp/ci-final-dcdf09a-linux-x64-data/elf-dependencies.json.

The libc guard passes 209 focused controls and both typechecks. Seven actual POSIX probe/version controls pass. Forty-one built-in database cases did not execute because embedded PostgreSQL timed out on this Mac; require Linux CI. Token gates pass with the pinned pnpm launcher. Receipt: /private/tmp/codex-default-glibc-floor-receipt.json.

Next action: freeze corrected diagnostic tooling, identify and fix the actual ARM startup cause, then require fresh hosted qualification, CI, and review. Keep the current branch, PR, test-drive, budget holds, and no-Codex-bundling boundary. No merge or production deployment is authorized.

Checkpoint 695506ad3912fa63604ca784fda50416fba983d6 is pushed and passes ordinary CI (53 successful checks, four conditional skips). The restarted test-drive serves 2026.1005.0+348.git.695506ad39; four complete agent execution configurations and both historical native runs survive unchanged, with the old experimental flag false. Normal staging selects the verified Mac target and reports needsBuild: false; there is no binary override or local Cargo build. Receipt: /private/tmp/pr2-final-preservation-after.json.

The hosted ARM diagnostic used tooling 695506ad and the literal dcdf09a package archives. It recovered the primary failure: Codex's bubblewrap cannot create a namespace inside the restricted Docker fixture. Daemon/CLI installation and ABI were not the cause. The existing consumer now retains that Docker install/lifecycle proof and uses the same installed graph on the actual ARM host for unchanged read-only startup. Lock, daemon, and official Codex command hashes must match across Docker/host and before/after. Twenty-one controls and independent review pass. No external-sandbox substitution, sudo, sysctl, namespace flags, or product permission policy changes are used. Actual host capability still needs proof. Receipt: /private/tmp/pr2-arm-host-split-owned-receipt.json.

Fresh review also found that the daemon's new libc gate had accidentally sent older Linux browser login to PATH-only lookup. A two-file fix restores owned Codex CLI resolution independently of daemon eligibility. One hundred twenty-four focused cases and server typecheck pass; nine regressions fail before the fix. Creation's libc floor remains unchanged. Receipt: /private/tmp/codex-default-login-libc-decoupling-receipt.json.

Next action: freeze this corrected tooling and run one remote ARM host treatment against the same verified archives. Require actual host startup before the final four-target qualification; retain literal product/tool source identities.

The host treatment at tooling 123a18837478d8cd0e2aff23f7e7aa86c9107de3 also fails native startup. The actual ARM host reaches the installed daemon and Codex, then bubblewrap fails loopback RTM_NEWADDR with Operation not permitted. No successful native session or after-start continuity is claimed. Docker/host installation identity passed. Exact upstream Codex 0.160 source places namespace creation before its own seccomp filter and always restricts networking for filesystem helpers. A Paperclip network-mode change would not solve this. Prepare one temporary same-policy direct Codex control plus read-only host namespace facts to distinguish host enforcement from native mediation. Do not alter kernel, Docker, or product permission policy. Receipts: /private/tmp/ci-final-arm-host-diagnostic-123-receipt.json and /private/tmp/codex-default-arm-sandbox-source-diagnosis.json.

Fresh 123a188 review is 5/5 with one payload-continuity finding. The existing consumer now hashes the actual official Codex native executable separately from its launcher, checks containment/header, and compares both across Docker, host, and before/after. Twenty-one controls pass, including native-only mutation and an older supported package layout. Receipt: /private/tmp/pr2-native-codex-payload-and-control-preparation-receipt.json.

Ordinary 123a188 CI found two test gaps. Nine new login fixture controls were shadowed by Vitest's global module bridge. The existing bounded plain-Node resolver seam now proves private package selection and containment before only fake login; all 27 login cases and typecheck pass. A repository test reloaded one millisecond after Save, before any update request reached the server. It now awaits the real saved-value render, then retains the persistence assertion after reload. No product repository code changes. Receipts: /private/tmp/codex-default-login-resolver-isolation-receipt.json and /private/tmp/ci-final-123a188-repository-e2e-analysis.json.

Next action: freeze these review/test fixes, run the bounded direct ARM control, and require fresh Linux CI. Keep ARM startup sign-off unresolved until proven on a compatible target; package installation and direct execution alone do not qualify the native runner. All Docker/native builds remain remote.

Checkpoint 598e190cb308f4d7f8f43c188c2e7d88c3fc90d1 passes ordinary CI: both required gates, 54 successful checks/statuses, and four conditional skips. Fresh review is 5/5; all 15 review threads are resolved. Human code-owner approval is still absent. The test-drive serves 2026.1005.0+350.git.598e190cb3; all four execution configurations and both historical native runs survive restart. The verified Apple Silicon daemon remains unchanged, needsBuild: false, with no binary override, native compilation, Docker build, or provider turn locally. Receipts: /private/tmp/ci-final-598e190-ci-review-receipt.json and /private/tmp/pr2-final-preservation-after.json.

The direct/native ARM diagnostic records GNU libc 2.39, AppArmor enabled with restricted unprivileged user namespaces, an unconfined current profile, zero effective capabilities, and no seccomp filter. Native startup still fails at bubblewrap loopback RTM_NEWADDR. The direct control stopped before Codex spawn at a TOML preservation guard, so it does not establish the sandbox failure's cause. Receipt: /private/tmp/ci-final-arm-direct-diagnostic-598-receipt.json.

Pure, integrity-bound public smol-toml 1.9.1 reproduction identifies that guard failure: its null-prototype tables differ from the writer's spread-created ordinary objects. Preserve the parser's tables while changing only the intended trust field; keep strict comparison, original comments/bytes, private writes, and malformed-input rejection. No parser pin, semantic bypass, or permission change. The existing suite passes 22 controls across both table representations; real 1.9.1 treatment repairs five valid configurations and keeps two invalid configurations unchanged. Runner/server typechecks pass. Receipt: /private/tmp/codex-default-startup-trust-fix-receipt.json.

The four-target performance qualifier uses literal 598e190 product/workflow source. Observed Linux x64/ARM64 and Apple Silicon builds pass with actual concurrent JavaScript/native preparation. Cache restore is exercised; observed results are cold misses, not measured speedups. The cache writer is reachable through the existing verified master canary push, with exact source and repository guards; no write-gate expansion is needed. Linux daemon bytes match the measured GNU 2.39 baseline. Remaining producer/consumer results must be recorded before qualification claims.

Next action: freeze the narrow trust correction, repeat the bounded direct control with explicit corrected-tooling provenance, and retain native startup as mandatory. A private namespace negative control and bounded read-only AppArmor journal may help distinguish host denial. Do not modify host policy, relax Codex's sandbox, or substitute direct execution for native qualification. Require fresh CI/review after the correction. ARM startup and managed staging remain unresolved; no merge or production recommendation is made.

The frozen production checkpoint a200495cc7488f4d59da570407e516cf702e5af8 passes CI (54 successful checks/statuses, four conditional skips) and fresh 5/5 review; all 15 review threads are resolved. It serves the test-drive at 2026.1005.0+351.git.a200495cc7, with four complete agent configurations and two historical native runs unchanged after restart. No local native/Docker build or additional provider turn ran.

Its exact-source qualifier builds and verifies all four daemons. Linux clean installation and both actual Mac native startup/cleanup consumers pass. Cache restores are real cold misses; JavaScript/native preparation overlaps on all four producers. The unchanged host's ARM startup fails at AppArmor's namespace capability restriction, so that original run remains failed. Public artifact 11763536756 contains the verified 18-package graph. Receipts: /private/tmp/ci-final-a200495-hosted-qualification-receipt.json and /private/tmp/ci-final-a200495-cached-producer-observations.json.

The separate stock-prerequisite ARM treatment passes actual native startup, default daemon resolution, model selection, read-only context, and joined cleanup on the exact same packages. Lock, daemon, official Codex launcher, and native payload hashes match before/after. GNU libc is 2.39. Global AppArmor enforcement, namespace restriction, and clone setting remain Y/1/1. Authenticated Ubuntu package files provide system bubblewrap and its reviewed stock scoped profile. Only those files are materialized; no package maintainer scripts, sysctl writes, or broad profile reload runs. This is a qualified target prerequisite, not a product permission-policy change. The user has no other QA ARM host. No new paid environment was provisioned. Receipt: /private/tmp/ci-final-a200495-arm-stock-prerequisite-receipt.json.

Keep the boundaries explicit: normal OS APT installation is unproven; the actual Paperclip npm installation and native startup are proven. The separate direct control hits a read-only temporary-home error and is excluded from native qualification. No ARM paid task/follow-up is claimed. Actual Apple Silicon useful-task/follow-up evidence remains tied to its recorded source and identical verified daemon bytes. Existing agents keep their runners.

The tested setup body is integrated as scripts/prepare-linux-arm64-qualification.sh, with an early hosted-Linux guard. The existing ARM-only qualification step invokes it before the existing consumer and uploads its report through the same artifact pipeline. Four focused workflow and guard controls pass; syntax and diff checks pass. Receipt: /private/tmp/codex-default-arm-prerequisite-ci-integration-receipt.json.

Next action: require latest-head CI/review and one hosted consumer against the unchanged a200495 production packages using the integrated helper. Production code remains frozen there; subsequent edits are qualification tooling or documentation and retain separate source identities when reusing those literal package archives. Managed staging, human code-owner approval, actual post-merge cloud composition, and production sign-off remain outstanding. No merge or deployment is authorized.

Current addition: Linux ARM64

The user now requires ARM Linux support as well. Treat ARM Linux as ARM64 (aarch64), alongside Linux x64 and both macOS architectures. The earlier Linux ARM deferral below is superseded for ARM64; 32-bit ARM and Windows retain legacy defaults. Existing agents keep their saved execution.

Extend the same native Codex creation/discovery contract and existing selection, login, built-in and plugin fixtures. Extend the current release assembler and remote workflow matrix to the fourth target, with an actual ARM64 hosted build and clean installation. Reuse the installed no-turn Codex startup check and the same public npm tarballs. Read required targets from the selected source so historical three-target promotions still work. Keep the Linux x64 managed provider pack distinct from the local ARM64 daemon.

No local Rust/Docker builds or new paid Linux campaign. Apple Silicon task and follow-up acceptance remains valid at the explicitly recorded source; Linux ARM64 build/install/startup must acquire its own evidence. The existing three-target qualifier completed successfully at d522822, including both clean Mac consumers. It does not qualify ARM64. Candidate 058af8f1b69c5fa3d9bc974b9eab73c141b52823 passed ordinary CI and fresh 5/5 review. Its remaining import display finding is fixed by sharing the existing legacy argument-policy calculation with the UI without changing execution permissions. Ninety-five focused controls pass; all 45 exact argument cases also pass against the original builder. Four component cases fail on the original page. A no-provider protected preview shows Legacy with bypass off, matching --sandbox read-only; it does not apply another import. Receipt: /private/tmp/codex-default-dc-import-live/legacy-policy-p2-receipt.json.

ARM64 selection/discovery controls pass 46 and 29 cases. Fourteen isolated browser-login tests pass after replacing the hardcoded ARM64 legacy login branch with the shared platform contract. This uses native execution's owned Codex resolver on ARM64 and retains PATH lookup for unqualified platforms. Shared typecheck passes. Built-in and plugin fixtures now include ARM64; their database checks remain in normal Linux CI. Receipt: /private/tmp/pr2-linux-arm64-selection-checkpoint.json.

The packaging patch passes 97 existing controls: 15 assembler/provider-pack, 20 consumer-boundary and 62 workflow tests. The first full workflow attempt was blocked by sandbox localhost permissions; the same full suite passes with its temporary listener access. Three workflow YAML files and MJS/shell syntax pass. Independent review confirms historical source compatibility and the unprivileged offline consumer boundaries. Official registry metadata confirms the pinned Node image has a native ARM64 manifest and the installed Codex dependency has an ARM64 package. No image or binary was pulled to this Mac. Receipt: /private/tmp/pr2-linux-arm-packaging-owned-receipt.json.

Actual ARM64 daemon build and clean npm/native startup remain unexecuted at this source freeze. The test-drive stays on its existing verified Mac daemon; its last restart at 058af8f preserved both full execution digests, both recorded native runs and both paused imports, with the deprecated flag false. Receipt: /private/tmp/codex-default-dc-import-live/final-restart-receipt.json.

Next action: integrate the narrow policy display and ARM64 source/package fixes, run targeted controls, freeze/push one candidate, then run the existing hosted qualification once with all source-declared targets and require fresh CI/review. Keep the same branch, PR, preview and evidence index below. No merge or production deployment is authorized.

Current amendment: include macOS in this PR

The user requires macOS support in the same Codex-default PR. The earlier Linux-only scope and macOS deferral below are superseded. Qualify Linux x64, macOS arm64 and macOS x64 through the shipped package path. Windows and Linux ARM keep their legacy defaults. Existing agents retain recorded execution. The user explicitly invoked dotta:paperclip-test-drive. Real task/follow-up acceptance is required on this Apple Silicon Mac. Intel builds must be attempted; an attended Intel provider journey is not required. Reuse the healthy test drive and the existing Product E2E helpers rather than create another test system.

Keep the current PR and branch: #15683, codex/codex-runner-default. The Mac qualification source is d522822a5daeb72d124360b576b82a8bb52b43f4; its ordinary CI is green. Fresh automated review is 5/5. The development release-manifest finding is fixed with focused tests and awaits fresh final-head review. Earlier Linux-only source 6ca302426b768791b499d2d563bbca4276f2c908 had fresh 5/5 review and eight resolved threads. That historical review does not qualify the macOS amendment. Master integration conflicts are resolved.

The test-drive server is running through the normal dev supervisor at the Mac qualification source. Health and bootstrap are ready; the actual listener belongs to this worktree. The preserved legacy and new native Codex QA agents are idle, with unrelated title edits intact. Dependencies and ignored configuration had been cleared, so startup restored them and the normal CLI signing keys while retaining the database and encrypted account key. The initial borrowed development daemon was removed before paid testing. The production resolver selects the source-bound CI arm64 daemon. Both native task runs and restart preservation use the verified runtime below.

Implementation ownership:

• Packaging worker: reuse the existing daemon assembler, release verification and release-smoke workflows to produce source-bound Linux and both macOS artifacts. Pack the normal npm graph, then test those same tarballs on actual Mac hosts. Retain the Linux and provider-pack controls. Never bundle Codex native payloads; use the installed official npm dependency and real protocol compatibility. Compile Rust and Docker only on remote hosts.
• Selection worker: extend the shared availability contract and existing creation, onboarding, discovery, approval, import and UI fixtures. Preserve explicit legacy choices, external overrides and existing execution.
• Runtime worker: verify the existing Mac native launch, account isolation, file delivery and continuity seams; fix only actual gaps. Keep the Linux-only sandboxed workspace-command capability gated on unsupported platforms.
• Lead: integrate, run targeted and required checks, verify useful Mac native task/follow-up artifacts and ordinary editing, refresh the test-drive on the verified revision, and update the same PR and evidence record.

Reuse existing evaluations and assertions. Provider-free packaging and protocol checks do not substitute for authenticated task completion. Preserve the $250 ceiling and historical unknown/cleanup holds; reconcile only documented unstarted future reservations before any new provider turns. No additional paid Linux campaign is authorized by this amendment. Embedded-browser-only login, no automatic agent migration, and no merge or production deployment remain constraints.

The macOS source checkpoint is 7b8d29a856b54217234131474ea47ea1a38fb0aa. The frozen master integration target is b189f586d2f01c078725193b8a5ce4372b4acb3d. Conflicts are being reconciled by file ownership, retaining the newer transport, lifecycle and release verification fixes. Focused macOS selection, installed-hook, file confinement and packaging controls pass. These are source/protocol controls, not real provider execution. The existing saved OpenAI subscription is connected. The ordinary production agent-config render suite passes 111 cases after its merge.

Budget reconciliation assigns $3 of the documented unstarted $5.50 managed reservation to Apple Silicon native test-drive acceptance, leaving $2.50 for the managed journey. The completed legacy subscription journey's entire $2.50 hold remains reserved as unpriced. No historical unknown or cleanup reserve is released; the $250 ceiling and $248.18 combined cost/reservation total remain unchanged. Limit the Mac journey to two task turns, 180 seconds each, no automatic retry, and an independently checked useful file plus revision.

Mac acceptance checkpoint

The real Apple Silicon task and follow-up passed at runtime source f4abdc2cfcd779d5ad9b9c0ea8b63114c1a18a9b. The ordinary picker submitted codex_local without a runner override and saved paperclip_runner / codex. Saved subscription reuse and native setup passed. Both task runs succeeded with driver codex_app_server, observed model gpt-5.6-sol, and the same provider session. Independent attachment downloads verified exact 61-byte and 102-byte Markdown files, including preservation of the first attachment. Reload retained the native configuration.

The actual owned daemon process loaded the source-bound CI bytes: sha256:d0656673f7b6dfa6f2554fac18f3e0b42e2eb10f444b06f6063255335d71aa14. Mach-O arm64, production contract, source receipt and code signature passed. The borrowed development daemon override was removed. Startup at this revision preserved the old legacy agent's full execution digest. Unrelated UI title edits and reload preserved complete legacy/native execution digests; the shared runner picker passed light/dark, mobile and keyboard checks. Screenshots and sanitized receipts are under /private/tmp/pr2-f4-mac-ui/.

The corrected qualifier's exact d522822 Apple Silicon artifact independently matches those same bytes and metadata. Artifact 11752770004 passed native header, source receipt and strict ad-hoc signature checks. Rust tree 6ca713d5f1f0a059c7f01a37d21f268817e0c93c and runner TypeScript tree ba9744db7fe79301cb0ab442e9546de3282a4bf4 are identical to the paid-task source. The receipt is /private/tmp/pr2-d522-mac-remote-daemon/sanitized-verification-receipt.json. Restarting the test-drive at d522822 preserved both complete execution digests, titles and both native run records, with no additional provider calls.

The deprecated enableNativeRunner field is now false on this QA instance. The native export/import UI journey passes with that field disabled. Import submission omitted adapter overrides, preserved native Codex/model identity, and left the new agent paused with its import hold. The explicit Legacy round trip also passes: the request sends runner: legacy without replacing source configuration, and the saved agent is codex_local with the import hold intact. Both survive reload; the source agent remains unchanged. These imports do not run setup probes or provider turns. Evidence is under /private/tmp/codex-default-dc-import-live/.

The live import journey found one incorrect policy display. Native Codex's preserved never policy translated to Legacy bypass true, while its checkbox showed false. A narrow hydration fix uses the existing policy defaults and canonical booleans; it does not change server permission translation. Against the pre-fix page, three display cases fail and four safe controls pass. The fixed page passes 42 component cases and 40 selection controls. The no-provider preview check passes: the corrected control matches the already-saved paused agent. Exactly two paused imports were submitted, with no third Apply. The combined receipt is /private/tmp/codex-default-dc-import-live/receipt.json; it separates d522822 persistence proof from the corrected UI's content hashes.

Three-target qualification built all three daemons, including actual Intel Mac. Its clean Linux consumer passed the 18-package installation and Codex ownership controls, then a Pi probe failed because it expected the old flat daemon path. Both Mac consumers reached deferred offline lifecycle scripts but Node-gyp tried a forbidden header download. Narrow verifier corrections preserve the startup/network/lock/sentinel assertions and use the host SDK. These failed attempts remain evidence; installed-package qualification still requires a passing corrected run.

Test-only head dc7304d7c4db1c9c9ee2ed80a98d004371372771 is production-byte identical to f4abdc2. Its ordinary CI passes the required checks. Two fixture repairs enabled Dot only in its intended experiment cases and restored owner directory permissions only inside each test worker's scratch home for teardown. The actual asset producer/symlink control passed. Fresh review identified import override/availability gaps and stale dev host binaries. Their fixes now pass 38 real-component import cases (eight fail on the old page) and 12 dev-stager/freshness controls. Unknown/gated providers retain their identity. Rebuilding refreshes an existing host target atomically and keeps a running old executable intact. Fresh final-head checks/review remain required. The corrected Pi/Mac installation probes pass 19 focused controls and independent source review; actual hosted consumers remain pending.

The two native runs report included subscription use without a dollar amount. The complete $3 setup/task hold remains reserved as unpriced. No historical unknown or cleanup hold was released, no automatic retry ran, and no additional paid Linux campaign started. The aggregate ceiling remains $250.

The import, dev-stager and installation-probe fixes are pushed at d522822. The corrected three-target qualifier has passed all three daemon producers and the real Linux clean installation, including the corrected Pi probe. Both Mac consumers are checking the same 18 tarballs. Ordinary CI reports 53 successful check runs, Snyk success and four conditional skips. Fresh review reports 5/5, with one new development-only manifest issue: rebuilding a host daemon must not corrupt released artifact identity. Its fix separates local development selection from release assets; it does not alter the Rust runner, production selector or release assembler. Fourteen focused controls prove preserved release targets/hash manifest, running old inodes, correct Mac host selection and future source freshness. Independent review verifies that the atomic flat publisher and qualified release components remain unchanged. The actual Mac still selects the verified release target and does not require Cargo. Receipts are /private/tmp/pr2-dev-release-preservation-checkpoint.json and /private/tmp/ci-final-d522-dev-equivalence-audit.json.

Next action: commit the verified development/import display fixes and this state record together. Run fresh final-head CI/review in parallel with the remaining clean package consumers, then record their exact conclusions in the PR evidence index. Keep d522822 as the qualification source; subsequent UI/development checks have their own source identity. Keep exact sources in every receipt. Do not repeat unchanged paid task turns or qualification components merely for the development-only fix.

This is the 2026-10-12 source-freeze snapshot. The PR verification section is the linked evidence index for final CI, review and consumer conclusions. Current qualification links above retain their literal tested source rather than claim that an earlier workflow ran on a later development/UI commit. Managed staging execution/access renewal, code-owner approval and actual post-merge Cloud composition remain unverified. Prior staging preflight evidence is retained at 37962635959 and 37965658123.

Outcome and ownership

Users choose a harness. New agents use Paperclip Runner where the harness and execution target are qualified. Existing agents keep their recorded runner. The task owns implementation, verification, review fixes, and reviewable PRs. Merging and deployment require separate authorization.

The original implementation is preserved on codex/default-agent-runner at 171d841295808ca185a258aaeb10b3dee68bb2b9. Its public review is PR #15422. The user approved splitting that work into four useful steps:

1. Packaged runtime reliability and Codex prerequisites, without changing defaults.
2. Codex defaults across creation, onboarding, hiring, imports, and the UI.
3. Claude defaults and authentication.
4. The remaining supported harness defaults and provider-specific fixes.

Completed prerequisite

PR #15555 merged at 6f9d0a56ba3c2f0059a723b7de434320eed7eb22. Its final candidate dde37d7 passed 47 ordinary CI jobs and fresh 5/5 automated review. The actual clean Linux npm consumer checked all 17 tarballs for absent Codex native payloads and official npm host dependencies. Actual Codex 0.156.1 startup passed on macOS ARM64. Bot lockfile refresh #15673 is merged. These checks did not qualify onboarding or cloud rollout.

Removed prerequisite work remains on codex/runner-packaging-full-snapshot at 6f3060beaa842ffcee21af058370d3cab5f571e9. Do not restore its release workflows, Docker materialization, Git installer, or extra login isolation wholesale.

Current slice: Codex defaults

Authorized 2026-10-09. Canonical branch: codex/codex-runner-default. Integration base: master 2dd9811e8be1dab59cccd86cdb25e8953b02fe07. Canonical PR: draft #15683. Last pushed candidate: ad5d8826ad18f72d672fcafbdd9fec24ef8c9fef. It integrates the current agent lifecycle boundary. The next narrow follow-up restores the native Codex sign-in action and settles an existing chat test's canonical lookup before interaction. The PR remains under 100 files, with no workflow, lockfile, or database migration changes. Fresh final-head CI and review are required after that follow-up. Preview: isolated Codex QA, normal dev supervisor, separate database. Hosted Linux live onboarding passed at 38199ea8; it remains historical proof after the lifecycle integration. UI has separate revision-bound proof. Attended local subscription and managed staging journeys remain unverified.

New Codex agents select Paperclip Runner on qualified Linux x64 targets. Users choose Codex, with Paperclip Runner or Legacy runner inside Advanced. Other harness defaults stay unchanged. Existing legacy/native agents and ordinary edits retain recorded execution; explicit runner changes use revisions/session invalidation. No database migration or permission-policy change.

Resolve before validation/auth/instructions/skills at the common creation boundary. Cover direct/API/CLI creation, onboarding seeds, hires, frozen approvals, built-ins, plugins, and import/export. Unsupported platforms or active external overrides retain legacy selection. Missing dependencies, invalid models, authentication failures, and incompatible settings remain actionable errors, without silently choosing another runner. Native Codex bypasses the experimental gate; other native providers retain their existing gate.

Finish line: one narrow reviewable PR, affected regressions and required checks passing, useful Codex tasks plus follow-up and independently checked artifacts, onboarding and existing-agent preservation verified locally and on qualified managed staging, and inspectable evidence. Human merge and production deployment remain separate actions. Actual production composition remains a post-merge gate.

Coverage and execution ownership

Reuse Product E2E profiles, fixtures, graders, reports, and installation checks. The first-task native Codex case now inspects the wizard's saved default directly with the experimental flag disabled. The legacy control selects its override before authentication. Each isolated onboarding company has a $5 task budget; setup probes require their own reserved allowance. Claude's explicit native fixture is unchanged until its later default PR.

Area	Owner	Current state
Shared contract, server resolution, setup readiness	Core worker	Integrated lifecycle: 210 core cases, 109 connection cases and five affected refresh controls pass; server noemit passes; counts overlap
Production create/edit/onboarding UI and stories	UI worker	171 fresh focused cases, 30 desktop/10 mobile captures and six keyboard checks; built-in follow-up passes 15 cases, UI typecheck and token gates
Built-ins, plugins, approvals, imports/exports, CLI	Creation-path worker	Integrated lifecycle: 105 portability, eight approval and three asset cases pass; 73 DB cases skipped on macOS; final Linux checks required
Execution/dev gate, E2E gaps, packaging, live journeys	Lead	Selected Linux onboarding case passes all 13 assertions, actual task/artifact/follow-up and cleanup; 149 public-projection/support cases pass
Full CI and final review	Lead	Integrated head: 49 checks pass, three fail, four skip; native auth action finding and existing chat readiness fixture fixed locally; fresh combined-head checks/review required
Local subscription task + follow-up	Lead	Embedded-browser Codex sign-in and first-agent creation completed; saved codex_local is expected on macOS; useful task/follow-up still pending
Managed staging API/subscription onboarding	Lead	Fleet Admin sign-in completed; dedicated tenant exists, active/awake and pinned to old release; scoped one-hour QA owner access approved; final serving revision/snapshot/runtime/cleanup qualification pending
Shipped npm/Docker/cloud artifacts	Lead	Integrated-head clean Linux npm consumer passes: 18 packages, no Codex payloads, host dependency from official npm; immutable staging preparation reports missing matching DB package; actual cloud composition is post-merge

Keep CPU-heavy Rust/Docker builds in hosted CI. Use Node 24, bounded workers, conservative provider turns/timeouts and existing QA accounts. Login interactions use the embedded browser. Do not change user preview services or production.

The original $250 ceiling remains. Historical receipts include unknown-charge reserves; the latest retained ledger holds $248.18 in costs/reservations and reports $1.82 unallocated, not a certified invoice balance. Reconcile unstarted reservations and current resource/credential state before paid runs. Do not reset the ceiling or treat missing charges as zero. The single new Linux campaign has four ready rate-card estimates totaling $1.265460800; its entire $12 hold remains reserved. Keep exact source/artifact/runtime identities and failed attempts in the existing report pipeline; mocks and passing CI do not close live acceptance.

Integration found and fixed an import preservation gap: same-harness model edits must retain the package's explicit runner or the existing agent's runner. Native setup reuses production remote artifact preparation and verifies the actual app-server/model path; a version number alone does not reject installed Codex. Known unsupported local/SSH platforms retain legacy defaults. Sandbox support does not infer an image architecture; setup verifies its actual artifacts.

Public package audit found flat Linux x64 daemons in current stable and canary server tarballs. Normal release builds stage only the build host's daemon; the multi-platform assembly helper has no release caller or macOS artifact producer. Automatic macOS/Windows/Linux ARM defaults therefore remain legacy in this slice. Existing explicit native agents remain usable with their installed runtime. macOS runner artifact assembly is a separate prerequisite for its default. Codex setup required three small Rust seams: read-only probes, observed model reporting, and reasoning effort. Old cached daemon bytes do not verify these.

Local startup hit the macOS shared-memory ID limit. One detached 56-byte segment was released only after zero attachments and exited owners were verified. No running server or database file was changed. The separate QA server is healthy.

Next action: verify the final candidate through existing Linux CI/install checks, fresh review, and bounded actual journeys. Preserve failed attempts and costs. Unrelated findings and remaining harness qualification belong to later slices.

Post-rebase UI checks pass (126 cases, typecheck, token gates). Product E2E catalog/onboarding support passes (122 cases), plus 47 confirmation fixture checks and E2E noemit. Existing Pi companion/executor controls pass (26 and 34 cases); core selection/setup passes 87 cases and transport passes six. Production Storybook build and 26 desktop/six mobile captures were completed before the Pi rebase; they are component evidence, not live execution proof. Both final integration gaps are implemented: discovery resolves the selected environment through the same helper as saving, and explicit native export/import profiles remain valid on macOS while new automatic defaults stay legacy. Scoped discovery/authorization passes 63 checks. UI context and recovery checks pass 280 cases plus three final regressions. Missing discovery metadata shows loading or the server error with Retry; explicit Legacy remains available. Final portability checks pass 105 cases; approval, built-in asset and CLI unit controls pass eight, three and three. The 72 skipped DB cases still need Linux. Candidate b7194275e completed 38 CI checks but failed 14, including aggregate checks. Its fresh review reported three P1 findings. The fixes preserve explicit legacy sandbox policy, return refreshed unmanaged subscription credentials to their authorized source account, and restore gated experimental native choices for other providers under Advanced. Actor restrictions now run before harness translation and again on the resolved configuration. Existing route fixtures use the real resolver; legacy execution controls request Legacy explicitly. Capability drift was fixed by preserving existing documentation heading anchors, without changing generated contracts. The retired Codex flag control now uses an experimental OpenCode profile; all 45 corpus regressions pass locally. Core regression checks pass 394 cases, with 147 final guard/inheritance controls; server noemit passes. UI checks pass 212 cases, typecheck and token gates. The original touch/wheel journeys pass two cases against the isolated preview. Final desktop/mobile/keyboard captures and the Advanced experimental story are being checked against the frozen UI tree. Earlier 26 desktop/six mobile/three keyboard checks passed on the previous UI revision. The built-in regression checks nondefault settings through runner-only switches in both directions.

Exactly $22 of documented unstarted staging reservations were reassigned to Codex-only proof: $12 Linux onboarding (one existing campaign, at most two attempts), $5.50 managed onboarding, $2.50 attended local proof, and $2 incremental compute/cleanup. The attempted $5 staging setup envelope remains an unknown-cost hold. Aggregate costs/reservations stay $248.179254104 under the original $250 allocation; no historical unknown or cleanup hold was released. This is not an invoice-certified balance. No new paid provider task has run in this slice.

Attended local Codex login is unfinished in the embedded browser; its old device code expired. Staging Fleet Admin requires fresh attended sign-in. The dedicated QA stack stack-pool-d06dca5eafe7 and its old immutable environment are identified historically; current access, serving revision, retained snapshot and physical cleanup must be verified before reuse. Old archived probe resources and missing compute billing remain unresolved. Do not substitute old artifacts or passing CI for these live gates. The next candidate must pass fresh CI and review before merge sign-off; actual private cloud composition remains post-merge work.

2026-10-09 Codex-only candidate qualification update

Frozen execution candidate 38199ea8e6a276eecd35084ad84d691322aba9f4 is rebased onto master 835a022936ddc7a152b9feab0c0420d02249a6d1. Its CI completed 48 passing, four failing and four skipped checks. The two substantive failures are test fixtures: legacy skill expectations on Linux and a credential probe that depended on a developer daemon. Their narrow corrections pass locally: 77 native/legacy/onboarding skill route cases and the selected-login refresh regression. The earlier Node 26 skill run ended without a result; it is not proof. Build, workspace typecheck, all browser E2E shards, policy checks, native compilation, and the clean public npm consumer pass. The consumer checks all 18 packed packages contain no Codex payload and acquires host Codex from official npm. The merge and generated-lock CI stamps are recorded separately from source.

The existing Linux Product E2E campaign 37950165589 passed its only selected case on attempt one, without a retry. The ordinary onboarding picker saved paperclip_runner / codex. All 13 assertions passed, including an independently checked nonce-bearing document and follow-up with recorded native execution and the same workspace. Four runs succeeded with observed model gpt-5.6-sol; cleanup passed. Target source is exactly 38199ea8. The workflow deliberately applies its verified resolved lock; the source receipt is dirty and must not be described as a pristine checkout. The report selected one of 52 catalog cases; it is not the entire catalog qualification.

The final run ledger contains four ready rate-card estimates totaling $1.265460800 (openai-standard-2026-09-30). Production pricing and accounting settled. The existing E2E numeric-only cost summary omits decimal-string costUsdExact and incorrectly reports unpriced/zero; this is a reporting follow-up, not a production pricing failure. The full $12 campaign hold remains reserved for setup and invoice uncertainty. Estimates are not provider invoices. No further paid campaign was dispatched. The existing public report includes private session identifiers in its result summary. It is withheld from broad linking while an allowlisted public projection is added at the existing result seam. Private artifacts and behavioral grading remain intact. This is an evidence-publication correction, not new eval machinery.

Fresh review scored 3/5, verified the previous three fixes, and found three UI edge cases: preserve original native setup-link intent on unqualified hosts; retain built-in settings on runner-only changes; and record an explicit choice when clicking the displayed automatic default. These fixes pass 171 focused UI checks, typecheck and token gates. A fresh static build passes; affected visual proof is in progress. Existing UI verification passed 28 desktop/eight mobile renders, six keyboard/footer cases and two touch/wheel journeys. Final CI/review must run after this combined follow-up is frozen.

The isolated preview uses 3125. Its supervisor uses the correct port and the prior backend restarted at 2026-10-09T15:28:08.305Z. No user preview or the separate OAuth proxy was stopped. The owned supervisor/backend were gracefully paused during lifecycle integration; restart and serving-source verification are required before another live journey. The first-agent name draft survived reload. The cached local daemon is not proof of the new native Rust seams; Linux hosted build/live execution supply that proof. Attended subscription login and current access to the dedicated managed staging stack remain unresolved. Canonical issue coordination is unavailable because the original test-drive service is offline; no unrelated company was used for updates.

Public-evidence projection is complete and passes 149 existing and new support checks. The private behavioral grader and raw evidence remain intact. Replaying the retained result removes all 12 known private identity values and preserves the original revision and all 13 assertion verdicts. Publication needs a new presentation identity and operator access; the existing protected workflow has no report-only replay input. It cannot overwrite the prior immutable report. The prior exposed report also needs operator removal/cache remediation. No provider rerun is justified to publish repaired evidence.

At 1be8502f, fresh review confirms all six previous fixes and reports one more built-in setup issue. A built-in that still needs setup must submit its displayed configuration to complete setup even when the model is unchanged. Already configured agents must still preserve the full saved configuration during a runner-only edit. Both native and legacy regressions reproduced before the fix. All 15 focused cases pass after the fix, including definition-model fallback and ready/paused settings preservation. UI typecheck and token gates pass. Rendering is unchanged, so existing revision-bound visual evidence remains applicable. Native compilation passes; the main CI cleared its allocation delay and is running, with no test failure observed yet.

Next action: freeze the built-in setup follow-up, require green exact-head CI and fresh 5/5 review, and publish sanitized retained evidence when operator access is available. Complete the attended and managed staging journeys when their remaining resources are ready. The PR stays a draft and is neither merge-ready nor production-ready yet. Merge and production deployment remain outside authorization.

2026-10-09 Current-master lifecycle integration

Master merged #15631 during qualification. GitHub blocked the new candidate on nine real merge conflicts. The integration preserves master's agent lifecycle ownership. Common runner resolution now runs in prepareAgentHire; approval activation retains the frozen reviewed runner, responsible-user identity and credential restrictions. Existing agent updates keep their saved execution. Obsolete source edits were removed, and redundant generic API prose was dropped while the agent-creation skill and its reference retain the complete runner contract. The diff remains 99 files.

Focused integration checks pass: 210 core, 109 connection, five affected refresh, 105 portability, eight approval and three built-in asset cases. Counts overlap. Server noemit and the existing lifecycle-boundary scanner pass. Shared, DB and plugin SDK JavaScript outputs were refreshed without migrations, Rust or Docker. The 73 DB-heavy cases were skipped on macOS and require hosted Linux proof. The full local route-fixture attempt was interrupted and is incomplete evidence; loopback restrictions were identified before its bounded affected-case rerun. That unrestricted rerun passes all 61 selected cases; 108 unrelated cases were excluded and remain part of required full hosted CI.

The human completed Fleet Admin sign-in. The dedicated QA stack exists and is active, awake, healthy and user-managed, so ordinary fleet rollouts skip it. It still serves historical Core 2dbe43a4, not this candidate. The human approved one hour of scoped owner access for this QA tenant through the audited admin flow. No release change, provider task, new image or fleet-wide action has run here.

Next action: freeze/push the integrated candidate, require exact-head CI and fresh 5/5 review, restart the matched local preview and qualify the dedicated managed target against that candidate. The previous Linux run is retained evidence; it must not be relabeled as the new live measurement.

2026-10-09 Integrated-head qualification and final corrections

At ad5d8826, all checks completed: 49 pass, three fail and four skip. Required verification, workspace typecheck, build, Linux server/DB suites, native compilation and the real clean 18-package consumer pass. The consumer contains no Codex payloads and selects its owned official-npm Codex dependency despite a different outer version. CI merge and generated-lock identities remain separate from the PR source. Applicable code-owner approval is still unproven.

The only browser failure is the existing selected-run denial case, whose fixture uses the process adapter. Its URL becomes canonical before its agent query settles. The test now waits for the successful company-scoped canonical response and verifies its complete agent identity before clicking. All nine existing retry cases pass against the real isolated preview with their exact request and denial assertions unchanged. A supporting query lifecycle control reproduces lost mutation feedback during a remount; the CI cause remains an inference, because the controlled early-click browser reproduction did not activate.

Fresh review scored 4/5 and found one native Codex onboarding defect: an authentication error lacked the shared check that displays the sign-in action. The missing check reproduced before the fix. The correction retains the native diagnostic, failed result and explicit runner choice. All 174 readiness, registry and production-form render cases pass, including selected-environment login and negative model/dependency controls; server/UI typechecks pass. The agent creation skill retains the full API contract and CLI equivalents in one place, avoiding a redundant reference edit and keeping the PR at 99 files.

The attended embedded-browser Codex sign-in succeeded, and first-agent onboarding created the isolated Mac agent as codex_local, as expected on this platform. The ordinary first-task interaction is open; task, artifact and follow-up are not yet proven. No task provider call was made during these corrections.

The dedicated staging tenant's old release remains unchanged. Read-only immutable preparation 37959487896 matched the intended QA target and reported a matching DB package/migrations artifact gap. Rollout and serving verification were skipped. Build the frozen candidate's isolated preview image and packages through the existing trusted remote workflow; never substitute an older image or claim private Cloud composition from the Core-only preview. Keep the pin and provisioning default.

Next action: push these narrow corrections, run fresh full CI and review, build matching immutable preview artifacts in hosted CI, then qualify the one QA tenant after those gates pass. Retain all historical cost and cleanup holds. The draft remains neither merge-ready nor production-ready.

At correction f6a15200c, fresh review passes 5/5 with all eight threads resolved, and the previously failing retry E2E shard passes. One unchanged auth-signal fixture exceeded its 15-second test deadline during a cold route import; its previous exact version passed on the integrated head. Imports now run in the existing setup hook after the same resets, keeping the 15-second assertion deadline and all actor/response checks. All 127 affected auth/form/model cases pass. A temporary 100ms assertion deadline also passes while setup takes about six seconds, confirming the separation. Keyboard coverage moved intact into the existing form suite; the PR stays 99 files. This correction changes only tests and this record, with the production runtime byte-identical to f6a15200c. Three hosted server shards were interrupted after passing progress and remain incomplete evidence. The new test-only head requires fresh completed CI.

The frozen f6a15200c preview image is building remotely; exact-source shared/DB preview packages are published and their source metadata verified. The isolated local preview restarted at 2026-10-09T16:46:58.859Z, serving that version with startup recovery ready and no pending migrations. Its existing worktree execution preference was off; activating it allowed the queued user onboarding response to run. The actual legacy Codex task completed and its independently read file contained the exact two requested lines. The same-task follow-up is running. No second task, agent hire, or automatic runner conversion was used.

Next action: commit and push the narrowed candidate, rerun its checks and fresh review, then update the PR and existing evidence report. Start the Codex-default slice after the user chooses to proceed. Merging and deployment remain outside this task.

Occupied credential fixture follow-up — 2026-10-12

Current-head 021df207 Runner Vitest 2 failed during fixture preparation with EADDRINUSE, before credential staging. Reused the shared correction from 50e7554069a31af72069e7632e9ae6151019f449: prepare a fresh home with two deliberately occupied candidates, preserve the foreign listener, and retain the actual staging denial and unchanged auth-file assertion. The three-line code annotation was removed to follow CONTRIBUTING; its explanation lives here.

Only fixture preparation retries, up to eight fresh homes. It releases only its owned partial or unselected listeners, then runs credential staging once. A bind race during that production call remains a visible failure and receives no retry. No production credential or permission behavior changed.

A controlled occupied-port baseline reproduces the old setup failure. All 42 existing credential controls pass on Node 24 with isolated synthetic data and zero provider calls or native builds. Comment-only removal preserves the tested executable structure; the suite was not repeated. Evidence is recorded in /private/tmp/ci-final-021df2-shared-credential-quorum-receipt.json and its comment-closure receipt. Fresh published-head CI and review remain required.

2026-10-13 Published canary and fresh staging qualification

The human merged prerequisite #16028 at actual Core master d67e3507b23041212fa26302ce6de078c5ebcc05 and asked to cancel the existing timer, then test the published npm canary locally and on a new staging stack. The finish-runner-default-stack-and-merge heartbeat was deleted. Codex defaults #15683 remains separate and unmerged. No production or provisioning-default promotion is authorized.

The human approved a separate $25 ceiling: $15 for one owned QA stack/sandbox including pool backfill, $5 for setup and at most four short task/follow-up turns, and $5 for cleanup. Zero automatic retries. The original $248.179254104 held/consumed and all original unknown and cleanup holds remain unchanged. Actual new resource cost is unknown and held within the new reservation.

Ordinary authenticated staging signup created stack-pool-7998e841ace7 at https://runner-canary-d67-qa-oct-13.staging.paperclip.app. It reached fresh first-agent onboarding with zero agents or provider turns. Its user-managed pin is verified. Initial distribution cloud-38355190192-1 is old source and has observed schema drift; it is baseline only. Exact d67 signed standard image, source gate and signed migrator have passed. Matching private composition is building through the existing canonical workflow, without a duplicate dispatch.

The public d67 release38389963483 ended successfully but skipped native production, publication and canary onboarding. Registry canary.5 provenance binds it to old4a641d, so local acceptance remains blocked. The focused repair PR #16149, exact ab99d3f7604cb2ac8d8a45c81276797af834e325, adds explicit cancellation/source-result guards to the existing producer and canary smoke. Its existing contract cases reproduce two missing guards before treatment. All70 release controls and20 source-verification neighbors pass after treatment; independent source review is clear. All required hosted gates passed with fresh5/5 and actual code-owner approval. PR #16149 merged at 60bc0d5fee9a6e48db08fc016521fee3d9f57d67; its new master-push release38395574681 is running. Concurrent master changes include Storybook indexing and verification-skill docs; npm and staging source identities remain separate. Source predicate tests support the diagnosis but do not establish actual GitHub scheduling or publication.

The native-runner QA override is applied and converged through one-target feature campaign1791869766576, with zero failed targets. Literal d67 private distribution cloud:38392212140:1 is qualified. Supported one-target deployment request f7cb6751-91f8-49a4-9ab8-6092ecb27e7c passed exact-source/private-artifact preflight38395788220; deployment38395855695 succeeded with authenticated serving verification and set_default=false. The pin and current private distribution remain verified.

Attended OpenAI device authorization completed in the embedded browser. Ordinary fresh onboarding created Legacy preservation QA (f9e30b8e-7ceb-4f88-b373-1a2cba65859d) with its Codex Legacy configuration and unopened first-task question. Its sandbox and connection settings were retained. Native Codex package QA (861f95bc-c9fc-4e32-8abb-8829d3fe42de) was created separately through the explicit experimental runner picker, using Codex, gpt-5.6-luna, the responsible user's saved subscription and Paperclip Computer. This tests the merged prerequisite; automatic Codex defaults remain outside this source.

The native creation Test reported success, but its visible details and exact d67 route show a Legacy Codex ACP/CLI model hello, not native runtime execution. At least one real setup hello is held in the setup reservation separately from the four task-turn allowance; other unmeasured setup usage is not assumed zero. Setup lease 1f2b04ce-97c2-4f81-8f92-0ece0fb54feb and provider resource 622b8bb6-8bec-40d2-83c2-fa5edddfa6e8 have no independent cleanup confirmation yet. Green setup is not native execution or physical cleanup proof.

Native QA policy survives reload with timeout180 seconds, concurrency1, interval disabled and max-turn continuation disabled. Separate transient/connection retry policy still needs an existing supported control before launching the task. The nonce-bearing first file challenge is drafted, not submitted; task turns remain zero. Existing file-artifact and session-continuity assertions are being reused, with manual adaptations identified rather than relabeled as an unchanged E2E suite pass.

The retry audit found no supported retry-only UI control and no certified provider-start bound: existing native recovery can launch additional continuation prompts. The human explicitly approved normal recovery within the same $25 ceiling, with at most four manual task/follow-up messages, 180-second run timeouts and no automatic test reruns. Production recovery policy is unchanged. One manual staging task was submitted (9f706825-36db-4950-9179-659406db37fb); its native execution, file bytes and continuity remain pending. Manual message counts and observed underlying provider/recovery events will be reported separately.

Release38395574681 has now actually completed all four native producers, including Darwin x64 and Linux ARM64, and its canary publisher is active. This supplies hosted scheduling evidence for the release repair. Actual source-bound registry publication and published onboarding smoke remain pending; canary.5 is still excluded as old-source evidence.

Next action: verify the actual staging serving revision, wait for the source-bound published registry package, install the real package in an isolated Apple Silicon consumer, and run real file task/follow-up journeys within the new budget. Preserve the old3125 test-drive and all receipts. Current evidence: /private/tmp/runner-d67-published-canary-qa/evidence/ and /private/tmp/ci-artifacts-d67e350-artifact-readiness-receipt.json. Neither requested live runtime test has passed yet.

2026-10-13 Final published-consumer and fresh-stack result

Actual master release38395574681 completed all four native producers, npm publication and real canary onboarding smoke. Public paperclipai@2026.1013.0-canary.6 binds to exact60bc, including narrow merged release repair #16149. Its clean isolated Apple Silicon install passed normal lifecycle, all18 no-bundled-Codex tar checks, packaged daemon/provider verification, native startup/open/close and CLI/doctor checks. Official optional npm Codex dependencies are retained; no local Cargo/Rust/Docker/runner-source build occurred. Literal d67 private staging composition and literal60bc npm remain separately attributed.

Ordinary local onboarding completed with the explicitly authorized OpenAI API key saved in a managed connection, and created Legacy preservation QA. The local subscription device flow expired; no subscription was saved. No credential values were written into prompts/reports. Native saved-account setup exposed a real published UI defect: the selected native runtime delegates to Legacy readiness and can trigger a second forced CLI probe, failing Command not found in PATH: "codex" despite successful packaged native resolution. Current private #15683 already contains the native setup probe correction, but its artifact/UI has not been tested here. Configure navigation cannot adopt the failed connection; no developer PATH or global Codex workaround was used.

The supported published API created a separate explicit-native local QA agent with the saved responsible-user OpenAI API-key binding. Real UI task NPM-2 completed native runs88eeb636 and4990be3e in43/46seconds. Independent26/52-byte downloads, exact random challenges, negative newline controls, durable attachments and run-attributed work products pass. Same saved account/grant and execution workspace are recorded. A self-added200-cent monthly cap correctly paused after unpriced metered gpt-5.6-luna usage; spent0 is not proof of free use. Removing only that supplemental cap to ordinary budget0 and explicit resume caused a recorded adapter config-revision freshness reset. The second provider session is fresh, so strict same-provider-session continuity fails and is not waived. No pricing or production budget policy was changed.

Fresh staging RUN-2 completed native runs7d242e7b and a8e62d9c in93/73seconds at d67/cloud:38392212140:1. Independent26/52-byte downloads pass; recorded UI/PRP events show session.started then session.resumed with the same provider session and workspace. Source-bound UI proof is distinct from a direct stored-row/full-grader export, which was unavailable. Its setup green was a Legacy hello and remains excluded as native readiness proof.

Existing local Legacy full execution settings survived native enablement, an unrelated title edit and reload byte-for-byte; that control made zero provider calls. Both native QA agents are paused after four total authorized manual task/follow-up messages, zero test reruns, with normal product recovery unchanged. Local live runs are0. The installed preview remains 3136. Historical3125 is stopped, with its original data intact; no current safe staged source-build preflight was available and it was not restarted. Staging remains pinned/user-managed and available for inspection, with no production/default promotion.

The existing exact-source file/artifact graders were reused. Strict registration helper title checks fail because the manual prompts requested readable titles rather than filename-as-title; correct attachment/run attribution passes separately. No metadata was rewritten to manufacture a pass, and no full catalog-cell pass is claimed. Physical cleanup of setup lease1f2b04ce/provider resource622b8bb6 and provider invoices remain independently unconfirmed. The separate25-dollar reservation and original248.179254104 held/consumed ledger preserve all unknown and cleanup holds. Metered model pricing remains unknown/unpriced. Required next gates are corrected native setup artifact qualification, priced-model budget acceptance and authorized physical cleanup confirmation; this does not make the default rollout production-ready.

Detailed receipts and sanitized report: /private/tmp/runner-d67-published-canary-qa/evidence/. Public package admission/source receiptc9eeaf…; native consumer receipt45b613…; paid-pair offline integrityb6bb4e…; exact account attribution is a separate six-field projection. These are literal qualification sources, not the unmerged root HEAD1a0ca662. Record-only changes are retained locally for the next actual reconciliation commit; no doc-only CI churn or dependent branch mutation was introduced.

The sanitized report is uploaded and independently download-verified as attachment-backed artifact work product122676da on the unassigned completed operator NPM-3. It does not wake an agent or close the feature gates. Native task artifacts are unchanged. The authorized Claude owner received the prerequisite source/qualification boundaries; no ownership or allowance was reassigned.

2026-10-13 Authorized Codex defaults finish and merge

The human requested that #15683 be finished and merged normally. A separate incremental $100 ceiling and as many bounded messages as needed are explicitly approved. The previous four-message/$25 campaign and original$250 ledger retain all unknown-charge and cleanup holds; they are not refunded or reassigned. Reuse local3136 and owned staging stack7998; preserve their data and receipts. Root owns actual-master reconciliation, exact-head checks/review, ordinary Mac/managed onboarding, checked task/follow-up and normal protected merge. Claude owner retains dependent branches and separate allowance. No production deployment or provisioning-default promotion is authorized. No timer is recreated.

Current-master integration includes 833769ab557255b11dd8f650f43ed7333653f5e4, then e3029c632b26b68595adc1a704a387833b3cefcb. The ordinary merge retains the published Codex history and prerequisite squash history. Its audited logical source delta preserves master fixes, the prepared managed Connect qualification, fresh scoped discovery, and existing first-task eval assertions. The remaining merge conflicts concern Storybook indexes and dated reviews, not execution code. Independent review of both source compositions found no concrete P1/P2 regression; source review does not establish live acceptance.

On the integrated checkout, two focused Codex runs pass 261 tests each across onboarding, runner selection, setup, editing, imports and readiness. Server and UI direct TypeScript checks pass after JavaScript-only shared/DB/adapter-utils/SDK preparation. All token gates pass. New master recovery controls initially report a missing declared trace test dependency and a sandbox-denied PostgreSQL listener; the four unaffected suites pass 74 cases. Isolated installation of the exact declared trace dependencies and an authorized temporary listener allow the two affected suites to pass all 60 cases. No tests are disabled, no lockfile or production policy is changed, and no local native/Docker build occurs. Full canonical workspace checks remain assigned to fresh hosted CI.

Fresh-source remote package qualification, ordinary Apple Silicon onboarding and immutable managed staging onboarding remain pending. The previous canary60bc and stagingd67 receipts stay attributed to those sources. The new budget record reserves resources60/provider30/cleanup10 dollars and retains all prior unknown holds. The supported private Cloud skill and CLI are read from exact private master 4f3a63ad6f3f84c87e0e129da35909d8ccc7ffb0; a deliberate pre-merge Core preview is separate from actual private Cloud distribution. Freeze the final reviewed product source before building; deploy only the owned pinned QA stack, with set_default=false.

Published intermediate448db859 passes the focused source controls and starts fresh hosted checks. A bounded managed-image review then identifies a concrete setup mismatch: real sandbox tasks select provider outer isolation, while probeNativeRunnerEnvironment overrides the verified transport choice with false. Correct this internal forwarding and derive its value from the server-resolved target; preserve local/SSH Codex isolation and removal of injected environment flags. The obsolete remote package qualification38423256993 is cancelled to limit costs and is excluded from final proof. Native/Docker work remains remote. Current source and new-head qualification must close the corrected boundary before acceptance or merge.

The maintained Daytona execution image is distinct from a standard Core app image. A saved immutable OCI digest without snapshot/template fields uses normal environment probing, measured OS/architecture/libc, actual image binding and confirmed lease cleanup. The existing full-stack E2E workflow owns its content-addressed execution image and one explicit managed-onboarding cell; its image build and live cell are not yet dispatched. A Core app image cannot be assumed to have compatible Daytona boot behavior merely because it contains the daemon. No provider credential is read to work around this boundary.

The isolation correction changes three production lines, with no API/configuration field or permission change. Inert launch baseline1/8 fails; matching treatment8/8 and23 inert/source neighbors pass. Selected-target server baseline12/12 fails; the full treatment suite51/51 passes, including contradictory configuration/environment flags. Direct server no-emit and independent source review pass. Read-only and approval policy, owner-bound credentials, deadlines and cleanup remain intact. A separately retained overbroad local-listener scaffold failure is not counted as native execution proof.

Intermediate448 hosted CI completes successfully. Fresh review4/5 correctly identifies the new managed case entering a local-only confirmation fixture. Baseline reproduces two failures; scope the existing local fixture correctly, retain all twelve local cases and the thirteenth explicit managed case, and reuse the separate managed-fixture checks. The full existing E2E support run passes2694 controls and exposes two more stale roster assumptions. Update those assertions while retaining the completion judge for accepted managed work and every Pi admission/negative control. No parallel suite or replacement grader is added. Final source still needs fresh published checks/review and live qualification.

Embedded-browser inspection of the built448 stories confirms the dark shared Runner popup and saved Legacy choice. It also exposes remaining OS-native environment/lifecycle/ACP dropdowns on the relevant runtime page. Their narrow shared-picker conversion preserves all values and callbacks and leaves unrelated provider-specific controls alone. These UI changes require a new JavaScript-only Storybook build and rendering checks; the old build remains literal448 evidence. No screenshot baseline is created or changed.

The corrected source passes the full existing E2E support suite:125 files/2697 tests, plus all128 existing Node source/qualification contract controls and direct E2E no-emit. Relevant dropdown baseline145/145 and treatment152/152 pass, including exact save requests for selecting/clearing an environment while retaining Legacy/native execution and accounts. UI no-emit and token gates pass. Independent review of the managed-isolation and confirmation-fixture corrections is clear. These are local source checks; exact-head hosted CI/review, fresh remote packages, rendered stories and real Mac/managed onboarding still remain required. Next action is a single corrected candidate publication, then affected qualification using the existing workflows.

Current published Codex head1a0ca662 is draft with green historical checks. Actual master833769ab is newer than merged prerequisite d67 and release repair60bc. Prepared private onboarding/Storybook work will be reconciled by source, without claiming its private/historical checks as final qualification. Native Connect correction is already in the Codex slice. Final managed defaults require the saved immutable OCI environment probe owned by ordinary Connect. Existing suites/fixtures/assertions/reporting are reused; no duplicate grader or silent Legacy fallback is added. All heavy builds stay remote, Codex payloads remain external official npm dependencies, and saved agents retain runners.

Next action: preserve/commit current evidence, integrate actual master plus reviewed prepared corrections, run targeted checks, freeze/push candidate, require fresh fullCI/review, then qualify ordinary creation/onboarding on Mac and the one staging target before protected squash merge.

The frozen30bc candidate passes all current-head required CI and fresh5/5 review. Its existing remote release-smoke qualification passes all four producers and clean platform consumers. The actual managed onboarding cell38428601763 fails before agent creation: scoped discovery selects native, but Codex0.160 attempts a nested filesystem sandbox while scanning AGENTS.md for the read-only setup session. Both measured setup leases release successfully; the separate fixture environment deletion fails because the fixture leaves it selected as instance default. Preserve this failed attempt, unavailable provider billing and cleanup holds. No task artifact or follow-up is reached.

The correction skips project instruction discovery only in the new empty setup workspace through the supported trusted Codex configuration. It retains the generated security arguments, read-only permission profile, approval-never, no dynamic tools, existing bounded hello turn and teardown deadlines. Ordinary task instruction discovery and saved agent configurations remain unchanged. Pinned official Codex0.160 source confirms the zero instruction limit precedes filesystem probes. Eight inert baseline failures become23 passing source/cleanup neighbors; direct runner/server TypeScript and maps pass. This does not establish hosted treatment.

The existing managed first-task fixture now snapshots and restores its prior instance default and managed-only setting before deletion, including lost setup responses. Unconfirmed default restoration blocks deletion and remains red; other restoration/deletion errors remain inspectable and retry only outstanding cleanup. Three reproduced baseline failures become129 passing first-task controls, with direct E2E TypeScript passing. Independent source review finds no actionable runtime/permission P1/P2; the required source-comment cleanup is applied. Final source needs fresh CI/review, package artifacts and successful ordinary Mac/managed journeys before normal merge. The one owned Core preview deployment for30bc completes through its existing exact-source check/deploy path; actual readiness is independently checked next. No fleet default is changed.

Corrected product source ca31623d36 passes all48 ordinary hosted CI jobs, required verify/E2E and fresh5/5 review with26 resolved threads. Its hosted package artifact11834160973 has verified ZIP digest d5d60bf5056f5573461f8d4bd873da78a0204c7f7295d03d5aa7234e55d4af69. The second isolated Mac consumer verifies all18 tarballs, no bundled Codex, official npm Codex0.160, all four daemon bindings and zero-turn native startup/cleanup. Normal install hooks include third-party optional C++ addons; no Paperclip runner/Cargo/Rust/Docker source build occurs locally. The source-bound preview completes one-target deployment38438245490 to the existing pinned QA stack, without default promotion; independent result admission remains separate.

Before paid cell38435063658 entered its matrix job, an admission audit found that ordinary onboarding timeout0 and agent concurrency20 did not satisfy this campaign's retained180-second/single-run bounds. Cancelled the campaign before its live cell started; image/build costs remain unknown and held. Extend the existing first-task fixture with a normal operator configuration PATCH and independent read-back before Get started. Only the timeout/concurrency bounds may change; runner/account/model/environment/permissions remain the wizard's original selection. This is a fixture correction, not a production default or API change. Its first iteration passes149 controls but independent review identifies the concurrency gap. The final combined bound reproduces three functional failures with the previous helper, then passes153 controls and direct E2E TypeScript. Independent review confirms that the timeout reaches the native turn deadline and the queue uses the saved single-run cap; exact source review closes before publication or further live eval admission. No failing or cancelled attempt is relabeled as passed.

The owned local3136 server is updated from30bc to literal ca316 hosted packages after an idle snapshot and stopped-data/home backup. All existing full execution configurations and recorded run projections match before/after, with no provider tasks during upgrade. The fresh Mac company's saved draft resumes with its agent name retained. Ordinary OpenAI API-key Connect creates native Codex with gpt-5.6-sol without a runner override; only the existing QA timeout/concurrency settings are then bounded before Get started. Actual useful task/artifact/follow-up proof is still pending. The staging immutable QA environment is selected temporarily as the instance default, with the prior Paperclip Computer value recorded for restoration. Its normal server credential fallback has not yet been verified. No direct provider-key extraction or production rollout is attempted.

The literal ca316 Mac journey now passes independent exact-file and registration checks for29/63 bytes, saved API-key account binding, native Codex provider session and workspace continuity across all five executed runs. One queued child run is cancelled before start and retained in evidence. Two manual messages and two confirmation responses produce five successful native runs; no process-loss retry occurs. Both task and child finish Done, and the QA agent is paused afterward. Rate-card estimates total$3.504199600, not invoice cost. The existing strict artifact/session helpers are reused offline; this is a real UI journey with independent evidence, not a full catalog-cell pass. Receipt7ef97c4705b085d465eeaf19f11d231e7b01e5a66c61b517cfcde0ec70a2db97 remains literalca316.

Candidate0065 has fresh5/5 review and26 resolved threads but its required E2E gate fails: the unchanged signoff fixture receives a cancelled run while waiting for executor success on GitHub's combined master checkout. The fixture discarded errorCode, so the precise cause is inconclusive. Preserve the failed gate; add only a bounded diagnostic to the existing assertion without weakening ownership, authorization or terminal-state checks. Managed38440601585 fails during image preparation after the hosted runner reports shutdown; its provider pack/live cell are skipped. No named live cell or provider task is admitted. Unknown preparation costs remain held; no automatic retry is dispatched.

Actual master252d9b5077f4eee98ec48225641ef1a02d824158 is integrated through an ordinary merge. Its only conflicts are the three Storybook catalog files. Semantic union preserves226 authored entries,2242 stories, stable IDs, both review histories and actual evidence limits; the existing generator,27 catalog/map controls and structural map checks pass. Runner/Rust/Codex selection/setup/onboarding/guard sources remain byte-identical. Master adds instance-secret storage and migration0339, including its account-home claim check; keep those changes and require fresh combined-source account/lifecycle controls, JS/DB installation, CI/review and current-source managed acceptance. Prior receipts retain their original revision.

On the owned staging stack, ordinary environment Test connects to the immutable image but cannot confirm probe-lease cleanup. New-agent discovery remains Legacy; the supported onboarding entry surfaces the exact pending-cleanup error before hiring. This is a blocked managed acceptance, not a native pass or a silent runner conversion. The QA environment had autoDeleteInterval0; source ordering makes immediate deletion after stop before archival a plausible cause, not a proven provider diagnosis. Attempting to change its QA interval to60 is correctly rejected while cleanup is pending, so persisted configuration remains0. Preserve the failed lease, its holds and the guard; do not clear durable state or extract provider credentials to manufacture qualification. Next action is confirmed owned-resource cleanup, then qualification of corrected QA configuration and normal native setup/task/follow-up.

Combined-source integration passes100 existing controls with the repository launcher's canonical isolated HOME/config/TMPDIR contract:41 device-login,12 real-PostgreSQL instance-secret and47 lifecycle tests, zero skips. Initial direct-invocation99/100 and alone identity-verdict failures remain recorded; no expectations or product code were changed. No on-disk worktree config write is observed, and3136 uses a separate preserved home/data. Direct server/E2E TypeScript pass. The existing signoff failure assertion now retains only a bounded verified errorCode; ownership, issue checks, deadlines, retry semantics and terminal failures stay intact. Actual-helper baseline12-pass/4-missing-diagnostic failures become16 passing inert controls, with no browser/provider work. This improves subsequent diagnosis and does not claim to repair the earlier cancellation.

The integrated6c candidate now passes all48 ordinary hosted jobs, required verify/E2E and fresh Greptile5/5 with26 resolved threads. The earlier signoff case passes on this combined source; its earlier0065 cancellation remains an inconclusive historical failure, not a proved flake. The remote four-platform/package qualification38445419339 binds literal6c. A single guarded managed onboarding cell38448001365 also resolves literal6c through the trusted master workflow and independently verified target lock; its exact selection and180-second/concurrency1 guard pass admission. No second paid cell or automatic test rerun is dispatched.

Master advances once more to c8efdbfba4 through Storybook-only #16196. Its only conflicts are the same three catalog files. Semantic reconciliation preserves all226 candidate suites and37 new master suites,263 suites/2499 stories, stable IDs and both review histories. Existing27 catalog/generator controls and35-area/175-ID map checks pass. Independent virtual-merge and actual staged checks prove every production/native/package/build component remains byte-identical to6c. Keep the6c package/image/live receipts literal; this catalog-only merge requires fresh head CI/review and applicable Storybook checks, not another expensive native build or paid runtime campaign.

The supported Cloud CLI is re-read from current private master8472ece87f8d9a9e17a6116b9f4631d98ce63486 and is byte-identical to the previously used maintained command. Its one-target preview request d227da49-fd73-44c0-9377-f25711e529bc builds literal6c remotely in38448052890, preserving the existing pinned/user-managed QA stack and leaving fleet/default promotion disabled. Build, deployment and actual serving-source verification remain pending. A separate QA environment with the same immutable execution image and autoDeleteInterval60 is saved through ordinary UI, with instance default unchanged and no probe yet. The prior failed environment, durable teardown record and cost holds remain intact. It cannot borrow the older environment's qualification facts; it needs its own new saved probe and confirmed matching cleanup before automatic native onboarding.

Existing ordinary board lease APIs and CLI diagnostics are identified, but anonymous challenge creation and the installed CLI's existing board context both receive401 at this tenant's public edge. No browser/provider credential is extracted and no new inspection API/workflow is introduced. The plugin settings route correctly honors Cloud's hidden-settings gate. Existing Fleet Admin provider links reach the normal signed-in Railway log UI; two successful aggregate orphan-cleanup sweeps prove the controller operates, but neither receipt binds the exact outstanding probe lease. Preserve that uncertainty and its hold. Current-source installed JS/DB migration/account preservation, independent managed task/follow-up and normal protected merge remain the next gates. No timer or production deployment is started.

2026-10-14 Codex qualification and new Test environment reconciliation

Frozen product9546f41e964953c801ad8c2d8bdecadbd5cd3830 passes current-source required CI and fresh5/5 review with30 resolved threads. Its existing four-platform/package campaign38485482843 succeeds: all18 tarballs/four daemon manifests, normal isolated Apple Silicon install, native credential-free startup/open/close and fresh installed DB initialization through0343 are independently verified. This source-built qualification package is not a registry-published npm canary. No Codex payload is bundled, and no local Cargo/Rust/Docker/native source build occurs.

The original managed onboarding case38485488621 passes its19 assertions and completed judge, without retry. Four actual native turns execute the child-bound240-byte file and real completion callback/reply with parent session/workspace continuity. Its checkout reports dirty state: the verified generated target lock replaces the committed lock, but full final porcelain is unavailable. Literal HEAD, runtime/assets and effective graph are verified separately. The reused signed execution image keeps its historical producer identity. Guarded environment removal and server shutdown pass; physical deletion and invoices are not certified. Earlier failed attempts and unconfirmed cleanup holds remain intact. Public evidence: https://d1p6rlowie26tp.cloudfront.net/runner-e2e/campaigns/gha-38485488621-1/index.html.

Ordinary fresh9546 Mac onboarding persists native Codex without a runner override before any QA bounds. The first useful document task and actual Done-parent completion callback execute successfully. One human follow-up updates the same child document to revision2 and publishes a child-bound1,101-byte file. Independent API and real browser downloads match SHA256b758f6d23b33cfa9cfc597a4c3bc2abbf74dc56b7b5d2b30fc45f65c1a4d1905. All seven actual native runs succeed; parent sessions/workspace continue, child execution has its own task session, observed concurrency1, longest run under47seconds, reload preserved. Two recovered proposal-format errors remain a nonblocking quality follow-up.

Existing installed Mac upgrade preserves all three execution configurations, safe account summaries and eight historical recorded run profiles. The existing Legacy agent's ordinary title edit/reload keeps execution settings, and its shared Advanced dropdown retains Legacy. Two actual Legacy/direct-adapter runs complete the same task and independently checked15-byte then34-byte files. Prior session state is passed and workspace continues; returned provider UUID changes, so stable provider-ID continuity is not claimed. After explicit human authorization, the root-created company QA guard is restored to its original0 and a500-cent hard stop is scoped to the selected Legacy agent. Historical unpriced costs/holds remain unchanged, normal service resolves only the new QA incident, other agents remain paused, and the company is paused again after all runs finish. Rate-card estimates: Mac3.4154336, managed1.170946, Legacy0.114767 dollars; none is an invoice. The separate100-dollar ceiling and all original250/25-dollar unknown/cleanup holds remain enforced.

The human selected the actual new Test environment for pre-merge acceptance. Its deployed policy supports verified branch previews, unlike Staging's current master-ancestry restriction. Normal Test email-code sign-in has sent a code and awaits the human handoff; no OTP redaction workaround, session impersonation or credential extraction is used. No actual owned Test tenant, schema admission, deployment or live task is claimed yet. The maintained one-target CLI and deliberately core-only preview path are prepared, with existing snapshot/migration-role/health/lock protections and set_default=false. Private Cloud composition and production/default promotion remain separate post-merge gates. The human also authorized a code-owner-review exception for PR15683 only, after all current-head CI/review/live gates pass; no global repository rule is changed and no other PR's approval is waived.

Remote preview38498802456 completes at exact9546, through trusted workflow definitionb8ffeb973a2a1d430efabffd755f15b6c7cf112a. The ready result matches its single request; immutable Core image digest4cba5c3546c3af3b948f0ee9c3532ada7c754491ce2d175a00164adc46698976 and exact9546 DB/shared registry archives match producer bytes/integrities. This Core preview has no standard signed-image attestation; npm SLSA structure is source/invocation-bound but cryptographic verification is not claimed. The signed execution image is a distinct artifact. No image layers or large transfer archive are downloaded locally. Terminal admission receipt: /private/tmp/current-9546-preview-preparation/TERMINAL-PREVIEW-PAIR-QUALIFICATION.json, SHA25692faae84c89e9e37e23129b6a5cd18580ed1c09517db91286afdf1445e3b5c6f.

Before merge, actual master advances to875943ac83e730fd4cfbe1e1860b3f4d7bf0ac78 and GitHub reports five content conflicts. Ordinary reconciliation preserves the Codex shared exports, flag-free Codex runtime, unified harness picker/display and incoming Grok Bot exports, three-flag admission, dedicated connection and Execution/Usage summary. The shared display helper additionally preserves Grok Bot branding; it must not label that existing external provider as Paperclip Runner. Seven narrow controls extend the existing display, mounted configuration and runtime-selection suites. An initial new test expected a saved connection section from an unsaved fixture; it is corrected to the existing save-first guidance without changing production behavior. Required maps now align35areas/176 capability IDs and direct token gates pass. Incoming shared Rust/backend/protocol bytes and migration0344 are materially different:9546 artifacts/live proof remain literal, and final integrated native/package/DB qualification must be refreshed remotely. No evidence is relabeled as combined-source proof.

The resolved composition passes226 cases across the five existing runtime/display/mounted/selection/heartbeat suites. Direct server and UI no-emit checks pass after JavaScript-only Runner SDK declaration preparation and isolated installation of the exact declared Speko0.0.13 dependency with lifecycle scripts disabled. Initial missing-dependency/stale-declaration diagnostics remain setup limitations; no production workaround or dependency/lockfile change is made. All three existing token checks and staged diff checks pass. Fresh hosted full checks/review and remote native/package qualification remain required.

Current inspectable QA results remain on local3136/3137 with preserved data. The normal board context publishes the sanitized qualification checklist as an attachment-backed primary work product on NPM-3; Done/unassigned status remains and no agent is woken. Canonical PR: https://github.com/paperclipai/paperclip/pull/15683; branch codex/codex-runner-default. Test login/owned target, refreshed reconciled-head gates/artifacts and real Test onboarding/task/file/manual follow-up remain the next action. No timer, merge, production deployment or provisioning-default promotion is performed in this checkpoint.

2026-10-14 current Test deployment and native cleanup failure

Exact published651a passes fresh current-head CI/review and the remote four-platform/package campaign38502151368. Its normal installed Apple Silicon startup, fresh343-migration initialization through0344 and upgrade preservation pass; earlier9546 live evidence remains literal. The immutable preview38503641696 and matching DB/shared bytes pass independent admission. No Codex payload is bundled and no local Docker/Cargo/Rust build occurs.

The human completes customer and separate Fleet Admin sign-in. One fresh customer-owned Test workspace is cold-provisioned, pinned through normal Admin UI and verified after reload. The maintained one-target core-only prepare/deploy succeeds with exact651a app/schema and authenticated serving-source verification, preserving the pin and fleet default. This unsigned branch preview is not the post-merge private Cloud distribution. Its execution image retains the distinct historical signed producer ea6c.

One ordinary Dashboard first-agent Auto Codex API-key Connect records account connection and environment probing on the saved immutable QA target. Native setup then fails before hire: runtime closing exhausts the existing10-second cleanup deadline and authority release remains unconfirmed. The failed payload is delivered after110573ms; HTTP200 is not readiness. No agent, task, follow-up, Legacy switch or unchanged retry occurs. Hello usage, physical cleanup and invoices remain unverified and held. The failure receipt is SHA2561bfce873af81f2424d9ca66dfd64404a21f19e386c3b51e2e0e08cb3f6e37be3. Actual Test acceptance blocks merge despite the scoped code-owner exception.

Read-only forensics reproduces two relevant bounded-close defects through the existing suites: a remote durable-state read can exceed its remaining suspension deadline, and an authenticated WebSocket awaiting peer close acknowledgement can outlive the setup budget. Late suspension proof is already rejected, and authority is retained; the repairs must preserve those protections and require actual physical socket closure before release. These reproductions establish source defects, not the sole cause of the live failure. The retained controller projection and provider request logs contain only permitted metadata; credentials, prompts and provider keys are not extracted.

Next action: complete narrow deadline/physical-close repairs and independent review, retain baseline failures, freeze a new candidate with fresh applicable gates/artifacts, recover only confirmed owned cleanup, and repeat changed-source Test automatic setup/task/checked file/manual follow-up. Then merge the exact ready head under the human's scoped exception and discover/wait for actual npm publication, signed standard image, migrator and private Cloud composition. Production deployment/default promotion remain outside authorization. The original timer stays cancelled and all prior unknown-charge/cleanup holds remain intact.

The narrow repairs now pass source controls and independent review. Four delayed-state baseline failures become15 passing deadline/containment/authority controls, with direct runner runtime TypeScript passing. Ingress's original no-acknowledgement regression fails before repair; a second review reproduces an earlier-error socket escaping active ownership. Final12 controls pass after retaining every owned socket until its physical close, with direct server TypeScript passing. Missing physical-close evidence remains blocked, and the original10-second setup deadline is unchanged. Maps35areas/176IDs and diff checks pass. These JavaScript repairs change neither permission policy nor native Rust; new-head hosted gates and actual Test treatment remain required.

The actual retained Test controller records turn.accepted/started/completed and completed drain/suspend commands. Their stored timestamps are command issuance times, not completion times, so they cannot identify which close stage exhausted the deadline. The internal setup identity differs from the public environment lease; their correlation remains contextual. No hello content, provider invoice or physical deletion is inferred. The local3136 evidence viewer is restored through normal installed651a startup after a current DB-only read-only idle/paused check. All three agent configurations/accounts and ten recorded run identities match its previous651a snapshot. The refreshed primary NPM-3 report is independently downloaded and hash-verified, preserving Done/unassigned status and historical cleanup state. Local3137 and all prior evidence stay unchanged.