Jannik/PaperClipAI
1
0 Fork 0
mirror of https://github.com/paperclipai/paperclip.git synced 2026-10-24 10:13:11 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
572bef4ba7679451ac1543db25cb8ebd533bf919
PaperClipAI/packages/paperclip-runner/spec/operation-groups/source.json
T
DottaandPaperclip 505e1a5582 feat(cases): add persistent workflows with same-task agent handoffs (#16959) 
## Thinking Path

> - Paperclip manages AI agents and their work.
> - An agent workflow needs persistent facts and a safe way to transfer
work.
> - Creating a task for each phase splits the objective, discussion,
workspace, and review policy.
> - A case can retain the facts while one primary task moves between
agents.
> - Transfers must survive process failure and preserve private access,
budgets, and completion gates.
> - This pull request adds durable case handoffs, native case tools, and
read-only case pages.
> - Prompts describe the workflow. Existing task controls decide when
work can run and finish.

## Linked Issues or Issue Description

**Problem or motivation**

Prompt-driven agent teams need a persistent record that can move through
triage, implementation, verification, and correction. Ordinary
reassignment does not provide a durable instruction, safe release
barrier, or recoverable delivery receipt for an agent handing off its
own running task.

**Proposed solution**

Extend standalone cases with one primary task, a descriptive phase,
retained access sources, and a handoff ledger. Apply assignments after
source execution and workspace settlement. Deliver each transfer through
the existing durable wake queue. Provide `create_case`, `read_case`,
`update_case`, and `handoff_case` in the native runner. Creation
requires kickoff and explicit workflow text. An explicit handoff to
`done` closes the case when normal task completion is accepted.

**Alternatives considered**

Do not add a workflow engine, filesystem queue, configured state graph,
or one task per phase. The workflow document combines transition prose
with an optional Mermaid `stateDiagram-v2` map. The server does not
execute the diagram. The Pipelines experiment removed on master stays
removed.

**Roadmap alignment**

This extends Agent Reviews and Approvals, Enforced Outcomes, Bounded Run
Recovery, and Activity Log attribution. Existing approval, review,
budget, privacy, workspace, and responsible-user rules remain
authoritative.

Related work: [ordinary handoff wake
recovery](https://github.com/paperclipai/paperclip/pull/15019). This
feature adds a separate persisted case-handoff receipt and release
barrier.

## What Changed

- Add case routing fields, retained access sources, durable handoff
history, delivery leases, and replay-safe migrations.
- Keep the same primary task across agent phases. Preserve each
returning agent's own session and the task's workspace.
- Fence outgoing mutations, wait for provider and workspace release, and
recover delivery without duplicate task comments or runs. Recheck
current assignment permissions as the original caller before applying a
delayed transfer. Scope a run Stop to that run’s own handoff intents, so
repeated old Stop requests preserve newer work. Cancelling terminal
intent without a source run also requires fenced current task ownership,
including native retries and preparation with an old checkout. For Cloud
callers, revalidate current stack membership with an uncached Cloud RPC
and derive owner elevation from the current managed setting.
- Keep case reads, documents, assets, Audit, and live events inside
retained task/project permissions.
- Add native case creation/read/update/handoff tools. Store required
workflow text and initial documents on the first task. Page oversized
case facts and referenced document bodies through the dedicated tool
with bounded UTF-8 JSON, current routing versions, snapshot conflicts,
and current source authorization on every page.
- Add read-only case lists and detail pages, task-style list controls,
compact dotted field tables, linked handoff tasks, and case filters in
Audit.
- Add native/legacy integration tests, migration/restart tests, browser
coverage, and bounded live receipt fixtures. Extend the trusted sandbox
condition to cover the new subscription fixture profile.
- Hide obsolete paused-agent warnings on completed or cancelled task
threads.
- Synchronize the company-switch settings test with React effects after
a CI failure. Preserve its security assertions and production remount
behavior.

## Verification

The branch directly includes master `9ef434fe79`. The required `ci /
verify` and `ci / e2e` gates pass on head `765fccd67c`. [Current-head
CI](https://github.com/paperclipai/paperclip/actions/runs/39464348614)
passes typecheck, build, tests, and all eight browser shards. Security
checks pass. [Greptile gives this exact head
5/5](https://github.com/paperclipai/paperclip/pull/16959#issuecomment-6291156549),
with no unresolved review threads. The optional Paperclip Review check
remains queued because its assigned agent is paused. It is not a
required branch check. No check result was overridden.

Local workspace typecheck and build pass after the master merge, along
with database migration checks, token gates, map checks, Storybook
catalog checks, and the Copilot profile identity check. Standard builds
refresh Runner vendor output. Focused checks pass 2,008
API/paging/context tests and 7 strict case protocol tests. The final
commit changes one test fixture only; its ten tests, UI typecheck, and
token gates pass. No production source changed in that commit.

On current head `765fccd67c`, all **194 critical workflow tests**
executed and passed with no skipped tests in those files:

- 38 Stop/ownership tests, including board completion intent, native
retries, stale Stop, and preparation with an old checkout.
- 2 actual legacy process/HTTP handoff tests, including scratch failure,
a closed-stdio child that continues writing, and recovery through a
fresh worker after the process group stops.
- 5 migration tests, including SQL column metadata, preserved null
authority context, and all six prior-numbering receipts.
- 3 process-settlement and 5 scratch tests.
- 88 handoff-service, 18 heartbeat handoff, and 21 native case-tool
integration tests.
- 7 bounded case/document-read projection tests and 7 strict
protocol-contract tests.

The current CI checkout was `fed65d49`, merging `765fccd67c` into master
`9ef434fe79`. Its new document regressions reconstruct exact
Unicode/escaped bodies and revisions through real native authority and
authenticated HTTP with generic API tools disabled. They cover
case-owned, primary-task, and linked-task documents; routing on every
page; stale document snapshots; access loss and unlinking;
unrelated/foreign/private sources; system documents; and quarantined
content. Active-task document tools retain their existing behavior.
These are current-head test results from the first CI attempt; the
browser-only retry did not rerun these suites.

The full `64fdd3403f` CI failed one separate settings test: after a
company switch, it observed an unsettled API-key draft. The production
component and test were unchanged from prior green source. Production
switches remount both keyed settings layers; the test directly reused an
unkeyed view and used a timer tick instead of waiting for React effects.
The final commit replaces that fixture synchronization with React `act`.
The exact secret-clearing assertions and all timeouts remain unchanged.
The original assertion failure remains recorded; no unchanged retry was
used. The narrow unchanged baseline and fixed fixture each pass 10
tests.

The upstream result-paging merge preserves case capture namespaces and
current asset privacy. Its API integration suite executed 39 of 41 tests
successfully, with two skipped; the optional assigned-result PRP
integration test was skipped. Neither skipped suite is counted in the
194 critical tests or as live provider proof.

All 361 upstream migration entries and SQL bodies remain unchanged. Six
case migrations follow master as 0363–0368 with identical SQL hashes.
Official Drizzle generators produced the combined metadata and five
retained snapshots. Generation reports no schema changes, and the
snapshot drift test passes. The earlier `ce361ae5d0` CI passed on
attempt 1, including its then-current 179 critical tests. Fresh review
later identified unusable document references with generic API tools
disabled; the bounded document reads and ten additional authenticated
HTTP tests address that finding.

The full local `pnpm test:run` attempt was cancelled after this Mac
exhausted PostgreSQL semaphore capacity; it is **not** counted as a
pass. Later database attempts also stopped before assertions or skipped,
including one sandbox socket denial. Two original stale-Stop regressions
did reproduce the bug against the old source. A REST serialization
assertion passed after two preserved database-startup failures. No test
timeout was increased. All 194 assertions listed above executed and
passed in current-head CI. The complete 385-file, 3,963-test UI shard
also passed after the fixture repair.

A configured-provider receipt workflow passed 13 backend checks across
triage → implementation → verification → correction → done, using one
task and four work runs. The saved receipt is revision 2 with total 6
USD; case and task both closed. The original canonical attempt remains
failed because its browser assertion confused the terminal destination
with completed-task tooltips. The corrected full browser verifier passed
on the same retained database and original runs, with no additional
provider calls. The last clean-build browser readback is on
`6a86c54a53`; later changes affect recovery, authorization, bounded
reads, and settlement. Accounted work cost is a $1.010574 rate-card
estimate; provider billing and setup-probe usage are unavailable.

Copilot profile 49 passed the unchanged seven-fixture private protocol
pack (46/46 checks, no retries) and the product file-edit canary after
master's completion-replay change. All 60 bound implementation hashes
remain unchanged on the current source. Historical profile-47/48
identities and results remain intact. See the [profile-49 compatibility
record](https://github.com/paperclipai/paperclip/blob/codex/persistent-case-handoffs/doc/plans/2026-10-20-copilot-completion-recovery-compatibility-v49.json).
This is bounded compatibility evidence, not a fresh full matrix,
installed-package product test, or Daytona rollout.

Preserved CI failures and retries:

- On `20662930ac`, Slack managed setup failed a five-second success
assertion after reload. Its test/application path was unchanged from a
prior green head. One unchanged-source retry passed all 25 tests in that
shard; no source or timeout changed.
- On `9402b4f17a`, two CI workers received shutdown signals at 15:24:19
UTC. Neither log had an assertion failure before interruption. One
unchanged-source retry of each passed all Runner static checks and all
32 tests in browser shard 6; both aggregates passed. The next head,
`7b4374edaf`, passed all CI without retries.
- On `295f289b5a`, serialized shard 9 timed out during its first
device-login test, then the next test found an active login lease.
Direct login/test paths were unchanged from a prior green head. Cold
import plus a timed-out async body using the next test's mutable
actor/store is the supported fixture-race explanation; no request trace
proves that sequence. The original failure remains recorded. One
unchanged-source retry passed all 294 tests in 19 files, including all
41 device-login tests. No login source or timeout changed. The
subsequent `ce361ae5d0` CI passed without retries.
- On `64fdd3403f`, one company-switch settings assertion observed an
unsettled draft. The final test-only commit uses React `act` without
changing assertions, timeouts, or production code. On `765fccd67c`, all
ten settings tests and the complete 385-file, 3,963-test UI shard
passed.
- On `765fccd67c`, browser shard 3 completed the split-handoff
assertions, then cleanup received HTTP 500 from run cancellation after a
one-second PostgreSQL row-lock timeout. The extra chat run was reporting
completed work while teardown began. Cleanup stopped before restoring a
global experiment flag, causing a later assertion to fail. Relevant
production and test paths are unchanged from an earlier green commit.
Stop's lock order is consistent, and no nested self-lock was found; the
exact PostgreSQL blocker was not recorded. One unchanged-shard retry
passed. The original failure, trace, and downstream flag failure remain
recorded. No Stop implementation, cleanup assertion, or timeout changed.
The retry supports intermittent cleanup contention; it does not identify
the original blocking transaction.


## Risks

- Local process transfers require host-owned PID/group absence. Missing
or uncertain termination evidence keeps delivery pending, independently
of scratch setup.
- Handoff admission and task cancellation share execution ownership. New
regression tests cover temporary holds, late source writes, and
uncertain provider termination.
- Retained private sources use an intersection of existing permissions.
This intentionally fails closed when a source is missing or an existing
task cannot preserve that boundary.
- Migrations add tables and indexes. They preserve master history and
can replay over prior feature installs. Migration 0368 adds nullable
internal authorization provenance with no default or authority backfill.
Historical transfers still awaiting release without this context fail
closed; an operator must cancel them and request a new handoff.
- Delayed Cloud handoffs depend on the current Cloud membership RPC. An
unavailable, ambiguous, expired, or mismatched response holds the
handoff for retry; it does not reuse cached authority or grant access.
- Bounded reads reload and reauthorize the selected projection per page.
Underlying work grows with the data size and number of pages. Changed
data or routing requires restarting from offset zero without the old
snapshot.
- Phase names and workflow diagrams remain advisory. They do not satisfy
review or approval gates.
- This is a large, cross-cutting PR. The maintainer requested one PR for
the whole feature; the commits separate data, runtime, UI, and
qualification work.

## Model Used

OpenAI Codex, GPT-6 family, with tool use, code execution, and delegated
code review. The exact deployment model ID and context-window size were
not exposed in the session. Live fixture agents used the explicitly
configured provider model recorded in their test evidence.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

---------

Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-10-20 12:46:14 -05:00

378 lines
27 KiB
JSON
Raw Blame History

{
"schemaVersion": 1,
"documentTitle": "Paperclip agent operation groups",
"evalRepositoryUrl": "https://github.com/paperclipai/paperclip-evals/blob/master/",
"prpEventFamilyDescriptions": {
"runner": "Runner connection, drain, and diagnostic lifecycle.",
"runtime": "Runner phase transitions.",
"sandbox": "Sandbox resource measurements.",
"workspace": "Workspace readiness.",
"harness": "Provider harness startup, readiness, exit, and diagnostics.",
"auth": "Content-free harness credential changes observed by the runner.",
"session": "Provider-neutral session open, resume, reconciliation, close, and failure.",
"turn": "Model turn submission through terminal turn disposition.",
"item": "Provider-neutral model/tool item lifecycle.",
"mcp_app": "MCP App discovery, initialization, tool, action, host-context, and teardown evidence.",
"runtime_request": "Runtime permission/input request lifecycle.",
"interaction": "Issue-thread interaction proposal, materialization, response, delivery, and rejection.",
"run": "Structured result negotiation and terminal run outcome.",
"attention": "Continuation and attention routing lifecycle.",
"work": "Recorded work-assessment evidence.",
"issue": "Issue-status decision proposal outcome and application evidence.",
"plan": "Complete provider-authored within-turn checklist snapshots, separate from durable Paperclip Plan documents.",
"tool": "Provider-neutral process, MCP, dynamic, and built-in execution activity.",
"research": "Provider-reported search, page-open, and in-page research activity.",
"delegation": "Child-agent delegation lifecycle and aggregate status.",
"model": "Requested/effective model routing and verification state.",
"context": "Context-window compaction markers without hidden summaries.",
"artifact": "Authorized artifact viewing and structured generated outputs.",
"review": "Provider review-mode state, separate from Paperclip authority.",
"hook": "Bounded provider hook lifecycle and blocking outcomes.",
"memory": "Authorized or unavailable memory citation references.",
"safety": "Provider safety review state attached to governed work.",
"terminal": "Content-free terminal input activity metadata.",
"wait": "Intentional provider waits, distinct from warm idle and human input.",
"provider": "Redacted provider notices and actionable warnings.",
"semantic_tool": "Canonical authorized Paperclip tool input and result evidence.",
"usage": "Provider/model-attributed usage and accounting boundaries."
},
"prpCommandFamilyDescriptions": {
"semantic_tool": "Returns an authorized, correlated Paperclip tool result to the provider through runnerd.",
"run": "Prepare or cancel a run.",
"session": "Open, snapshot, or close a normalized provider session.",
"turn": "Start, steer, interrupt, or stop a model turn.",
"request": "Resolve a pending runtime request.",
"interaction": "Acknowledge delivery of an interaction response.",
"runner": "Drain or shut down the runner process."
},
"optionalGrantGroups": [
{
"id": "feedback",
"description": "Internally attributed complaints and improvement suggestions; no additional grant required beyond active run authority.",
"operationIds": ["submit_complaint", "submit_suggestion"]
},
{
"id": "discovery",
"description": "Company-visible task, agent, project, and goal discovery.",
"operationIds": ["search_tasks", "list_agents", "get_agent", "list_projects", "list_goals", "set_task_title"]
},
{
"id": "projects",
"description": "Project creation and authorized repository discovery through the live company/run authority.",
"operationIds": ["create_project", "list_project_repositories"]
},
{
"id": "delegation_dependencies",
"description": "Create or reassign delegated work and maintain dependency edges.",
"operationIds": ["create_task", "reassign_task", "set_dependencies", "hire_agent"]
},
{
"id": "governance",
"description": "Read, request, comment on, and decide approvals under governed-action checks.",
"operationIds": ["list_approvals", "get_approval", "get_approval_context", "request_approval", "decide_approval", "comment_on_approval"]
},
{
"id": "cases",
"description": "Read and update authorized case facts and revisioned documents, and durably hand off the primary task. list_cases and upsert_case remain scenario mocks.",
"operationIds": ["list_cases", "upsert_case", "create_case", "read_case", "update_case", "handoff_case"]
},
{
"id": "workspace_runtime",
"description": "Inspect and select task workspaces, prepare repositories, and control workspace runtime services.",
"operationIds": ["get_workspace_runtime", "control_workspace_service", "get_workspace", "list_workspaces", "select_workspace", "prepare_repository"]
},
{
"id": "wake_scheduling",
"description": "Schedule a bounded continuation wake when the current task owns the future check.",
"operationIds": ["schedule_wake", "set_task_monitor"]
},
{
"id": "routines",
"description": "Inspect or manage company routines.",
"operationIds": ["list_routines", "manage_routine"]
},
{
"id": "company_skills",
"description": "Create, update, or inspect company skills and synchronize the current agent's skills.",
"operationIds": ["create_skill", "update_skill", "list_company_skills", "sync_company_skills"]
},
{
"id": "secrets",
"description": "Inspect secret metadata or use a brokered secret value without exposing plaintext evidence.",
"operationIds": ["list_secret_metadata", "read_secret_value"]
},
{
"id": "portability_admin",
"description": "Export portable company state; broad administration remains deferred until split into governed operations.",
"operationIds": ["export_company", "administer_company"]
},
{
"id": "test_escape_hatch",
"description": "Controlled skill-test transport only; never product coverage.",
"operationIds": ["generic_api_request"]
},
{
"id": "api_fallback",
"description": "Discover and invoke HTTP API operations unsupported by available dedicated tools. Production authority and route authorization remain required.",
"operationIds": [
"search_api",
"call_api"
]
}
],
"behaviorGroups": [
{
"id": "hb",
"legacyGroup": 1,
"name": "Heartbeat",
"owner": "control plane + always tools",
"operationIds": ["get_task_context", "set_task_title"],
"controlPlaneOperationIds": ["select_work", "enforce_budget"],
"realSurface": "agent identity, inbox-lite, heartbeat context, budget and active-issue services",
"mockStateDomains": ["company", "actor", "wake", "task", "budget", "run"],
"prpEvidence": "runner/session/run context plus bounded task-context tool results",
"gap": "Production semantic binding is unbound; identity and work selection remain injected/control-plane-owned."
},
{
"id": "co",
"legacyGroup": 2,
"name": "Checkout",
"owner": "control plane",
"operationIds": [],
"controlPlaneOperationIds": ["checkout_task"],
"realSurface": "POST /api/issues/:id/checkout and execution-lock services",
"mockStateDomains": ["task", "actor", "run", "idempotency", "fault"],
"prpEvidence": "run preparation and issue-status decision evidence with checkout receipt",
"gap": "Intentionally no model tool; the production checkout receipt still needs the additive semantic-receipt envelope."
},
{
"id": "st",
"legacyGroup": 3,
"name": "Status",
"owner": "always tools + control-plane arbitration",
"operationIds": ["answer_status_question", "finish_task", "block_task", "request_review"],
"controlPlaneOperationIds": ["reconcile_run", "append_audit_record"],
"realSurface": "issue PATCH, review/liveness policy, and native finalization arbitration",
"mockStateDomains": ["task", "comments", "interactions", "blockers", "audit", "run"],
"prpEvidence": "semantic operation receipt, work assessment, issue-status decision, and terminal causality",
"gap": "Production semantic binding and additive typed operation/conflict receipts remain unimplemented."
},
{
"id": "cm",
"legacyGroup": 4,
"name": "Comments",
"owner": "always tools",
"operationIds": ["get_task_history", "report_progress"],
"controlPlaneOperationIds": ["append_audit_record"],
"realSurface": "issue comment list/get/create routes",
"mockStateDomains": ["task", "comments", "actor", "idempotency", "audit"],
"prpEvidence": "bounded read result or idempotent comment-write receipt plus audit reference",
"gap": "Active-task binding is unbound; cross-task comment mutation is deliberately outside V1."
},
{
"id": "se",
"legacyGroup": 5,
"name": "Search",
"owner": "optional discovery tools",
"operationIds": ["search_tasks", "list_agents", "get_agent", "list_projects", "list_goals", "list_project_repositories"],
"controlPlaneOperationIds": [],
"realSurface": "company issue search and agent/project/goal list/get routes",
"mockStateDomains": ["company", "task", "actor", "project", "goal"],
"prpEvidence": "bounded redacted read projections through tool-result item events",
"gap": "Goal operations remain scenario-only. Project and repository discovery contracts are delivered by the live server authority; they are not implemented by the mock command dispatcher."
},
{
"id": "su",
"legacyGroup": 6,
"name": "Subtasks",
"owner": "optional delegation tools",
"operationIds": ["create_task", "reassign_task", "hire_agent", "handoff_case"],
"controlPlaneOperationIds": ["route_wake"],
"realSurface": "company issue create, child issue, guarded reassignment, and wake services",
"mockStateDomains": ["company", "task", "actor", "blockers", "wake", "audit"],
"prpEvidence": "company/task state diff, audit reference, and continuation wake evidence",
"gap": "create_task is production-bound to ordinary active-issue child creation with assignment, dependency-ready wake, company checks, child limits, and durable source-scoped idempotency. handoff_case is live-only: the dedicated case service moves the same primary task after source execution settles, or records completion intent subject to ordinary completion gates; legacy scenarios do not claim that coverage."
},
{
"id": "bl",
"legacyGroup": 7,
"name": "Blockers",
"owner": "always/optional tools + control plane",
"operationIds": ["block_task", "set_dependencies"],
"controlPlaneOperationIds": ["schedule_blocker_wake", "route_wake"],
"realSurface": "issue relations, blocker projection, liveness validation, and blocker wake services",
"mockStateDomains": ["task", "blockers", "wake", "actor", "audit", "fault"],
"prpEvidence": "dependency diff, block receipt, attention routing, and issue-status decision",
"gap": "set_dependencies is production-bound for the active issue; block_task remains unbound, and cancelled-blocker receipts still need typed additive evidence."
},
{
"id": "dp",
"legacyGroup": 8,
"name": "Documents and plans",
"owner": "always task-document tools; restore optional; destructive lifecycle control-plane-only",
"operationIds": ["list_documents", "read_document", "list_document_revisions", "write_document"],
"controlPlaneOperationIds": ["append_audit_record"],
"realSurface": "issue document list/read/upsert/revision/restore/lock/unlock/delete routes",
"mockStateDomains": ["task", "documents", "interactions", "idempotency", "audit", "fault"],
"prpEvidence": "bounded reads and revision-safe write/conflict/denial receipts with revision lineage",
"gap": "restore_document_revision is an approved optional-tool gap; lock/unlock/delete are intentionally control-plane-only. Case kickoff initialDocuments become ordinary task documents in the same transaction. Case reads roll up authorized task document metadata; historical case-document REST storage remains readable without dedicated native document tools."
},
{
"id": "ix",
"legacyGroup": 9,
"name": "Interactions",
"owner": "always tools + addressed resolver",
"operationIds": ["request_human_input"],
"controlPlaneOperationIds": ["route_wake"],
"realSurface": "issue-thread interaction create/respond/accept/reject/withdraw services",
"mockStateDomains": ["task", "documents", "interactions", "wake", "actor", "idempotency"],
"prpEvidence": "interaction proposal/materialization/response/delivery and attention events",
"gap": "Production binding and semantic resolution receipts are unbound."
},
{
"id": "ap",
"legacyGroup": 10,
"name": "Approvals",
"owner": "optional governance tools + governed approver",
"operationIds": ["list_approvals", "get_approval", "get_approval_context", "request_approval", "decide_approval", "comment_on_approval"],
"controlPlaneOperationIds": ["route_wake", "append_audit_record"],
"realSurface": "company approval, decision, issue-link, comment, and governed-action services",
"mockStateDomains": ["company", "task", "approvals", "actor", "wake", "audit", "idempotency"],
"prpEvidence": "governed semantic receipts, audit references, and attention/continuation linkage",
"gap": "Production binding and additive governed-action receipts are unbound; board-only authority stays outside grants."
},
{
"id": "ar",
"legacyGroup": 11,
"name": "Artifacts",
"owner": "always tools + artifact/work-product services",
"operationIds": ["register_deliverable"],
"controlPlaneOperationIds": ["append_audit_record"],
"realSurface": "attachment upload and issue work-product routes",
"mockStateDomains": ["task", "artifacts", "workProducts", "workspace", "audit", "idempotency"],
"prpEvidence": "artifact/work-product reference and durable inspectability receipt; never binary bytes",
"gap": "Production upload/register composite and additive durable-reference receipt are unbound."
},
{
"id": "er",
"legacyGroup": 12,
"name": "Errors and critical rules",
"owner": "runner/control plane + optional workspace/wake tools",
"operationIds": ["get_workspace_runtime", "control_workspace_service", "get_workspace", "list_workspaces", "select_workspace", "prepare_repository", "schedule_wake", "inspect_operation_result"],
"controlPlaneOperationIds": ["release_task", "enforce_budget", "persist_run", "replay_run", "reconcile_run"],
"realSurface": "workspace runtime, monitor/recovery, budget, run persistence/replay, release, and terminal services",
"mockStateDomains": ["workspace", "budget", "run", "wake", "audit", "idempotency", "fault"],
"prpEvidence": "runtime/workspace/attention/run lifecycle, typed denials, replay facts, and terminal causality",
"gap": "Budget stop reasons and semantic denial/conflict receipts require additive v1 envelopes; inspect_operation_result remains scenario-only. Task workspace inspection, discovery, selection and repository preparation use live authenticated service contracts; the legacy scenarios do not claim coverage for these operations."
},
{
"id": "rf",
"legacyGroup": 13,
"name": "Reference files",
"owner": "always instruction tools + optional domain tools + test-only escape hatch",
"operationIds": ["list_cases", "upsert_case", "create_case", "read_case", "update_case", "list_routines", "manage_routine", "create_skill", "update_skill", "list_company_skills", "sync_company_skills", "list_secret_metadata", "read_secret_value", "export_company", "administer_company", "generic_api_request", "search_api", "call_api", "create_project", "read_agent_instructions", "update_agent_instructions", "get_agent_instruction_history", "restore_agent_instructions", "submit_complaint", "submit_suggestion"],
"controlPlaneOperationIds": ["append_audit_record"],
"realSurface": "agent instruction revisions, project, case, routine, company-skill, secret, portability, and administration services, and run-attributed agent commentary",
"mockStateDomains": ["company", "cases", "routines", "skills", "secrets", "audit", "fault"],
"prpEvidence": "bounded domain projections, redacted broker receipts, company diffs, and audit references",
"gap": "Instruction read/update/history/restore require the live canonical revision service, current responsible-user permissions, and pinned base revisions for writes. Their service, authority, and product E2E tests are separate from the legacy mock scenarios. Project and skill creation and API tools require the live server authority; generic_api_request is test-only. create_case, read_case and update_case are live-only authorized case creation, projections and fact mutations; list_cases and upsert_case remain scenario mocks. Other domain operations remain scenario-only. Broad administer_company is deferred and cannot claim product coverage. Production API and paired dedicated-tool regressions are recorded separately in paperclip-evals/evals/runner-api-tools; the legacy scenario count is not evidence of that coverage. Feedback actions are live-only: shared persistence, authority, API, and actual Codex smoke tests cover them; the legacy scenario count does not claim feedback coverage."
},
{
"id": "mh",
"legacyGroup": 14,
"name": "Multi-hop",
"owner": "composed semantic operations + control-plane continuation",
"operationIds": ["create_task", "set_dependencies", "request_human_input", "request_approval", "register_deliverable"],
"controlPlaneOperationIds": ["route_wake", "reconcile_run"],
"realSurface": "delegation, dependency, interaction, approval, artifact, and terminal orchestration services",
"mockStateDomains": ["task", "blockers", "interactions", "approvals", "artifacts", "wake", "run", "audit"],
"prpEvidence": "correlated operation receipts, state diffs, attention hops, work assessment, status decision, and terminal outcome",
"gap": "No generic transaction tool is allowed; shared mock/real conformance must prove each composed effect."
},
{
"id": "rs",
"legacyGroup": 15,
"name": "Restraint and no-call",
"owner": "policy/exposure layer",
"operationIds": ["answer_status_question", "read_secret_value", "generic_api_request"],
"controlPlaneOperationIds": ["enforce_budget"],
"realSurface": "task-mode, secret-broker, test-scope, pause, and budget policy checks",
"mockStateDomains": ["actor", "task", "budget", "secrets", "audit", "fault"],
"prpEvidence": "absence of forbidden effects plus typed policy denial/redaction receipts when a call is attempted",
"gap": "Typed redaction/authorization receipts need additive v1 evidence; generic_api_request is never a product fallback."
},
{
"id": "wk",
"legacyGroup": 16,
"name": "Wake situations",
"owner": "control plane + always context/history tools",
"operationIds": ["get_task_context", "get_task_history", "schedule_wake", "set_task_monitor"],
"controlPlaneOperationIds": ["select_work", "route_wake"],
"realSurface": "wakeup requests, heartbeat context, comment/interaction/approval/blocker wake routing, and scheduled wake services",
"mockStateDomains": ["wake", "task", "comments", "interactions", "approvals", "blockers", "run"],
"prpEvidence": "attention request routing/resolution plus resumed session/run causality",
"gap": "set_task_monitor binds the one-shot monitor scheduler in production; schedule_wake remains mock-backed. Control-plane routing remains non-callable."
}
],
"rules": {
"companyAuthorization": [
"Every entity read and write is resolved inside the authenticated actor's company; cross-company identifiers fail without disclosing protected facts.",
"Board actors use active membership and role permissions. Agent writes require a company-scoped run JWT and X-Paperclip-Run-Id; active-task tools cannot accept a caller-selected company or arbitrary task.",
"Optional tools are omitted unless every required claim, role, and task-mode condition is satisfied. A grant never bypasses approval, budget, pause, execution-lock, interaction-owner, or other governed-action checks."
],
"taskModes": [
"standard permits the full eligible catalog subject to claims and role checks.",
"ask is answer-only: investigation reads are eligible, while implementation, document mutation, delegation, terminal, and governed writes are absent.",
"planning permits plan/document/progress/input operations but not delegation or terminal completion; accepting a plan transitions the issue into a fresh standard execution continuation for the exact accepted revision.",
"skill_test exposes only scenario-admitted tools. generic_api_request additionally requires the explicit test grant and allowlist and never supplies product coverage."
],
"redaction": [
"Tool descriptors declare observable redaction. Secret plaintext may reach only the model-use capsule authorized for a bound secret; it never reaches PRP, logs, artifacts, errors, audit details, or serialized tool results.",
"Authorization denials reveal stable codes, missing public claims, and remediation only; they do not include protected entity state, credentials, headers, cookies, or another company's policy.",
"Artifacts carry durable references, hashes, content type, and size on the wire; binary payloads remain in storage transports."
],
"idempotency": [
"Every mutation whose descriptor says required must carry a stable idempotency key. Retrying the same key and equivalent input returns the prior receipt without duplicating side effects.",
"Reusing a key with different input is an idempotency conflict. Optimistic document writes additionally bind baseRevisionId and return the current revision on conflict.",
"PRP source event IDs are idempotent, source sequence gaps are evidence, and replay is side-effect free. Replaying a trace cannot repeat control-plane writes."
],
"sideEffects": [
"read operations return bounded projections and do not mutate control-plane state.",
"task_write and company_write operations emit normalized state diffs and immutable audit references after production authorization succeeds.",
"governance, workspace_control, secret_read, and admin operations retain their production-specific gates; catalog exposure is necessary but never sufficient authority.",
"Terminal semantic operations propose intent. The control plane owns checkout, release, budget enforcement, persisted run evidence, replay, wake routing, audit append, and final status arbitration."
]
},
"documentLifecycle": {
"scope": [
"Issue documents are active-task working records identified by (activeIssueId, key). Always-present document tools do not accept a company id or arbitrary issue id.",
"Cross-task document reads require a future explicit optional operation and grant; case documents and future company knowledge are separate resource types.",
"Locked-document fallback may create a deterministic new key only when lockedDocumentStrategy is create_new_document; the source stays locked and the returned receipt names the redirected key."
],
"operations": [
{"action": "create", "semanticOperation": "write_document", "placement": "always_agent_tool", "contract": "baseRevisionId is null; create revision 1 and return document/revision/audit identity.", "status": "supported contract; production binding unbound"},
{"action": "read", "semanticOperation": "list_documents / read_document", "placement": "always_agent_tool", "contract": "List metadata or read the current active-task document by stable key.", "status": "supported contract; production binding unbound"},
{"action": "update", "semanticOperation": "write_document", "placement": "always_agent_tool", "contract": "Require the exact latest baseRevisionId and an idempotency key; append an immutable revision.", "status": "supported contract; production binding unbound"},
{"action": "revisions", "semanticOperation": "list_document_revisions", "placement": "always_agent_tool", "contract": "Return bounded immutable revision history newest first.", "status": "supported contract; production binding unbound"},
{"action": "restore", "semanticOperation": "restore_document_revision", "placement": "optional_agent_tool (documents:restore)", "contract": "Validate same-document lineage, reject locked documents, append a new revision, and return source/new revision identity; restoring current is a no-change duplicate.", "status": "approved catalog gap"},
{"action": "lock", "semanticOperation": "none", "placement": "control_plane_owned", "contract": "Board/administrative lifecycle action; agent writes receive document_locked or use explicit create-new fallback.", "status": "intentionally non-callable"},
{"action": "unlock", "semanticOperation": "none", "placement": "control_plane_owned", "contract": "Board/administrative lifecycle action; never inferred from a failed write.", "status": "intentionally non-callable"},
{"action": "delete", "semanticOperation": "none", "placement": "control_plane_owned", "contract": "Destructive audited action; pending targets become stale and the runner never recreates them automatically.", "status": "intentionally non-callable"}
]
},
"legacySemanticTargetDispositions": {
"injected_actor_context": {"kind": "control_plane", "targets": ["select_work"], "reason": "Identity is launch context, not a model tool."},
"runner_work_selection": {"kind": "control_plane", "targets": ["select_work"], "reason": "Inbox selection belongs to the control plane."},
"get_project": {"kind": "folded", "targets": ["list_projects"], "reason": "The bounded discovery operation owns project list/get projection in V1."},
"wait_for_workspace_service": {"kind": "folded", "targets": ["control_workspace_service"], "reason": "Wait is a bounded action of workspace service control."},
"get_goal": {"kind": "folded", "targets": ["list_goals"], "reason": "The bounded discovery operation owns goal list/get projection in V1."},
"semantic_task_disposition": {"kind": "composite", "targets": ["answer_status_question", "finish_task", "block_task", "request_review"], "reason": "Generic issue PATCH is replaced by intent-specific terminal/status operations."},
"atomic_checkout": {"kind": "control_plane", "targets": ["checkout_task"], "reason": "Checkout is an atomic control-plane transaction."},
"runtime_release": {"kind": "control_plane", "targets": ["release_task"], "reason": "Release is runner/control-plane cleanup."},
"restore_document_revision": {"kind": "known_gap", "targets": [], "reason": "Approved optional documents:restore operation is not yet in the canonical catalog."},
"link_approval": {"kind": "folded", "targets": ["request_approval", "get_task_context"], "reason": "Issue linkage is part of approval request/context composites."},
"unlink_approval": {"kind": "control_plane", "targets": ["append_audit_record"], "reason": "No standalone agent unlink tool is approved in V1."},
"test_only_api_escape_hatch": {"kind": "folded", "targets": ["generic_api_request"], "reason": "Compatibility alias for the test-only escape hatch."}
}
}
Reference in new issue View Git Blame Copy Permalink