mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-20 06:02:18 +02:00
DottaandPaperclip
5a9e6b6315
## Thinking Path > - Paperclip lets people manage AI agents and their work. > - Grok Bot uses a managed Runner and a fixed external work session. > - Its admitted contract gives it no access to Paperclip workspace files. > - The Runner still has a sync descriptor to support durable recovery. > - Cancellation treated that descriptor as proof that files needed repair. > - This pull request uses the admitted access contract while preserving ownership settlement. > - Users get the correct recovery action after Stop, with native file safeguards intact. ## Linked Issues or Issue Description Refs #16219 and #16422. The duplicate search found no open Grok workspace correction. **What happened?** A real Grok Stop test cancelled its run, fenced its assignment, denied a stale progress update and cleaned up the sandbox. Paperclip also created a file-repair hold. The recovery panel told the user to recover workspace files, although the admitted external contract has workspace access set to none. **Expected behavior** Keep the stopped session fenced and require inspection before new work. Keep failed-run ownership settlement. Do not invent a file export obligation for a session that cannot access the workspace. Native sessions with writable or unknown workspace access must keep their file safeguards. **Steps to reproduce** 1. Connect a Grok Bot and assign a task. 2. Let it accept the task and save a Paperclip checkpoint document. 3. Use Stop while it is working. 4. Inspect the task recovery panel. It asks for file repair after sandbox cleanup succeeds. **Paperclip version or commit** Observed on Core11d69d04c7through the actual Grok client. Reproduced against master with database-backed regressions. ## What Changed - Match the admitted native input to its run, company, agent, task and external driver before treating workspace access as disabled. - Keep coordinator ownership checks and failure settlement. Skip file retention and the false file-repair obligation for that exact contract. - Add inspection-only settlement for old Grok file holds through Runtime recovery. Verify exact run ownership, fenced assignments, terminal coordinators and managed lease stop receipts. Archive the false file evidence and preserve no-replay. - Keep historical Dot recovery controls. Do not claim global external-provider termination. - Fix the later dispatch-failure owner so it cannot retain a no-workspace external sandbox for a false file obligation. - Cover both Grok and Dot, mismatched access evidence, native file recovery and the assembled heartbeat cleanup path. - Update the Grok guide and the existing release evidence plan. ## Verification - Four database regressions fail before the correction. - 68 file-recovery and cancellation checks pass. Grok, Dot and the shared recovery notice pass 98 checks. The assembled heartbeat selection passes both cases; 404 unrelated cases were not selected in that local command. - The lifecycle regression caught an unsafe early-return prototype. The final code keeps coordinator settlement for both workspace cases. A separate assertion was corrected for the run-state projection's explicit nulls. The failed attempts remain in the private evidence record. - Repository typecheck and build, token gates and Storybook build pass. The branch was rebased fromea4aa185b0onto7420af26fc, whose additional change affects CI profile exports. The core recovery checks are repeated after rebase. - On the earlier deployed source, a real 824-second task survived an actual same-image controller restart with its original run, assignment, process and lease. It completed canonically and cleaned up without an extra wake. The active Stop test denied a real stale update and completed connection inspection and authenticated re-verification. These results establish the observed baseline and defect; they do not qualify this patch's deployed behavior. - Review found two valid gaps: the old file obligation still blocked fresh input, and dispatch failure could request retention earlier. Both are corrected. The follow-up passes 128 focused tests and server typecheck. The recovery test proves fresh user continuation after inspection, authenticated re-verification, and managed Runner cleanup while the old assignment stays fenced. - A second review found a partial-transaction gap. Routine readiness now commits as invalid before task holds retire. All 43 Grok routine tests pass, including a held task lock and an unrelated active assignment. - Repository typecheck and build pass after the first review corrections; final server typecheck also passes. The full local suite is still running and is not claimed as passed. The first follow-up CI timed out at 15 seconds in one unchanged run-history case; all 91 cases pass locally. The cause is unproven. - The final head,33e4361911, passes 54 checks plus one successful status context. Two optional Storybook jobs are skipped. Greptile reviewed that exact head at 5/5 with no unresolved threads. All source CI suites pass on this final head without retry. The earlier runner-shutdown and timeout attempts remain recorded. - An actual deployed historical recovery and fresh Stop repeat are still required. ## Risks An incomplete or mismatched contract must retain file safeguards. The change uses stored admission evidence rather than current agent configuration. Historical records stay auditable and do not gain automatic replay or a generic Retry action. Operator inspection and a fresh authenticated verification remain required before new Grok work. Global Grok termination remains unconfirmed. No schema migration is needed. ## Model Used OpenAI GPT-6 in Codex, with reasoning, repository editing, shell tools and computer use. The exact serving model ID, snapshot and context window are not exposed by this session. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>