Files
PaperClipAI/feature-map/README.md
T
DottaandPaperclip cc88b61c09 feat: add portable verification skills and refresh the feature map (#15983)
## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work.
> - Contributors use the feature map to select verification recipes.
> - The repository needs separate skills to create a verifier, maintain
recipes, and run checks.
> - Shared recipes must match current routes, controls, and
prerequisites.
> - This pull request adds portable verification skills and updates the
existing map.
> - The benefit is a repeatable verification workflow with clear
ownership and evidence limits.

## Linked Issues or Issue Description

Refs: #15288, which added the existing feature map. The related test
cleanup in #15978 changes test ownership; this PR changes skill
instructions and recipes.

**Issue type**

Missing documentation and outdated verification instructions.

**Where is the issue?**

The project-local skills in `.agents/skills/` and the recipes in
`feature-map/`.

**What's wrong?**

The repository lacks the portable creation and maintenance skills. The
verifier mixes live verification with map editing. Some recipes describe
old controls or omit required flags, identities, and provider setup.

**Suggested fix**

Import the skills and their complete references from Paperclip's pstack
fork. Keep the existing map in its current directory. Let the verifier
read recipes and report drift. Let the maintenance skill update the map.

## What Changed

- Add `create-verification-skill` and `maintain-verification-skill` from
the portable fork of Poteto's pstack. Include invocation policies, all
feature-map examples, self-contained attribution notices and the full
MIT license in each skill folder.
- Use the existing `feature-map/` directory and Poteto's recipe format.
Omit the fork's separate runtime skill and runtime-skill dependencies
because Paperclip supplies execution.
- Add `verify-paperclip` with executable launch, readiness, onboarding,
and cleanup helpers. Use isolated temporary data and separate evidence
directories.
- Make `verify-paperclip` consume the map and report recipe drift. Give
map editing to `maintain-verification-skill`.
- Review all 35 feature files and correct 30 recipes. Clarify routes,
flags, current controls, persistence scope, and the limits of linked
tests.
- Remove the unrelated Conference Room flag change from the onboarding
smoke helper.
- Add a standard-library ownership test. It proves that doctor and stop
reject a foreign checkout without stopping its live server. A
delayed-exit fixture also proves cleanup waits for runtime exit.
- Keep audit screenshots and scratch reports outside the repository. No
product code, migrations, lockfile, or workflow changes.

## Verification

- Passed after rebase: metadata validation for all three skills, Python
syntax and executable checks, JavaScript syntax, 35-entry map/index
consistency, relative links, license preservation, and `git diff
--check`.
- Ran one isolated live audit before rebase. Checked task persistence,
document upload/download bytes, goal hierarchy, project edits, search,
local process Agent Chat, question replies, queued-message discard/stop,
and a harmless loopback MCP call.
- Checked local settings and draft flows. Synthetic cost events reached
a small budget limit and paused the test agent. These checks do not
prove external model quality or provider billing.
- Checked cleanup of the audit server, database, local MCP fixture, and
workspace service inventory.
- Passed: `pnpm -r typecheck`.
- Greptile: 5/5 on commit `4344ac4df7`. The cleanup finding is fixed and
its review thread is resolved. A fresh review is pending for the notice
relocation.
- Passed: `python3 -m unittest discover -s
.agents/skills/verify-paperclip/tests -v`. Both tests pass: the foreign
fixture stayed alive after rejection, and owned cleanup waited for
delayed runtime exit.
- Passed: `pnpm build`.
- All GitHub CI checks were green on commit `4344ac4df7`. The cloud-auth
browser shard passed after one retry for a disposed mocked API response.
The notice relocation passed skill metadata, relative-link, and
license-preservation checks; fresh CI/review is pending.
- The full local `pnpm test:run` did not complete. It was interrupted
after nearly 30 minutes once the complete CI suite passed on the same
commit. Exit code: 130. The new helper safety tests passed locally. The
local full-suite checklist item stays unchecked.
- Full live coverage is incomplete. Authenticated multi-user checks and
external provider journeys need their own identities, credentials, and
targets.
- The corrected onboarding helper could not be re-tested after removing
the flag mutation. Two fresh launches failed before server startup.
Direct PostgreSQL initialization reported exhausted shared-memory IDs or
limits. The host had free disk space. No host-wide limits or unrelated
instances were changed.

## Risks

- Recipe drift can return as the UI changes. The map records
verification scope, not proof of a passed journey.
- The new helpers assume a source checkout with installed dependencies,
Python, Node, and `lsof`. The onboarding helper also needs Playwright.
- The local audit found observations that need separate investigation:
an action test returned fixture data while the connection control showed
Off and native profiles existed; a failed status-card setup task left
the card showing Setting up. Workspace service start also did not reach
a running state. This PR does not change product behavior or redefine
those outcomes as success.
- The main audit trace did not finalize during browser shutdown.
Screenshots, text captures, and iteration results were retained.
- Live evidence was captured before rebase. The onboarding helper
re-test and full provider/auth qualification remain incomplete.

## Model Used

OpenAI GPT-6 through Codex assisted with this change. The session does
not expose the exact serving model ID, configured context-window size,
or reasoning setting. Capabilities used: source analysis, read-only
source subagents, file edits, shell commands, and browser automation.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [ ] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [ ] All Paperclip CI gates are green
- [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

---------

Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-10-12 13:31:44 -05:00

184 lines
11 KiB
Markdown

# Paperclip feature map
Start here when reproducing a user-facing bug, verifying a change, or deciding
which surfaces a fix must cover. Each recipe describes what a person can do,
where they can do it, the expected result, and the evidence needed to verify it.
Product behavior is still governed by [the implementation spec](../doc/SPEC-implementation.md).
## Features
The map is organized by user capability, not by source file. It covers **35 feature
families** across the product, CLI, and operator workflows, checked against source
on 2026-10-12. Experimental and developer-only surfaces are labeled explicitly.
Each recipe includes sub-features, current entry points, automated evidence,
manual verification steps, and gotchas.
### Getting started and access
| Feature | What it covers |
| --- | --- |
| [Onboarding and first work](./onboarding.md) | Instance setup, company wizard, first agent and task. |
| [Login, invitations, and access](./access.md) | Sessions, bootstrap, membership, roles, and CLI authorization. |
| [Companies and portability](./companies.md) | Company switching/settings, archival, package import/export. |
### Tasks and conversations
| Feature | What it covers |
| --- | --- |
| [Task creation and lifecycle](./tasks.md) | Creation, assignment, lists, properties, comments, and completion. |
| [Delegation, dependencies, and signoff](./task-coordination.md) | Child work, prerequisites, reviewers, and task-tree controls. |
| [Inbox, decisions, and search](./inbox-search.md) | Personal triage, decision queues, unread/blocked views, and search. |
| [Agent conversations and project handoff](./agent-chat.md) | Persistent conversations, discovery, handoff, and gated board chat. |
| [Questions and approvals](./questions-and-approvals.md) | Question/plan responses, formal approvals, and app-tool review. |
| [Steering and queued messages](./steering.md) | Follow-ups, queue edits, interruption, and pause/resume. |
| [Documents, attachments, and work products](./documents-artifacts.md) | Versioned documents, annotations, files, outputs, and artifact library. |
### Agents and reusable capabilities
| Feature | What it covers |
| --- | --- |
| [Hiring, configuration, and organization](./agents.md) | Agent identity, instructions, reporting lines, lifecycle, and built-ins. |
| [Runs, harnesses, and model accounts](./runs-adapters.md) | Adapter/model setup, account validation, transcripts, and run history. |
| [Skills and Skill Studio](./skills.md) | Discovery, sources, authoring, revisions, tests, and agent policies. |
| [Team packages and installation](./teams.md) | Catalog preview/install via CLI/API; catalog UI availability called out. |
### Projects and execution
| Feature | What it covers |
| --- | --- |
| [Projects and repositories](./projects.md) | Project lifecycle, task context, repository configuration, and defaults. |
| [Goals and work alignment](./goals.md) | Goal hierarchy, ownership, status, and project/task context. |
| [Workspaces, services, and files](./workspaces.md) | Provisioning, task bindings, services/logs, Git/files, and closure. |
| [Execution environments](./execution-environments.md) | Local, SSH, sandbox providers, target probes, and custom images. |
| [Recovery](./recovery.md) | Stopped work, workspace repair, bounded continuation, and reconnect. |
### Apps, channels, and extensions
| Feature | What it covers |
| --- | --- |
| [Connection setup](./connection-setup.md) | Catalog, MCP links, task requests, authentication, and setup resumption. |
| [App access and action permissions](./app-permissions.md) | Agent grants, off/ask/allowed actions, discovery, tests, and revocation. |
| [External chat and email](./chat-channels.md) | Provider-specific identity, threads, files, delivery, and endpoint upkeep. |
| [Tool gateways and access profiles](./gateways-profiles.md) | Tool exposure, client configuration, tokens, profiles, and activity. |
| [Secrets and proposals](./secrets.md) | Company/user credentials, grants, proposals, and vault import. |
| [Plugins](./plugins.md) | Installation/configuration, contributed pages/tools, and lifecycle. |
### Automation and structured work
| Feature | What it covers |
| --- | --- |
| [Routines, schedules, and triggers](./routines.md) | Definitions, variables, scheduled/webhook/manual runs, and history. |
| [Pipelines, review queues, and learnings](./pipelines.md) | Experimental stages, automation, items, review, and learning records. |
| [Cases](./cases.md) | Experimental structured fields, relationships, revisions, and task links. |
| [Status cards](./status-cards.md) | Experimental summaries, watched work, refresh history, and settings. |
### Oversight and operation
| Feature | What it covers |
| --- | --- |
| [Costs and budgets](./budgets-costs.md) | Spend reports, scoped limits, incidents, hard stops, and resumption. |
| [Dashboards and audit trails](./activity.md) | Company health, live work, activity, runs, routines, and timeline. |
| [Navigation, profile, and announcements](./navigation-preferences.md) | Sidebar state, favorites/recents, personal identity, and dismissals. |
| [Instance operations](./instance-operations.md) | Installation, updates, service health, configuration, and backups. |
| [CLI/API and local worktrees](./cli-operations.md) | Explicit context, resource commands, outputs, runs, and isolated instances. |
### Contributor surfaces
| Feature | What it covers |
| --- | --- |
| [Developer previews and diagnostic labs](./developer-labs.md) | Design examples, interaction fixtures, performance checks; not production acceptance. |
These are verification instructions, not a claim that every journey passed a live
test. A component test proves its component; a scripted provider proves that
fixture integration. Record executed results separately from the map.
## Before driving a journey
1. Use this checkout's [isolated test drive](../doc/DEVELOPING.md#one-command-isolated-manual-test-drive)
for manual product checks. It creates a temporary instance and prints its URL
and data directory. Do not guess that a server on port 3100 belongs to you.
2. Record the commit, URL, company, login role, relevant experimental settings,
adapter, runtime mode, and live versus simulated dependencies. Use disposable
tasks and provider resources. A fresh test drive creates a company and CEO,
but no task or first run.
3. Use the current navigation and company prefix. Paths in recipes omit that
prefix. Record whether the streamlined or production shell is selected;
Agent Chat, chat connectors, and the combined Inbox/Tasks view have separate
gates. A hidden surface is an unmet prerequisite, not a successful test.
4. Run the smallest relevant test first. Vitest commands below run from the
repository root after installing dependencies. Playwright recipes use their
named configuration and its isolated environment, not an unrelated running
instance. Reserve expensive runner/provider tests for the behavior at issue.
5. Exercise the actual user action, inspect its result, reload, and verify the
persisted state or continuation. Use read-only API checks to corroborate UI
evidence; creating state through the API does not prove the creation UI.
For agent-driven acceptance work, start with the
[Paperclip verification skill](../.agents/skills/verify-paperclip/SKILL.md) for an
isolated launch, ownership/readiness checks, browser driving, evidence, and cleanup.
It uses this directory as its feature map. The existing
[dev-workspace run/verify skill](../.agents/skills/paperclip-dev-workspace-run-verify-fix/SKILL.md)
and [evaluation skill](../.agents/skills/paperclip-evals/SKILL.md) describe runtime
ownership and evidence handling. Reuse them; this map introduces no environment
launcher, credentials, scheduled job, or second test framework.
## Evidence contract
Report each entry point as **passed**, **failed**, **blocked** (with its missing
prerequisite), or **not run**. Include the feature filename and entry-point ID,
commit/environment, user action, expected and observed result, command/exit code,
and evidence links. Screenshots or traces should show both the action and the
discriminating result. Include task/run/request IDs when relevant, without secrets.
A fix is verified across its affected surfaces only when each has evidence or
an explicit reason it does not apply. Shared code alone does not prove parity.
Keep product regressions visible; do not change the recipe to bless a failure.
For Paperclip-assigned work, attach evidence through the
[artifact workflow](../doc/AGENT-ARTIFACTS.md).
## Inventory and remaining depth
[The UI coverage inventory](./coverage.json) accounts for every non-test TSX
module under `ui/src/pages`, including supporting panels, legacy variants, and
labs. Every product area now links to concrete recipes. **Partial** means the
area still has the named variant or workflow gaps; **unmapped** is reserved for
an area with no recipe. These statuses describe documentation, not runtime health.
The page inventory is a source snapshot dated 2026-10-05. The map also
includes entry points hosted inside other modules (pipeline Review Queue and
Learnings, task documents, onboarding), CLI-only operations, and operator work.
The team recipe explicitly distinguishes the current CLI/API path from catalog
UI components without a current top-level route. Refer to [route registration](../ui/src/App.tsx)
and the [CLI registry](../cli/src/index.ts) when changing reachability.
Remaining depth includes complete provider/auth/attachment matrices, every
harness/model/environment capability combination, third-party plugin features,
and every role/error/mobile/legacy-shell permutation. The recipes name relevant
gaps instead of equating source presence with a working user journey. The index
can include capabilities that do not add a page file.
## Maintaining the reference
The map is documentation only. It adds no CI checks, automatic journey execution,
or required inventory updates for future pull requests.
When maintaining a recipe, compare its entry points and expected results with
the current source. Check that linked tests still exercise the stated behavior
and that local references still exist. Refresh the inventory snapshot when it
helps explain the current product. Maintenance is optional and review-based.
Each recipe starts with an H1 and a user-visible description, then exactly:
1. **Sub-features** — stable backticked IDs and observable behavior/states.
2. **How to get to it (user POV)** — one H3 backticked entry-point ID per surface.
3. **Driving it with <harness>** — starts with `Preconditions:`; repeat each entry-point H3,
with `Automated:` and `Manual:` paragraphs. Name test scope and gaps honestly.
4. **Gotchas** — misleading look-alikes, feature gates, and invalid evidence.
New or updated entries follow
[Poteto's feature-map examples](../.agents/skills/create-verification-skill/references/feature-map-example/).
Existing entries with a `Driving it` heading can adopt the named harness when
their recipes are updated. The original format was inspired by
[Omnigent's feature map](https://github.com/omnigent-ai/omnigent/tree/91acfbbb59f6fc210ff95a9e9428aadd62e06582/feature-map).
Paperclip's recipes and checks follow its own task model and test infrastructure.