Files
PaperClipAI/server/src/__tests__/paperclip-semantic-conformance.test.ts
T
Dotta 51ad751e0b feat(runner): integrate Codex native execution (#12616)
## Thinking Path

> - Paperclip is the open source control plane for teams of AI agents.
> - Agent runs currently use direct adapters and their established
finalization paths.
> - The new runner package needs one production integration before it
can execute a real provider through the server.
> - That integration must not change direct adapters or expose
unsupported providers.
> - The rollout must also preserve native runs that were already
recorded when the feature flag changes.
> - This pull request adds a default-off, Codex-only native execution
path and its authority boundary.
> - The benefit is a recoverable production vertical slice with explicit
compatibility guards.

## Linked Issues or Issue Description

**Subsystem affected**

Cross-cutting server orchestration and adapter selection.

**Problem or motivation**

The runner package exists, but the server cannot yet start and recover a
governed Codex run through it. A careless integration could also route
existing direct adapters into the native runtime or lose cancellation
and finalization state.

**Proposed solution**

Add a hidden `paperclip_runner` adapter for Codex. Keep it behind the
default-off instance flag. Bind native execution, resume, cancellation,
semantic tool authority, and finalization to the recorded company,
issue, run, and coordinator identities. Leave every direct adapter on
its existing path.

**Alternatives considered**

A multi-provider launch was rejected because only Codex has the complete
production bridge in this series. Replacing direct adapter execution was
rejected because the runner remains experimental.

**Roadmap alignment**

This work supports governed tool access, action attribution, and
self-healing runs. It keeps the integration narrow and default-off.

## What Changed

- Add the Codex-only native session executor and persisted resumption
path.
- Add run-scoped semantic tool projection, authorization, receipts, and
idempotency.
- Add audited native cancellation with durable issue and coordinator
binding.
- Add result fencing so a recorded result cannot reacquire the provider
and run twice.
- Reject fresh runner starts when the rollout flag is off while
preserving recorded native recovery.
- Keep direct adapters outside native status, cancellation, record
creation, and finalization.
- Add focused conformance, recovery, cancellation, status, portability,
and compatibility coverage.

## Verification

- GitHub Actions is the authoritative test environment for this large
stack.
- The PR policy and lightweight stack checks run while this is a middle
PR.
- The full required suite runs when this PR becomes the lowest unmerged
or top PR.
- Greptile will review this exact delta after the branch is pushed.

## Risks

- The main risk is routing a legacy adapter into native execution.
Runtime selection and heartbeat tests cover that boundary.
- The next risk is stale or cross-company cancellation. Durable binding
checks and transactional audit persistence cover it.
- The adapter remains hidden and default-off. Only Codex is admitted.
- There are no database migration, lockfile, or GitHub workflow changes
in this PR.

## Stack

1. [Runner package, SDK, and developer
tools](https://github.com/paperclipai/paperclip/pull/12608)
2. This PR: Codex production server integration
3. [Provider-neutral task-thread
UI](https://github.com/paperclipai/paperclip/pull/12617)

## Model Used

OpenAI Codex with GPT-5, extended reasoning, repository tools, and
parallel review agents.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [ ] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [ ] All Paperclip CI gates are green
- [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
2026-08-31 22:51:17 -05:00

101 lines
4.2 KiB
TypeScript

import { afterAll, beforeAll, describe, expect, it, vi } from "vitest";
import { createDb } from "@paperclipai/db";
import {
CAPABILITY_HIGH_RISK_SEMANTIC_VECTORS,
CAPABILITY_SEMANTIC_CONFORMANCE_IDS,
CapabilityMockSemanticConformanceAdapter,
runSemanticConformanceKit,
} from "../vendor/paperclip-runner/testing.js";
import {
getEmbeddedPostgresTestSupport,
startEmbeddedPostgresTestDatabase,
} from "./helpers/embedded-postgres.js";
import {
PaperclipProductionSemanticConformanceAdapter,
seedPaperclipSemanticConformance,
type PaperclipSemanticConformanceIds,
} from "./helpers/paperclip-semantic-conformance.js";
vi.hoisted(() => {
process.env.PAPERCLIP_HOME = "/tmp/paperclip-semantic-conformance-home";
process.env.PAPERCLIP_INSTANCE_ID = "semantic-conformance";
process.env.PAPERCLIP_LOG_DIR = "/tmp/paperclip-semantic-conformance-home/logs";
process.env.PAPERCLIP_IN_WORKTREE = "false";
});
const embeddedSupport = await getEmbeddedPostgresTestSupport();
const describeEmbedded = embeddedSupport.supported ? describe : describe.skip;
if (!embeddedSupport.supported) {
console.warn(`Skipping semantic production conformance: ${embeddedSupport.reason ?? "unsupported host"}`);
}
describeEmbedded("Paperclip semantic mock/production conformance", () => {
let temporary: Awaited<ReturnType<typeof startEmbeddedPostgresTestDatabase>> | null = null;
let mock: CapabilityMockSemanticConformanceAdapter | null = null;
const base = CAPABILITY_SEMANTIC_CONFORMANCE_IDS;
const ids: PaperclipSemanticConformanceIds = {
companyId: base.companyId,
actorId: base.actorId,
foreignCompanyId: "20000000-0000-4000-8000-000000000002",
foreignTaskId: base.foreignTaskId,
blockerTaskId: base.blockerTaskId,
worlds: {
default: { taskId: base.defaultTaskId, runId: base.defaultRunId, capabilities: [] },
"cross-company": {
taskId: base.crossCompanyTaskId,
runId: base.crossCompanyRunId,
capabilities: ["dependencies:write"],
},
interaction: { taskId: base.interactionTaskId, runId: base.interactionRunId, capabilities: [] },
"terminal-blocked": {
taskId: base.blockedTerminalTaskId,
runId: base.blockedTerminalRunId,
capabilities: [],
},
terminal: { taskId: base.terminalTaskId, runId: base.terminalRunId, capabilities: [] },
},
};
beforeAll(async () => {
temporary = await startEmbeddedPostgresTestDatabase("paperclip-semantic-conformance-");
const db = createDb(temporary.connectionString);
await seedPaperclipSemanticConformance(db, ids);
mock = await CapabilityMockSemanticConformanceAdapter.create();
}, 30_000);
afterAll(async () => {
await mock?.stop();
await temporary?.cleanup();
});
it("matches authorization, state, audit, retry, document, continuation, and terminal semantics", async () => {
if (!temporary || !mock) throw new Error("semantic_conformance_fixture_not_started");
const production = await PaperclipProductionSemanticConformanceAdapter.create(
createDb(temporary.connectionString),
ids,
);
const report = await runSemanticConformanceKit({
vectors: CAPABILITY_HIGH_RISK_SEMANTIC_VECTORS,
adapters: [mock, production],
});
expect(report.rows).toHaveLength(CAPABILITY_HIGH_RISK_SEMANTIC_VECTORS.length);
expect(report.rows.every((row) => row.adapterIds.join(",") === "capability-mock,paperclip-production-services"))
.toBe(true);
expect(report.rows.find((row) => row.vectorId === "progress-duplicate-retry")?.observation.audit)
.toEqual([]);
expect(report.rows.find((row) => row.vectorId === "document-stale-revision")?.observation.authorization)
.toEqual({ outcome: "denied", code: "document_revision_conflict" });
expect(report.rows.find((row) => row.vectorId === "continuation-request")?.observation.state)
.toMatchObject({ interactions: [{ continuationPolicy: "wake_assignee" }] });
expect(report.rows.find((row) => row.vectorId === "terminal-finish")?.observation.state)
.toMatchObject({ task: { status: "done" } });
expect(report.rows.every((row) => row.observation.receipt?.operationReceiptPresent === true))
.toBe(true);
}, 30_000);
});