mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-11-01 23:43:16 +01:00
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - The web server owns request handling and remote execution coordination. > - Deployment must start a ready replacement while the old server still serves. > - An outage test does not prove that two live servers can overlap safely. > - This pull request adds a separate Product E2E cell for that boundary. > - The existing run, file, recovery, and retained-session checks still apply. ## Linked Issues or Issue Description Refs #18518. The runtime prerequisite is merged; this PR qualifies its ephemeral server and deployment contracts. ## What Changed - Add the explicit `rolling-web-deployment` Codex Daytona workflow. - Start independent A/B/C homes and compiled builds behind a test ingress. - Wait for readiness before routing, then drain and delete the old home. - Observe active authority before handoff and use the existing read-only recovery oracle. - Require ordinary reads and saves to succeed throughout replacement. Read back every accepted save exactly once. - Preserve the five-minute outage suites and their existing validators. - Add a model-free supervisor smoke and an unready replacement control. - Require graceful exit before deleting an old home; forced cleanup cannot satisfy the oracle. - Preserve a durable Stop through lease release/expiry until the recovered execution owner acknowledges it. Permit only fenced reattachment of the original execution for Stop cleanup; submit no new turn. - Exclude events saved by A during shutdown from evidence of B making progress. ## Verification - E2E TypeScript check passed. - Affected harness checks: 143 passed. Catalog, fixture and report checks: 120 passed. - Actual supervisor smoke passed two replacements: 436 reads, 45 saves, zero request failures, and confirmed owned resource cleanup. - B became ready in 18.7 seconds; C became ready in 109.2 seconds. A prior C timeout remains failed evidence. - Fresh browser proof: 11 checks passed, 246 reads, 50 acknowledged saves, zero failures, 1,058ms reconnect, both old homes deleted and cleanup confirmed. - Stop lease-gap regression: three PostgreSQL delivery tests passed with a simulated provider edge. Current server TypeScript build/vendoring passed. - Full harness: 5,814 passed, 17 failed, four skipped. Two shutdown races passed the focused file; two report timeouts passed an isolated 42-test rerun. Onboarding/workflow-security/Pi/date-expired fixtures are unchanged on inspected master; the host embedded PostgreSQL fixture remains a setup limitation. This is not a green full local suite. - CI at `172509b8be` passed all gates. Greptile is 5/5 with every review thread resolved. The earlier access-service race failure passed its isolated regression and the subsequent full CI. - Final review corrections: six focused executor cases, three PostgreSQL command-delivery cases, 19 harness cases and server/E2E typechecks passed. - Three live attempts failed before agent creation: two harness setup gaps were fixed, then provider authentication failed. The saved OpenAI key returns 401; a refresh is pending. The Daytona probe reported cleanup uncertain, and no sandbox with that attempt label was found through the authenticated staging manager. No live model execution is claimed. - Live Runner overlap, released-container qualification and hosted deployment proof remain pending. Merging this opt-in qualification lane does not claim those results. ## Risks - The source lane shares workspace dependencies and does not establish container packaging correctness. - The live workflow needs an explicitly owned S3 bucket, PostgreSQL, pinned remote image and provider credentials. - Qualification cleanup stops all owned processes after failure. A failed replacement must not be reported as a pass. ## Model Used OpenAI Codex, GPT-6. Tool use, code execution and repository review. The runtime does not expose a more specific model ID or context-window size. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
60 lines
3.6 KiB
TypeScript
60 lines
3.6 KiB
TypeScript
import type { RunnerApi } from "./api.js";
|
|
import type { MatrixExecution } from "./types.js";
|
|
import { createHash } from "node:crypto";
|
|
import type { StoryCheck, StoryRun } from "./everyday-observations.js";
|
|
import { validControllerReplacementReceipt, type ControllerReplacementReceipt } from "./controller-replacement.js";
|
|
|
|
/** Only these explicit recovery definitions change the post-replacement user entry point. */
|
|
export function retainedControllerFollowupTransport(execution: Pick<MatrixExecution, "suite" | "task">): "browser" | "task_comment_api" {
|
|
return ["daytona-restart-continuity", "remote-workspace-storage", "rolling-web-deployment"].includes(execution.suite.id) && execution.task.id === "recover-controller"
|
|
&& execution.suite.definitionMetadata?.retainedControllerContinuation === true
|
|
&& execution.suite.definitionMetadata.retainedControllerFollowupTransport === "task_comment_api"
|
|
? "task_comment_api" : "browser";
|
|
}
|
|
|
|
export async function submitRetainedControllerComment(api: Pick<RunnerApi, "post">, issueId: string, body: string, clientRequestId: string) {
|
|
return api.post<{ id: string }>(`/api/issues/${issueId}/comments`, { body, reopen: true, clientRequestId });
|
|
}
|
|
|
|
export function onePersistedRetainedControllerComment(input: {
|
|
added: Array<{ id?: unknown; body?: unknown; authorAgentId?: unknown; authorType?: unknown }>;
|
|
commentId: string; body: string;
|
|
}) {
|
|
return typeof input.commentId === "string" && input.commentId.length > 0
|
|
&& input.added.length === 1 && input.added[0]?.id === input.commentId
|
|
&& input.added[0].body === input.body && !input.added[0].authorAgentId && input.added[0].authorType === "user";
|
|
}
|
|
|
|
const hash = (value: string | null | undefined) => value ? createHash("sha256").update(value).digest("hex") : null;
|
|
|
|
/** Public evidence keeps provider/session identifiers hashed. */
|
|
export function retainedControllerRun(run: StoryRun) {
|
|
return { runId: run.id, companyId: run.companyId, agentId: run.agentId, issueId: run.nativeIssueId,
|
|
status: run.status, runtimeMode: run.runtimeMode, finishedAt: run.finishedAt,
|
|
nativeSessionSha256: hash(run.nativeSessionId), providerSessionSha256: hash(run.sessionIdAfter) };
|
|
}
|
|
|
|
export function gradeRetainedControllerContinuation(input: {
|
|
before: ReturnType<typeof retainedControllerRun>;
|
|
after: ReturnType<typeof retainedControllerRun>;
|
|
outage: ControllerReplacementReceipt | undefined;
|
|
requestedAt: string;
|
|
completedTool: boolean;
|
|
usefulReply: boolean;
|
|
}): StoryCheck[] {
|
|
const { before, after, outage } = input;
|
|
const passed = validControllerReplacementReceipt(outage)
|
|
&& before.status === "succeeded" && after.status === "succeeded"
|
|
&& before.runtimeMode === "native" && after.runtimeMode === "native"
|
|
&& before.runId !== after.runId && before.companyId === after.companyId
|
|
&& before.agentId === after.agentId && before.issueId === after.issueId
|
|
&& Boolean(before.nativeSessionSha256) && before.nativeSessionSha256 === after.nativeSessionSha256
|
|
&& Boolean(before.providerSessionSha256) && before.providerSessionSha256 === after.providerSessionSha256
|
|
&& Date.parse(before.finishedAt ?? "") <= Date.parse(outage?.startedAt ?? "")
|
|
&& Date.parse(input.requestedAt) >= Date.parse(outage?.startedAt ?? "") + (outage?.readyAfterMs ?? Infinity)
|
|
&& Date.parse(after.finishedAt ?? "") >= Date.parse(input.requestedAt)
|
|
&& input.completedTool && input.usefulReply;
|
|
return [{ id: "retained-controller-continuation", passed,
|
|
detail: "After completion and another empty-cache replacement, a new native turn must use the same retained provider session and execute the saved project for a useful reply." }];
|
|
}
|