mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-17 01:25:26 +02:00
Devin FoleyandPaperclip
a0651c96f8
Expose process liveness without database or credential queries while preserving hostname and runtime identity guards. Deep health and sleep/wake readiness checks retain their existing behavior. Co-Authored-By: Paperclip <noreply@paperclip.ing>
139 lines
5.1 KiB
Markdown
139 lines
5.1 KiB
Markdown
# Installation, configuration, updates, and backups — agent access
|
|
|
|
Product map: [Installation, configuration, updates, and
|
|
backups](../feature-map/instance-operations.md).
|
|
|
|
Review date: 2026-10-12. Source commit: `f981fa3cc10cb8663a87dec60345fbff46d54d0a`.
|
|
|
|
This is a source-reviewed baseline of representative operations and known gaps.
|
|
Each capability needs operation-level review before its entire scope can be
|
|
qualified. No live agent execution is claimed. Follow the [map contract](../README.md)
|
|
for format, permission checks, evidence and maintenance.
|
|
|
|
## `install-update`
|
|
|
|
Review: `baseline`.
|
|
|
|
API: `not-applicable` — No uniform company REST updater API. Treat pre-start
|
|
installation as an operator exception or design an explicit delegated operator API.
|
|
|
|
Agent access: `operator-only` — Existing CLI install/update/rollback commands.
|
|
|
|
Policy: Local machine operator and instance-administrator authority; distinct from
|
|
company-scoped agent keys.
|
|
|
|
Evidence: `source-only` — [implementation](../../cli/src/index.ts#L91) at the reviewed
|
|
commit above.
|
|
|
|
Verification: `not-run` — exercise the listed local workflow in an authorized, owned
|
|
operator environment. Verify its isolation and result; do not count local machine
|
|
authority as company-agent API access.
|
|
|
|
Gaps: No uniform company REST updater API. Treat pre-start installation as an operator
|
|
exception or design an explicit delegated operator API.
|
|
|
|
## `server-service`
|
|
|
|
Review: `baseline`.
|
|
|
|
API: `present` — representative operation IDs:
|
|
|
|
- `GET /api/health`.
|
|
|
|
Agent access: `operator-only` — Existing CLI service/dev controls; health REST; owned
|
|
workspace services have separate agent APIs.
|
|
|
|
Policy: Local machine operator and instance-administrator authority; distinct from
|
|
company-scoped agent keys.
|
|
|
|
Evidence: `source-only` — [implementation](../../cli/src/index.ts#L91) at the reviewed
|
|
commit above.
|
|
|
|
Verification: `not-run` — exercise the listed local workflow in an authorized, owned
|
|
operator environment. Verify its isolation and result; do not count local machine
|
|
authority as company-agent API access.
|
|
|
|
Gaps: Instance start/stop and task workspace start/stop are different capabilities.
|
|
Local service control is not agent company authority.
|
|
|
|
## `configuration`
|
|
|
|
Review: `baseline`.
|
|
|
|
API: `present` — representative operation IDs:
|
|
|
|
- `GET /api/instance/settings`.
|
|
- `PATCH /api/instance/settings`.
|
|
|
|
Agent access: `restricted` — Board/admin instance settings; CLI configure/env; local
|
|
configuration files.
|
|
|
|
Policy: Local machine operator and instance-administrator authority; distinct from
|
|
company-scoped agent keys.
|
|
|
|
Evidence: `source-only` — [implementation](../../cli/src/index.ts#L91) at the reviewed
|
|
commit above.
|
|
|
|
Verification: `not-run` — assert the documented agent denial with an owned test fixture;
|
|
verify any listed agent request/result path separately. A delegated operation needs its
|
|
own policy and access review.
|
|
|
|
Gaps: Settings APIs cover parts of configuration; pre-start database/binding/storage
|
|
configuration is local operator tooling.
|
|
|
|
## `diagnostics`
|
|
|
|
Review: `baseline`.
|
|
|
|
API: `present` — representative operation IDs:
|
|
|
|
- `GET /api/health`.
|
|
- `GET /api/liveness` and `HEAD /api/liveness` — public process startup status
|
|
and build commit only; no database readiness or workspace identity.
|
|
|
|
Liveness is anonymous and runs before actor/session resolution. Hostname and
|
|
signed-bootstrap endpoint validation still apply. It grants no instance control
|
|
authority. [Liveness tests](../../server/src/__tests__/liveness.test.ts) cover idle
|
|
drain, invalid ambient credentials, unavailable SQL, and startup recovery with
|
|
local Express fixtures; no live provider or agent access is claimed.
|
|
|
|
Agent access: `partial` — REST health plus local CLI doctor.
|
|
|
|
Policy: Local machine operator and instance-administrator authority; distinct from
|
|
company-scoped agent keys.
|
|
|
|
Evidence: `source-only` — [implementation](../../cli/src/index.ts#L91) at the reviewed
|
|
commit above.
|
|
|
|
Verification: `not-run` — exercise a listed permitted operation with actual agent
|
|
credentials/run context; inspect its result and applicable persistence/attribution.
|
|
Assert the relevant denied actor, owner, company or mode from Policy. Review the
|
|
remaining operations before qualifying the whole capability.
|
|
|
|
Gaps: Health is an API; full local doctor/repair inspects host configuration and is not
|
|
equivalent to that response.
|
|
|
|
## `backup`
|
|
|
|
Review: `baseline`.
|
|
|
|
API: `present` — representative operation IDs:
|
|
|
|
- `POST /api/instance/database-backups`.
|
|
|
|
Agent access: `restricted` — Board/admin backup API; local CLI db:backup; restore into
|
|
an authorized separate target.
|
|
|
|
Policy: Local machine operator and instance-administrator authority; distinct from
|
|
company-scoped agent keys.
|
|
|
|
Evidence: `source-only` — [implementation](../../cli/src/index.ts#L91) at the reviewed
|
|
commit above.
|
|
|
|
Verification: `not-run` — assert the documented agent denial with an owned test fixture;
|
|
verify any listed agent request/result path separately. A delegated operation needs its
|
|
own policy and access review.
|
|
|
|
Gaps: API creation exists. Restore/lifecycle are operator workflows rather than ordinary
|
|
company agent capabilities.
|