mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-31 14:16:39 +01:00
Devin FoleyandPaperclip
88a35cf4e7
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - Native restart recovery decides whether an interrupted provider session can continue. > - An unusable checkpoint must stop provider replay. > - The failed run can still own a remote sandbox and files that need saving. > - The blocked restart path recorded failure but omitted the existing workspace preservation obligation. > - Saved user comments then waited for cleanup that had no file-recovery owner. > - This change records that obligation in the same transaction as the failure. ## Linked Issues or Issue Description **What happened?** A native run failed after its provider reported a terminal connection error. Restart recovery rejected its failed checkpoint and marked the run failed. Its prepared workspace and active sandbox lease had no preservation record. A later user continuation waited for the old environment to stop and could not start. **Expected behavior** When restart recovery blocks a run, preserve its exactly bound workspace through the existing stop-and-save service. Keep provider replay blocked. Stop proof and saved files must still precede any successor. **Steps to reproduce** 1. Prepare a native run with a remote workspace descriptor and its matching lease. 2. Persist a permanently failed provider checkpoint. 3. Run native restart recovery. 4. Observe a failed run with an active lease and no required workspace-recovery record. Refs #17801 and #17439. Those PRs add lease-settlement notifications and remote controller adoption. This change records the missing preservation obligation in the current restart failure producer. ## What Changed - Call the existing native workspace preservation service before the blocked restart transaction commits. - Keep the existing company, coordinator ownership, source lease and descriptor checks. - Add real PostgreSQL cases for exact binding, an unrelated source, a live owner, and rollback when preservation cannot commit. - Verify that preservation creates no replacement run or wake and retains the provider attempt count. - Document the transaction and recovery contract. ## Verification - Updated the existing branch with master at `09c05c55050fede448196637cbaa543a154da76e`. Both sides of the overlapping test additions remain. The production fix is still two added lines. - Current source verification: macOS arm64, Node 25.6.1, and disposable Homebrew PostgreSQL 16.14. No deployment or live task replay was performed for this branch update. - **113 tests pass** across `native-failed-workspace-recovery.test.ts` and `native-restart-recovery.test.ts`. Run them with `PAPERCLIP_TEST_DATABASE_URL` set to a disposable database ending in `_test`. Coverage includes exact source binding, live-owner protection, transaction rollback, no replacement run or wake, cancellation preservation, and orphan preservation. - Full local `pnpm -r typecheck` and `pnpm build` pass. Map checks, module-boundary checks, and the PR diff whitespace check pass. - Local verification limits remain explicit. The embedded PostgreSQL probe fails during `initdb`. The full `pnpm test:run` invocation hit that startup failure and was stopped. A broader restart integration invocation against disposable PostgreSQL did not finish while checkpoint-backlog work remained pending and was stopped. Neither invocation is a passing acceptance result. Hosted CI must qualify the updated head. - Prior-head evidence retained: the preservation regression first failed because its required fields were absent. The original verification passed 105 locally available cases and skipped nine real-runner process cases because the local binaries were unavailable. Previous-head hosted CI passed full typecheck/build, test shards, Runner checks, and browser shards. Those results do not qualify the updated head. - Prior live-repair evidence retained: an audited call to the existing preservation service registered the missing obligation for an exactly bound source. Normal workers confirmed termination, released the source lease, and preserved the prepared files before an assigned continuation started. This was an earlier repair, not acceptance of the current branch update. - Updated-head hosted CI passes on `a22feeb54daa2e9325a55d0ccd86515e64cbd47d`, including typecheck/build, all test shards, Runner checks, and browser shards. Apex is 5/5 on the same commit with no actionable findings or unresolved review threads. GitHub reports a clean merge state. The patch is not deployed. The original provider connection failure remains unexplained by this change. ## Risks - Preservation adds database work only when a restart classification becomes terminal. It adds no recurring scan or timer. - A failed preservation write now rolls back failure settlement. The existing owner can retry instead of leaving cleanup without an owner. - A live coordinator or mismatched source remains protected. This change neither destroys the sandbox nor starts provider work in the recovery transaction. - Existing cleanup must still prove termination and preserve files. A terminal run alone does not authorize continuation. ## Model Used OpenAI `gpt-6.1-sol` through Codex in T3 Code, with xhigh reasoning effort, repository inspection, tool use, and code execution. The runtime does not report the context-window size. Earlier implementation used the OpenAI Codex model recorded in the PR history. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge Co-authored-by: Paperclip <noreply@paperclip.ing>