DottaandPaperclip
d3f2a60e79
## Thinking Path > - Paperclip manages agents and their work. > - Product E2E tests verify work through the browser and public APIs. > - The classic matrix already tests several common task stories. > - Its older stories depend on local fixture setup and workspace access. > - Deployment tests need the same story checks with a separate target adapter. > - This PR shares those checks and adds five explicit journey selections. > - A deployment pass still requires evidence from that deployment. ## Linked Issues or Issue Description **What existing behavior does this improve?** Product E2E journey reuse across managed instances and deployed Cloud instances. **Current behavior** The deployed-target catalog covers task creation, assignment, Ask, and fresh onboarding. Plan revision and Everyday stories run through the classic fixture driver. Several story steps assume a local workspace. **Proposed behavior** Add explicit Plan revision, artifact revision, protected-action approval and decline, Skill Studio, and Stop/redirect journeys. Share the main browser sequences and content checks with the classic driver. Let target adapters provide authentication, native agents, a reachable service fixture, and owned cleanup. **Reason and benefit** A local pass cannot verify the deployed application. Shared story code lets a deployed target exercise the same behavior without copying an entire test or starting a replacement server. **Breaking changes** No product API or default matrix selection changes. Passed deployment results must satisfy the declared story checks and work-run count. Unsupported target capabilities fail before a story runs. Related public work: #17262 and #18098. Upstream prerequisite: #18230. ## What Changed - Extract shared Plan, artifact download/oracle, protected service, Skill Studio, and Stop/redirect helpers. Keep classic callers on those helpers. - Add five explicit paid journey selections with owned-task observations and native company, agent, model, and environment checks. - Include classic prompts, delivery/decision code, and the decline grader in the source-definition hash. Keep classic transient-read retries and reject deployment binding failures immediately. Match cookie directory boundaries in sensitive fixture requests. - Require complete story checks and expected run receipts before retaining a passing result. Keep failed evidence and private downloads. - Add a secret-safe request method for deployment fixture credentials. Add the missing declaration for the existing manual evidence policy module so the E2E project can typecheck. - Document target responsibilities and promotion after a real deployment pass. This source catalog does not enroll candidates in a daily plan. ## Verification - E2E TypeScript check: passed, including the review follow-up. - Review follow-up: 30 tests passed across four files, covering transient Plan reads, immediate binding rejection, cookie-path scope, agent receipts, and artifact evidence. Stop now waits for a saved, still-active native turn before the browser click and retains its startup events. Counterexamples reject claimed-but-unstarted, already-completed, interrupted, and non-native work. Shared observation and API helpers also enter the definition fingerprint. Cancellation snapshots are captured before lease cleanup. A direct terminal-boundary assertion rejects native work after cancellation even if it is already in the first snapshot; five cleanup-window counterexamples are covered. The Stop-output regression first failed for both native `item.delta` and `item.completed`; the fixed check detects both while allowing accounting-only updates. A report-catalog test first failed because the sandbox denied the tsx child IPC pipe (`listen EPERM`); the unchanged test passed outside the sandbox. - Affected journey, catalog, API, service fixture, and delivery checks: 313 tests passed across 19 files. - Workspace build: passed after rebase. - Workspace typecheck: passed. The default repository run was attempted. Repeated embedded PostgreSQL startup failures prevented local database coverage; it was stopped without claiming a full pass. Linux CI must supply that coverage. - Broad E2E support run: 4,793 passed, 23 failed, 2 skipped. Failures include existing stale image/Pi assertions and process/startup timeouts under host load. The affected tests pass separately. This is not a claim that the broad suite is green. - Upstream CI prerequisites: this branch is rebased on the merged #18230 repair. The earlier conflicting Turbo flags no longer apply. The shell-hook fix is also supplied by that upstream change. Linux shell-hook investigation: 19 focused tests and adapter TypeScript passed. The exact staged-config sequence reproduced CI's 500 in a pinned Node 24 Linux container. Node's default stdin socket at shell level zero selects Bash remote-shell startup and reads `.bashrc` instead of `BASH_ENV`. Ignored stdin and a nested shell each produce 1000. The fixture now ignores stdin; the production hook and 1000 assertion are unchanged. See [Bash startup rules](https://www.gnu.org/software/bash/manual/html_node/Bash-Startup-Files). - GitHub CI on the earlier head passed most suites but failed two browser tests (a fixture cleanup lock timeout and a fixture run staying queued) plus the shell-hook assertion. The lock-timeout case received one retry, which was cancelled by a later source push and does not establish recovery. These failures remain part of the verification record. - Real Cloud qualification: the private target adapter is reviewed and merged. These candidates must pass there before daily-plan promotion. Current source review: Greptile 5/5 and Paperclip Review 5/5 on `a9df1d6e8d880710fce39b87e689e07e1c8e6edc`, with zero unresolved review threads. The full [GitHub CI run](https://github.com/paperclipai/paperclip/actions/runs/40974946081) passed on that exact head, including both required aggregate checks. ## Risks Shared helper changes affect classic callers. The independent ZIP oracle and visible delivery requirements remain in place. Stop requires native acknowledgement, terminal event evidence, resource cleanup, and no later original-turn activity. The managed local target still lacks paid-agent fixtures and reports these journeys as unsupported. ## Model Used OpenAI Codex, GPT-6 family, with reasoning, terminal use, and code execution. The exact serving model ID and context window are not exposed to this session. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
12 KiB
navigation
| navigation | ||||||
|---|---|---|---|---|---|---|
|
Steering and queued messages
People can send follow-ups while an agent works, manage saved messages that have not been consumed, and choose when to steer or interrupt. Stopping a run and pausing a task are separate controls. The UI must preserve the message, explain why it is waiting, and only claim delivery after an authoritative acknowledgement.
Feature ID: steering.
Agent access: companion.
Sub-features
queue:steering/queue— a busy task saves follow-ups and shows their order and wait reason.edit-order-discard:steering/edit-order-discard— edit full Markdown, reorder, and discard eligible saved messages; ownership, revision conflicts, and already-dispatched states matter.steer:steering/steer— explicit user action sends a queued message into a compatible active run; unavailable capabilities and provider rejection remain visible.interrupt:steering/interrupt— stop the current execution and carry accepted follow-ups into the eligible continuation without delivering them twice.stop-and-pause:steering/stop-and-pause— distinguish stop-in-flight, confirmed stop, task/ancestor pause, agent pause, and budget hold. Resume must respect the actual gate.drafts:steering/drafts— switching tasks, reloading, and uncertain submission retain the correct task's draft and attachment receipts.approval-queue:steering/approval-queue— answered questions and accepted approvals have durable delivery distinct from editable ordinary comments.
How to get to it (user POV)
task-composer
Open an assigned task (/issues/:issueId). Start work, then send follow-ups while
the agent runs. Use the queued-message controls to edit, reorder, discard,
steer, or interrupt when offered. After Stop, choose Send on a saved queue to explicitly continue it without recreating the messages or attachments. Native steering still requires an active turn; Send after Stop is a separate user decision. Use the composer stop/pause control separately.
Both task presentations need attention when changing their shared behavior.
agent-chat
Enable Agent Chat and open an agent conversation. Send another message during
a reply and inspect the shared queue. /new starts fresh provider context in
the same conversation; it is an ordered boundary, not a normal model prompt.
request-response
Answer an earlier question or accept a confirmation while successor work is active on the task. Inspect the resulting queued response and its available steer/interrupt control instead of assuming acceptance interrupted execution.
external-channel
Send a follow-up from a linked external chat conversation while its task is running. Use that provider's supported stop/control affordance where available; inspect the resulting task and run in Paperclip.
Driving it
The explicit stop-redirect Product journey covers steering/stop-and-pause only for Stop and one new direction. It requires active work, native cancellation acknowledgement, resource cleanup, and completion without later original-turn activity. It does not qualify pause, interrupt, or all queued-message behavior. Source registration is not a live Cloud pass.
Preconditions: follow the baseline. Use an agent that stays busy long enough to inspect the queue. Record the adapter, native/legacy mode, and advertised steering capability. Test supported and unsupported steering without treating an absent capability as a product failure.
task-composer
Automated: queued-message UI covers order, failure restoration, unavailable steering, stale revisions, and discard acknowledgements. Queue routes cover durable ordering, authorization, steering acknowledgements, interrupt recovery, and concurrent dispatch. Composer covers drafts and uncertain saves.
Task-detail delivery races cover a consumed message whose send response and queue snapshot arrive late. A started run's input receipt removes that message from pending, while a separate unsent message stays queued. Admission to a run that has not started is not delivery. A later retry of the same message remains visible in its new authoritative queue. A queued turn's own starting input stays in history before execution, including board messages that reopen a task. Later inputs keep their queue controls and full canonical order. A maintenance hold displays its current admission wait; drain release and expiry prompt normal admission without a manual retry. Receipts retain the primary wake and coalesced source queue IDs. They clear a late snapshot even when its target names the preceding run or is null.
pnpm exec vitest run ui/src/components/task-chat/TaskChatQueuedMessages.test.tsx server/src/__tests__/issue-queued-comments-routes.test.ts
Automated stop coverage is separate: composer stop with its configuration and ACP stop/continuation. Inspect their fixture and opt-in prerequisites; skipped native cases are not native proof. The explicit follow-up/Stop/resume journey requires a later user message before continuation. The database Stop accounting regression checks complete and late receipts without another provider turn. These are separate scopes; database success does not establish deployed or Slack acceptance.
Manual: queue three distinguishable messages. Edit one, reorder them, reload, and confirm the saved order. Discard one and confirm it never reaches execution. After a queued message enters a started run, confirm it leaves pending even if the send response arrives later. Reload and confirm it appears once in history. Steer one while busy and verify the agent receives that exact message once. Repeat with a rejected steer and a stale second-tab edit; the UI must preserve retryable content and explain the conflict. On a fresh run, interrupt with a queued follow-up and verify confirmed stop followed by one continuation. Pause the task (and separately its ancestor), preserve a draft, then resume the actual hold; no hidden send should occur while paused. Check both task presentations when available; the named component tests do not prove every host integration.
Fixture-backed recovery check: start with an agent in its completed paused
lifecycle state, then insert a new accepted deferred_issue_execution request
through the PostgreSQL recovery fixture.
Normal wake admission
rejects paused agents, so this pending state cannot be created by sending a new
message through the ordinary UI or API. Let release and periodic recovery run.
Confirm that the saved request remains pending. Resume the agent, wait for its
lifecycle to become ready, and verify one delivery. An explicit Pause cancels
older queued work; those cancelled receipts must not be replayed. A paused
request must not prevent another eligible recipient's queued work from proceeding.
agent-chat
Automated: agent chat sessions covers persistent conversation/session behavior with deterministic harness fixtures; shared composer tests cover the controls. These do not qualify live steering for every harness.
Manual: queue two follow-ups while the conversation replies. Reload, edit or
discard one, then let the other run. Verify one reply and unchanged conversation
identity. Send /new, then a new prompt; old history remains visible, and the
new turn uses fresh provider context. Verify a useful answer rather than only
the session-divider UI. Repeat the queue operations with a live capable harness
when the change touches delivery.
request-response
Automated: response delivery proves queueing/coalescing and retry-safe receipts. The queue-route suite tests separate comment and approval queues, explicit steering, and fresh-session restrictions on plan approvals.
Manual: answer an old question during a new run, confirm that it is saved and queued, and let the active run end. Verify exactly one continuation with the answer. Repeat an eligible approval with explicit steer; another approval that requires a fresh session must not offer same-turn delivery. Do not edit an approval outcome through an ordinary queued-message editor.
external-channel
Automated: chat interaction arbitration covers backend arbitration with simulated requests. It is not a provider UI test.
Manual: send two distinguishable messages through one disposable linked conversation while busy. Inspect their saved task order, run delivery, and external reply. Check a duplicate provider event and unauthorized sender. Provider-specific control semantics and real transport timing remain a manual gap; do not assume browser queue controls are available in every channel.
Gotchas
- Paperclip's queue is server-owned once saved; it is not Omnigent's unsent browser draft buffer. A stale edit must not overwrite a consumed message.
- Steer availability depends on the active runtime's capability, not its brand name. A UI row disappearing optimistically does not prove provider receipt.
- Interrupt, stop, task pause, agent pause, and budget pause have different effects. A running indicator disappearing does not prove remote work stopped.
- An interrupted run may need verified cleanup before a saved follow-up can start. Preserve and inspect the wait reason; see recovery.
- A healthy idle Agent Chat is waiting for input, not stranded unfinished work.
Storybook verification
drafts
Capability ID: steering/drafts.
Scope: ui Storybook: Task-keyed restored draft and attachment receipts; task switch/reload, failed send and uncertain-save recovery. Production: Retain correct task draft across navigation and reload; inspect authoritative saved receipt before claiming delivery; do not clear storage on every harness mount. Sources: Source: TaskChatComposer.tsx, composer-draft.ts. Tests: TaskChatComposer.test.tsx, issue-queued-comments-routes.test.ts
approval-queue
Capability ID: steering/approval-queue.
Scope: ui Storybook: Answered question/accepted approval delivery waiting, eligible steer/interrupt, failed delivery and fresh-session-only approval. Production: Keep response delivery durable and distinct from editable comments; coalesce once, enforce fresh-session restrictions and deduplicate concurrent/retried continuation. Sources: Source: TaskChatQueuedMessages.tsx, question-response-delivery.ts. Tests: TaskChatQueuedMessages.test.tsx, question-response-delivery.test.ts, issue-queued-comments-routes.test.ts