Jannik/PaperClipAI
1
0 Fork 0
mirror of https://github.com/paperclipai/paperclip.git synced 2026-11-01 23:43:16 +01:00
Code Issues Packages Projects Releases Wiki Activity
Files
ab0b15d234ef9bfbb3728fa97a5e2fe9a8d0c1de
PaperClipAI/packages/paperclip-runner/spec/operation-groups/source.json
T
DottaandPaperclip 8ff812cdde feat(chat): deliver proactive task messages to agent chats (#18374) 
## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work.
> - Agent Chat gives each person a persistent conversation with each
agent.
> - Tasks and routines produce results outside that conversation.
> - Those runs need a safe way to bring a requested result back to the
person.
> - The server must select the agent's own chat and check the source
task's access rules.
> - This pull request adds proactive chat messages and unread
indicators.
> - People can see the result, open its source task, and reply in the
same chat.

## Linked Issues or Issue Description

**Subsystem affected**

Server, native runner tools, shared contracts, database, and UI.

**Problem or motivation**

An agent can report progress on a task or comment on an authorized task.
It cannot send a routine result to its own standing chat with the
responsible person. A morning review routine therefore cannot leave a
visible digest in that person's chat.

**Proposed solution**

Add `send_chat_message({body, idempotencyKey})` and `POST
/api/agents/me/chat/messages`. The server selects the company, agent,
and responsible person from the active run. It saves an attributed
comment and audit record in one transaction. The chat shows a
source-task link and per-person unread state.

**Alternatives considered**

A destination parameter on a generic comment tool would expose
unnecessary routing authority. A new delivery worker would add another
durable delivery path. This change uses a dedicated tool and the
existing comment and live-event paths.

**Roadmap alignment**

This extends the experimental Agent Chat capability in `ROADMAP.md`. The
existing `enableAgentChat` setting controls it. Related public work:
Refs #13282, Refs #13283, and Refs #14408. Searches for proactive chat
and unread chat found no duplicate PR.

## What Changed

- Add a focused messaging service shared by the native tool and HTTP
route. It checks current run ownership, execution mode, recipient
membership, task access, and task privacy.
- Reuse the canonical company/agent/person conversation. Save the
comment and audit record together. Keep task completion and chat
execution separate from delivery.
- Add source-task provenance and source-scoped retry keys. Identical
retries return the saved receipt. Changed content returns a conflict.
- Enforce the conversation's fixed agent at the shared comment-write
boundary. Keep normal reply cancellation and session checks.
- Add chat unread state, accessible agent dots, aggregate Chat
indicators, and visible-message read cutoffs. Refresh through existing
live events.
- Add the request-key constraint, native tool contracts, documentation,
capability maps, stories, and regression coverage.

## Verification

- Local delivery/security proof: all 38 proactive-message cases pass.
Eight credential-scope regressions and four quota regressions fail
against the prior source. The repaired delivery and canonical
cross-issue cap suites pass all 49 cases; all 31 OpenAPI tests, server
typecheck, and capability-map checks pass. The shared per-run cap covers
native and HTTP sends, mixed ordinary mutations, concurrent last-slot
contention, and retry/recovery without double charging.
- Credential tests preserve the authenticated person and authorizer;
reject bridge/test credentials and persisted skill-test runs after
task-mode changes; and recheck API-key revocation, scope, and
responsible person after destination locking. The earlier
delivery/native-authority suites passed all 74 cases before the four
quota additions.
- Four PostgreSQL contention cases cover native and HTTP sends plus
retries during a native chat mutation. All four deadlock against the
earlier source and pass with destination-before-source/run locking.
Recovery and human-reply delivery enqueue only the human comment; a
proactive digest never wakes the chat agent.
- Passed 108 companion conversation, native-authority, and OpenAPI
tests; 112 runner catalog/workflow-report tests; 47 completion-delivery
tests; and 25 project-handoff tests. Focused runner tests cover native
tool availability without generic API tools.
- All 327 affected UI tests, UI typecheck, token gates, and catalog
checks pass. The read hook retries at most three times, respects server
retry delay, coalesces only seen cutoffs, recovers on reconnect, and
cancels on scope changes.
- Real browser journeys with a deterministic process agent verify
routine-to-chat delivery, first-chat creation, unread state across
reload, the source link, secondary chat navigation, and a follow-up
reply referring to the digest. This does not qualify live GitHub
retrieval or model output quality.
- The Storybook showcase uses production components with deterministic
network fixtures. Rendered interactions pass for the landing, ordinary
read success, transient read recovery, and persistent failure after
bounded retries. Both Chat navigation variants update from two unread
chats to one while only Kodi's dot clears. Mobile and light variants
were reviewed. The existing Coordinator Recents label contrast finding
is unchanged; no Linux visual baseline archive exists.
- Current master's independent sandbox migration retains 0418.
Regenerated the feature migration as 0419 from the combined schema and
retained exactly the newest five snapshots; numbering/safety, replay,
and schema-drift checks pass.
- Workspace typecheck and build passed before PR preparation; canonical
server/UI typechecks passed again on the combined tree. Migration
`0419_slippery_impossible_man.sql` passes safety and schema drift checks
on disposable PostgreSQL, including interrupted index repair, concurrent
migrators, one-time owner read-state backfill, preserved receipts, and
two SQL replays. A default five-second local snapshot comparison timed
out; a diagnostic 30-second run passed without drift.
- Earlier failures are retained in the record: full local `pnpm
test:run` and broad shards encountered embedded-PostgreSQL startup,
timing, and provider-recovery failures. Thirteen selected
external-channel cases pass in isolation on the original and changed
sources; an unordered comment-row assertion now explicitly orders both
reads. The earlier route registry, native tool count, runner catalog,
and accessible Chat badge-name failures were fixed and passed full
remote CI on `920b3bb7db`.
- Repeated managed-skill server8 failures came from CI's newer synthetic
merge: its Cloud guard correctly rejected the old local-disk fixture.
Master independently repaired the fixture in #18385; this branch keeps
that repair unchanged. All 57 managed-skill and Cloud prerequisite cases
pass on the combined tree, and that fixture has no remaining PR diff.
- Current reviewed head `dc16f314739a6d977bed21cb1446d0e80a541578`:
Greptile 5/5 with no findings, Superagent security assessment passed,
advisory Paperclip Review 5/5 with no findings, and zero open review
threads. All 55 current-head check runs pass, with five expected skips
and the advisory review neutral at 5/5; Snyk also passes. No checks are
pending or failing. Protected squash auto-merge is enabled and is
waiting for required code-owner approval. A normal exact-head merge was
refused by the base-branch policy; no admin bypass was used. The
previous head's Superagent quota finding is fixed and covered above.

## Risks

- Chat remains company-visible. Delivery rejects a source task with
private-task, project, or ancestor restrictions.
- Read state uses a comment timestamp cutoff. The server retains
database precision and never moves a read receipt backward.
- The new unique constraint changes comment query planning. An existing
regression now uses an explicit row order. The migration builds the
unique index concurrently, then takes a brief table lock to attach it.
It uses the existing top-level migration and interrupted-index recovery
path.
- The upgrade backfills missing chat-owner read-state rows at the latest
existing agent comment. Existing read receipts remain intact. New chats
can still be unread before the human participates.
- Quota observation commits atomically with delivery. A rejected send
rolls back its attempted denial audit row and any first-chat creation;
the canonical warning remains in server logs, and previously spent quota
remains enforced. Identical/conflicting retries and receipt recovery
spend no extra slot.
- This version delivers in-app only. It adds no external-channel, push,
or email delivery.
- Local full-suite acceptance remains limited by the failures recorded
above. The feature stays behind `enableAgentChat`.

## Model Used

OpenAI Codex. PR preparation and CI work used `gpt-6.1-sol` with tool
use and code execution. The earlier implementation also used Codex, but
its exact model ID was not recorded in the visible session. The
context-window size was not provided.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run focused tests locally and they pass; the broad local
failures are recorded above
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

---------

Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-10-30 21:39:07 -05:00

814 lines
31 KiB
JSON
Raw Blame History

{
"schemaVersion": 1,
"documentTitle": "Paperclip agent operation groups",
"evalRepositoryUrl": "https://github.com/paperclipai/paperclip-evals/blob/master/",
"prpEventFamilyDescriptions": {
"runner": "Runner connection, drain, and diagnostic lifecycle.",
"runtime": "Runner phase transitions and run-scoped reported activity.",
"sandbox": "Sandbox resource measurements.",
"workspace": "Workspace readiness.",
"harness": "Provider harness startup, readiness, exit, and diagnostics.",
"auth": "Content-free harness credential changes observed by the runner.",
"session": "Provider-neutral session open, resume, reconciliation, close, and failure.",
"turn": "Model turn submission through terminal turn disposition.",
"item": "Provider-neutral model/tool item lifecycle.",
"mcp_app": "MCP App discovery, initialization, tool, action, host-context, and teardown evidence.",
"runtime_request": "Runtime permission/input request lifecycle.",
"interaction": "Issue-thread interaction proposal, materialization, response, delivery, and rejection.",
"run": "Structured result negotiation and terminal run outcome.",
"attention": "Continuation and attention routing lifecycle.",
"work": "Recorded work-assessment evidence.",
"issue": "Issue-status decision proposal outcome and application evidence.",
"plan": "Complete provider-authored within-turn checklist snapshots, separate from durable Paperclip Plan documents.",
"tool": "Provider-neutral process, MCP, dynamic, and built-in execution activity.",
"research": "Provider-reported search, page-open, and in-page research activity.",
"delegation": "Child-agent delegation lifecycle and aggregate status.",
"model": "Requested/effective model routing and verification state.",
"context": "Context-window compaction markers without hidden summaries.",
"artifact": "Authorized artifact viewing and structured generated outputs.",
"review": "Provider review-mode state, separate from Paperclip authority.",
"hook": "Bounded provider hook lifecycle and blocking outcomes.",
"memory": "Authorized or unavailable memory citation references.",
"safety": "Provider safety review state attached to governed work.",
"terminal": "Content-free terminal input activity metadata.",
"wait": "Intentional provider waits, distinct from warm idle and human input.",
"provider": "Redacted provider notices and actionable warnings.",
"semantic_tool": "Canonical authorized Paperclip tool input and result evidence.",
"usage": "Provider/model-attributed usage and accounting boundaries."
},
"prpCommandFamilyDescriptions": {
"semantic_tool": "Returns an authorized, correlated Paperclip tool result to the provider through runnerd.",
"run": "Prepare or cancel a run.",
"session": "Open, snapshot, or close a normalized provider session.",
"turn": "Start, steer, interrupt, or stop a model turn.",
"request": "Resolve a pending runtime request.",
"interaction": "Acknowledge delivery of an interaction response.",
"runner": "Drain or shut down the runner process."
},
"optionalGrantGroups": [
{
"id": "feedback",
"description": "Internally attributed complaints and improvement suggestions; no additional grant required beyond active run authority.",
"operationIds": [
"submit_complaint",
"submit_suggestion"
]
},
{
"id": "discovery",
"description": "Company-visible task, agent, project, and goal discovery.",
"operationIds": [
"search_tasks",
"list_agents",
"get_agent",
"list_projects",
"list_goals",
"set_task_title"
]
},
{
"id": "projects",
"description": "Project creation and authorized repository discovery through the live company/run authority.",
"operationIds": [
"create_project",
"list_project_repositories"
]
},
{
"id": "delegation_dependencies",
"description": "Create or reassign delegated work and maintain dependency edges.",
"operationIds": [
"create_task",
"reassign_task",
"set_dependencies",
"hire_agent"
]
},
{
"id": "governance",
"description": "Read, request, comment on, and decide approvals under governed-action checks.",
"operationIds": [
"list_approvals",
"get_approval",
"get_approval_context",
"request_approval",
"decide_approval",
"comment_on_approval"
]
},
{
"id": "cases",
"description": "Read and update authorized case facts and revisioned documents, author company workflow prompts, and durably hand off the primary task. list_cases and upsert_case remain scenario mocks.",
"operationIds": [
"list_cases",
"upsert_case",
"create_case",
"read_case",
"update_case",
"list_workflows",
"read_workflow",
"create_workflow",
"update_workflow",
"handoff_case"
]
},
{
"id": "workspace_runtime",
"description": "Inspect and select task workspaces, prepare repositories, and control workspace runtime services.",
"operationIds": [
"get_workspace_runtime",
"control_workspace_service",
"get_workspace",
"list_workspaces",
"select_workspace",
"prepare_repository"
]
},
{
"id": "wake_scheduling",
"description": "Schedule a bounded continuation wake when the current task owns the future check.",
"operationIds": [
"schedule_wake",
"set_task_monitor"
]
},
{
"id": "routines",
"description": "Inspect or manage company routines.",
"operationIds": [
"list_routines",
"manage_routine"
]
},
{
"id": "company_skills",
"description": "Create, update, or inspect company skills and synchronize the current agent's skills.",
"operationIds": [
"create_skill",
"update_skill",
"list_company_skills",
"sync_company_skills"
]
},
{
"id": "secrets",
"description": "Inspect secret metadata or use a brokered secret value without exposing plaintext evidence.",
"operationIds": [
"list_secret_metadata",
"read_secret_value"
]
},
{
"id": "portability_admin",
"description": "Export portable company state; broad administration remains deferred until split into governed operations.",
"operationIds": [
"export_company",
"administer_company"
]
},
{
"id": "test_escape_hatch",
"description": "Controlled skill-test transport only; never product coverage.",
"operationIds": [
"generic_api_request"
]
},
{
"id": "api_fallback",
"description": "Discover and invoke HTTP API operations unsupported by available dedicated tools. Production authority and route authorization remain required.",
"operationIds": [
"search_api",
"call_api"
]
}
],
"behaviorGroups": [
{
"id": "hb",
"legacyGroup": 1,
"name": "Heartbeat",
"owner": "control plane + always tools",
"operationIds": [
"get_task_context",
"set_task_title"
],
"controlPlaneOperationIds": [
"select_work",
"enforce_budget"
],
"realSurface": "agent identity, inbox-lite, heartbeat context, budget and active-issue services",
"mockStateDomains": [
"company",
"actor",
"wake",
"task",
"budget",
"run"
],
"prpEvidence": "runner/session/run context plus bounded task-context tool results",
"gap": "Production semantic binding is unbound; identity and work selection remain injected/control-plane-owned."
},
{
"id": "co",
"legacyGroup": 2,
"name": "Checkout",
"owner": "control plane",
"operationIds": [],
"controlPlaneOperationIds": [
"checkout_task"
],
"realSurface": "POST /api/issues/:id/checkout and execution-lock services",
"mockStateDomains": [
"task",
"actor",
"run",
"idempotency",
"fault"
],
"prpEvidence": "run preparation and issue-status decision evidence with checkout receipt",
"gap": "Intentionally no model tool; the production checkout receipt still needs the additive semantic-receipt envelope."
},
{
"id": "st",
"legacyGroup": 3,
"name": "Status",
"owner": "always tools + control-plane arbitration",
"operationIds": [
"answer_status_question",
"finish_task",
"block_task",
"request_review"
],
"controlPlaneOperationIds": [
"reconcile_run",
"append_audit_record"
],
"realSurface": "issue PATCH, review/liveness policy, and native finalization arbitration",
"mockStateDomains": [
"task",
"comments",
"interactions",
"blockers",
"audit",
"run"
],
"prpEvidence": "semantic operation receipt, work assessment, issue-status decision, and terminal causality",
"gap": "Production semantic binding and additive typed operation/conflict receipts remain unimplemented."
},
{
"id": "cm",
"legacyGroup": 4,
"name": "Comments",
"owner": "always tools",
"operationIds": [
"get_task_history",
"report_progress",
"send_chat_message"
],
"controlPlaneOperationIds": [
"append_audit_record"
],
"realSurface": "issue comment list/get/create routes and own-agent chat messaging service",
"mockStateDomains": [
"task",
"comments",
"actor",
"idempotency",
"audit"
],
"prpEvidence": "bounded read result, idempotent progress receipt, or persisted proactive chat comment with source task/run provenance",
"gap": "Proactive chat delivery is bound to the running agent and responsible human; arbitrary chat destinations are unsupported. Other comment/history binding gaps remain recorded per operation."
},
{
"id": "se",
"legacyGroup": 5,
"name": "Search",
"owner": "optional discovery tools",
"operationIds": [
"search_tasks",
"list_agents",
"get_agent",
"list_projects",
"list_goals",
"list_project_repositories"
],
"controlPlaneOperationIds": [],
"realSurface": "company issue search and agent/project/goal list/get routes",
"mockStateDomains": [
"company",
"task",
"actor",
"project",
"goal"
],
"prpEvidence": "bounded redacted read projections through tool-result item events",
"gap": "Goal operations remain scenario-only. Project and repository discovery contracts are delivered by the live server authority; they are not implemented by the mock command dispatcher."
},
{
"id": "su",
"legacyGroup": 6,
"name": "Subtasks",
"owner": "optional delegation tools",
"operationIds": [
"create_task",
"reassign_task",
"hire_agent",
"handoff_case"
],
"controlPlaneOperationIds": [
"route_wake"
],
"realSurface": "company issue create, child issue, guarded reassignment, and wake services",
"mockStateDomains": [
"company",
"task",
"actor",
"blockers",
"wake",
"audit"
],
"prpEvidence": "company/task state diff, audit reference, and continuation wake evidence",
"gap": "create_task is production-bound to ordinary active-issue child creation with assignment, dependency-ready wake, company checks, child limits, and durable source-scoped idempotency. handoff_case is live-only: the dedicated case service moves the same primary task after source execution settles, or records completion intent subject to ordinary completion gates; legacy scenarios do not claim that coverage."
},
{
"id": "bl",
"legacyGroup": 7,
"name": "Blockers",
"owner": "always/optional tools + control plane",
"operationIds": [
"block_task",
"set_dependencies"
],
"controlPlaneOperationIds": [
"schedule_blocker_wake",
"route_wake"
],
"realSurface": "issue relations, blocker projection, liveness validation, and blocker wake services",
"mockStateDomains": [
"task",
"blockers",
"wake",
"actor",
"audit",
"fault"
],
"prpEvidence": "dependency diff, block receipt, attention routing, and issue-status decision",
"gap": "set_dependencies is production-bound for the active issue; block_task remains unbound, and cancelled-blocker receipts still need typed additive evidence."
},
{
"id": "dp",
"legacyGroup": 8,
"name": "Documents and plans",
"owner": "always task-document tools; restore optional; destructive lifecycle control-plane-only",
"operationIds": [
"list_documents",
"read_document",
"list_document_revisions",
"write_document"
],
"controlPlaneOperationIds": [
"append_audit_record"
],
"realSurface": "issue document list/read/upsert/revision/restore/lock/unlock/delete routes",
"mockStateDomains": [
"task",
"documents",
"interactions",
"idempotency",
"audit",
"fault"
],
"prpEvidence": "bounded reads and revision-safe write/conflict/denial receipts with revision lineage",
"gap": "restore_document_revision is an approved optional-tool gap; lock/unlock/delete are intentionally control-plane-only. Case kickoff initialDocuments become ordinary task documents in the same transaction. Case reads roll up authorized task document metadata; historical case-document REST storage remains readable without dedicated native document tools."
},
{
"id": "ix",
"legacyGroup": 9,
"name": "Interactions",
"owner": "always tools + addressed resolver",
"operationIds": [
"request_human_input"
],
"controlPlaneOperationIds": [
"route_wake"
],
"realSurface": "issue-thread interaction create/respond/accept/reject/withdraw services",
"mockStateDomains": [
"task",
"documents",
"interactions",
"wake",
"actor",
"idempotency"
],
"prpEvidence": "interaction proposal/materialization/response/delivery and attention events",
"gap": "Production binding and semantic resolution receipts are unbound."
},
{
"id": "ap",
"legacyGroup": 10,
"name": "Approvals",
"owner": "optional governance tools + governed approver",
"operationIds": [
"list_approvals",
"get_approval",
"get_approval_context",
"request_approval",
"decide_approval",
"comment_on_approval"
],
"controlPlaneOperationIds": [
"route_wake",
"append_audit_record"
],
"realSurface": "company approval, decision, issue-link, comment, and governed-action services",
"mockStateDomains": [
"company",
"task",
"approvals",
"actor",
"wake",
"audit",
"idempotency"
],
"prpEvidence": "governed semantic receipts, audit references, and attention/continuation linkage",
"gap": "Production binding and additive governed-action receipts are unbound; board-only authority stays outside grants."
},
{
"id": "ar",
"legacyGroup": 11,
"name": "Artifacts",
"owner": "always tools + artifact/work-product services",
"operationIds": [
"register_deliverable"
],
"controlPlaneOperationIds": [
"append_audit_record"
],
"realSurface": "attachment upload and issue work-product routes",
"mockStateDomains": [
"task",
"artifacts",
"workProducts",
"workspace",
"audit",
"idempotency"
],
"prpEvidence": "artifact/work-product reference and durable inspectability receipt; never binary bytes",
"gap": "Production upload/register composite and additive durable-reference receipt are unbound."
},
{
"id": "er",
"legacyGroup": 12,
"name": "Errors and critical rules",
"owner": "runner/control plane + optional workspace/wake tools",
"operationIds": [
"get_workspace_runtime",
"control_workspace_service",
"get_workspace",
"list_workspaces",
"select_workspace",
"prepare_repository",
"schedule_wake",
"inspect_operation_result"
],
"controlPlaneOperationIds": [
"release_task",
"enforce_budget",
"persist_run",
"replay_run",
"reconcile_run"
],
"realSurface": "workspace runtime, monitor/recovery, budget, run persistence/replay, release, and terminal services",
"mockStateDomains": [
"workspace",
"budget",
"run",
"wake",
"audit",
"idempotency",
"fault"
],
"prpEvidence": "runtime/workspace/attention/run lifecycle, typed denials, replay facts, and terminal causality",
"gap": "Budget stop reasons and semantic denial/conflict receipts require additive v1 envelopes; inspect_operation_result remains scenario-only. Task workspace inspection, discovery, selection and repository preparation use live authenticated service contracts; the legacy scenarios do not claim coverage for these operations."
},
{
"id": "rf",
"legacyGroup": 13,
"name": "Reference files",
"owner": "always instruction tools + optional domain tools + test-only escape hatch",
"operationIds": [
"list_cases",
"upsert_case",
"create_case",
"read_case",
"update_case",
"list_workflows",
"read_workflow",
"create_workflow",
"update_workflow",
"list_routines",
"manage_routine",
"create_skill",
"update_skill",
"list_company_skills",
"sync_company_skills",
"list_secret_metadata",
"read_secret_value",
"export_company",
"administer_company",
"generic_api_request",
"search_api",
"call_api",
"create_project",
"read_agent_instructions",
"update_agent_instructions",
"get_agent_instruction_history",
"restore_agent_instructions",
"submit_complaint",
"submit_suggestion"
],
"controlPlaneOperationIds": [
"append_audit_record"
],
"realSurface": "agent instruction revisions, project, case, routine, company-skill, secret, portability, and administration services, and run-attributed agent commentary",
"mockStateDomains": [
"company",
"cases",
"routines",
"skills",
"secrets",
"audit",
"fault"
],
"prpEvidence": "bounded domain projections, redacted broker receipts, company diffs, and audit references",
"gap": "Instruction read/update/history/restore require the live canonical revision service, current responsible-user permissions, and pinned base revisions for writes. Their service, authority, and product E2E tests are separate from the legacy mock scenarios. Project and skill creation and API tools require the live server authority; generic_api_request is test-only. Workflow definition tools are live-only company-scoped prompt authoring and bounded retrieval under the Cases flag. create_case, read_case and update_case are live-only authorized case creation, projections and fact mutations; list_cases and upsert_case remain scenario mocks. Other domain operations remain scenario-only. Broad administer_company is deferred and cannot claim product coverage. Production API and paired dedicated-tool regressions are recorded separately in paperclip-evals/evals/runner-api-tools; the legacy scenario count is not evidence of that coverage. Feedback actions are live-only: shared persistence, authority, API, and actual Codex smoke tests cover them; the legacy scenario count does not claim feedback coverage."
},
{
"id": "mh",
"legacyGroup": 14,
"name": "Multi-hop",
"owner": "composed semantic operations + control-plane continuation",
"operationIds": [
"create_task",
"set_dependencies",
"request_human_input",
"request_approval",
"register_deliverable"
],
"controlPlaneOperationIds": [
"route_wake",
"reconcile_run"
],
"realSurface": "delegation, dependency, interaction, approval, artifact, and terminal orchestration services",
"mockStateDomains": [
"task",
"blockers",
"interactions",
"approvals",
"artifacts",
"wake",
"run",
"audit"
],
"prpEvidence": "correlated operation receipts, state diffs, attention hops, work assessment, status decision, and terminal outcome",
"gap": "No generic transaction tool is allowed; shared mock/real conformance must prove each composed effect."
},
{
"id": "rs",
"legacyGroup": 15,
"name": "Restraint and no-call",
"owner": "policy/exposure layer",
"operationIds": [
"answer_status_question",
"read_secret_value",
"generic_api_request"
],
"controlPlaneOperationIds": [
"enforce_budget"
],
"realSurface": "task-mode, secret-broker, test-scope, pause, and budget policy checks",
"mockStateDomains": [
"actor",
"task",
"budget",
"secrets",
"audit",
"fault"
],
"prpEvidence": "absence of forbidden effects plus typed policy denial/redaction receipts when a call is attempted",
"gap": "Typed redaction/authorization receipts need additive v1 evidence; generic_api_request is never a product fallback."
},
{
"id": "wk",
"legacyGroup": 16,
"name": "Wake situations",
"owner": "control plane + always context/history tools",
"operationIds": [
"get_task_context",
"get_task_history",
"schedule_wake",
"set_task_monitor"
],
"controlPlaneOperationIds": [
"select_work",
"route_wake"
],
"realSurface": "wakeup requests, heartbeat context, comment/interaction/approval/blocker wake routing, and scheduled wake services",
"mockStateDomains": [
"wake",
"task",
"comments",
"interactions",
"approvals",
"blockers",
"run"
],
"prpEvidence": "attention request routing/resolution plus resumed session/run causality",
"gap": "set_task_monitor binds the one-shot monitor scheduler in production; schedule_wake remains mock-backed. Control-plane routing remains non-callable."
}
],
"rules": {
"companyAuthorization": [
"Every entity read and write is resolved inside the authenticated actor's company; cross-company identifiers fail without disclosing protected facts.",
"Board actors use active membership and role permissions. Agent writes require a company-scoped run JWT and X-Paperclip-Run-Id; active-task tools cannot accept a caller-selected company or arbitrary task.",
"Optional tools are omitted unless every required claim, role, and task-mode condition is satisfied. A grant never bypasses approval, budget, pause, execution-lock, interaction-owner, or other governed-action checks."
],
"taskModes": [
"standard permits the full eligible catalog subject to claims and role checks.",
"ask is answer-only: investigation reads are eligible, while implementation, document mutation, delegation, terminal, and governed writes are absent.",
"planning permits plan/document/progress/input operations but not delegation or terminal completion; accepting a plan transitions the issue into a fresh standard execution continuation for the exact accepted revision.",
"skill_test exposes only scenario-admitted tools. generic_api_request additionally requires the explicit test grant and allowlist and never supplies product coverage."
],
"redaction": [
"Tool descriptors declare observable redaction. Secret plaintext may reach only the model-use capsule authorized for a bound secret; it never reaches PRP, logs, artifacts, errors, audit details, or serialized tool results.",
"Authorization denials reveal stable codes, missing public claims, and remediation only; they do not include protected entity state, credentials, headers, cookies, or another company's policy.",
"Artifacts carry durable references, hashes, content type, and size on the wire; binary payloads remain in storage transports."
],
"idempotency": [
"Every mutation whose descriptor says required must carry a stable idempotency key. Retrying the same key and equivalent input returns the prior receipt without duplicating side effects.",
"Reusing a key with different input is an idempotency conflict. Optimistic document writes additionally bind baseRevisionId and return the current revision on conflict.",
"PRP source event IDs are idempotent, source sequence gaps are evidence, and replay is side-effect free. Replaying a trace cannot repeat control-plane writes."
],
"sideEffects": [
"read operations return bounded projections and do not mutate control-plane state.",
"task_write and company_write operations emit normalized state diffs and immutable audit references after production authorization succeeds.",
"governance, workspace_control, secret_read, and admin operations retain their production-specific gates; catalog exposure is necessary but never sufficient authority.",
"Terminal semantic operations propose intent. The control plane owns checkout, release, budget enforcement, persisted run evidence, replay, wake routing, audit append, and final status arbitration."
]
},
"documentLifecycle": {
"scope": [
"Issue documents are active-task working records identified by (activeIssueId, key). Always-present document tools do not accept a company id or arbitrary issue id.",
"Cross-task document reads require a future explicit optional operation and grant; case documents and future company knowledge are separate resource types.",
"Locked-document fallback may create a deterministic new key only when lockedDocumentStrategy is create_new_document; the source stays locked and the returned receipt names the redirected key."
],
"operations": [
{
"action": "create",
"semanticOperation": "write_document",
"placement": "always_agent_tool",
"contract": "baseRevisionId is null; create revision 1 and return document/revision/audit identity.",
"status": "supported contract; production binding unbound"
},
{
"action": "read",
"semanticOperation": "list_documents / read_document",
"placement": "always_agent_tool",
"contract": "List metadata or read the current active-task document by stable key.",
"status": "supported contract; production binding unbound"
},
{
"action": "update",
"semanticOperation": "write_document",
"placement": "always_agent_tool",
"contract": "Require the exact latest baseRevisionId and an idempotency key; append an immutable revision.",
"status": "supported contract; production binding unbound"
},
{
"action": "revisions",
"semanticOperation": "list_document_revisions",
"placement": "always_agent_tool",
"contract": "Return bounded immutable revision history newest first.",
"status": "supported contract; production binding unbound"
},
{
"action": "restore",
"semanticOperation": "restore_document_revision",
"placement": "optional_agent_tool (documents:restore)",
"contract": "Validate same-document lineage, reject locked documents, append a new revision, and return source/new revision identity; restoring current is a no-change duplicate.",
"status": "approved catalog gap"
},
{
"action": "lock",
"semanticOperation": "none",
"placement": "control_plane_owned",
"contract": "Board/administrative lifecycle action; agent writes receive document_locked or use explicit create-new fallback.",
"status": "intentionally non-callable"
},
{
"action": "unlock",
"semanticOperation": "none",
"placement": "control_plane_owned",
"contract": "Board/administrative lifecycle action; never inferred from a failed write.",
"status": "intentionally non-callable"
},
{
"action": "delete",
"semanticOperation": "none",
"placement": "control_plane_owned",
"contract": "Destructive audited action; pending targets become stale and the runner never recreates them automatically.",
"status": "intentionally non-callable"
}
]
},
"legacySemanticTargetDispositions": {
"injected_actor_context": {
"kind": "control_plane",
"targets": [
"select_work"
],
"reason": "Identity is launch context, not a model tool."
},
"runner_work_selection": {
"kind": "control_plane",
"targets": [
"select_work"
],
"reason": "Inbox selection belongs to the control plane."
},
"get_project": {
"kind": "folded",
"targets": [
"list_projects"
],
"reason": "The bounded discovery operation owns project list/get projection in V1."
},
"wait_for_workspace_service": {
"kind": "folded",
"targets": [
"control_workspace_service"
],
"reason": "Wait is a bounded action of workspace service control."
},
"get_goal": {
"kind": "folded",
"targets": [
"list_goals"
],
"reason": "The bounded discovery operation owns goal list/get projection in V1."
},
"semantic_task_disposition": {
"kind": "composite",
"targets": [
"answer_status_question",
"finish_task",
"block_task",
"request_review"
],
"reason": "Generic issue PATCH is replaced by intent-specific terminal/status operations."
},
"atomic_checkout": {
"kind": "control_plane",
"targets": [
"checkout_task"
],
"reason": "Checkout is an atomic control-plane transaction."
},
"runtime_release": {
"kind": "control_plane",
"targets": [
"release_task"
],
"reason": "Release is runner/control-plane cleanup."
},
"restore_document_revision": {
"kind": "known_gap",
"targets": [],
"reason": "Approved optional documents:restore operation is not yet in the canonical catalog."
},
"link_approval": {
"kind": "folded",
"targets": [
"request_approval",
"get_task_context"
],
"reason": "Issue linkage is part of approval request/context composites."
},
"unlink_approval": {
"kind": "control_plane",
"targets": [
"append_audit_record"
],
"reason": "No standalone agent unlink tool is approved in V1."
},
"test_only_api_escape_hatch": {
"kind": "folded",
"targets": [
"generic_api_request"
],
"reason": "Compatibility alias for the test-only escape hatch."
}
}
}
Reference in new issue View Git Blame Copy Permalink