mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-29 12:59:13 +01:00
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - Agents can propose secrets and bindings for approval. > - Pending proposals already contain their expiry and encrypted value. > - The server scans for expired proposals on every maintenance tick, even when none exist. > - Committed proposal changes and saved expiry times provide the required triggers. > - This PR uses those triggers and preserves scrubbing, approval checks, and recovery. > - Empty and completed proposal history no longer causes recurring expiry queries. ## Linked Issues or Issue Description Refs #17443. This is the second PR in the sleep migration stack and targets its branch. **What problem does this solve?** The periodic proposal scan contacts PostgreSQL when no proposal needs maintenance. That obstructs idle database behavior across tenant instances. **What is the proposed solution?** Use transaction-aware notifications for creation and resolution. Reconstruct the earliest pending expiry at startup. Run cleanup at that deadline, or retry while reconciliation remains unfinished. **Why is this useful?** It removes an idle scan while retaining security checks and physical ciphertext cleanup. No queue table or migration is required. ## What Changed - Added intent notifications before secret/binding creation, approval, terminal transitions, and linked interaction resolution. The existing outer transaction owns settlement. - Kept expiry selection, ciphertext scrubbing, dependent rejection, and authorization in the secret-proposal service. - Registered a startup and deadline worker in place of the aggregate maintenance sweep. Empty/terminal states disarm; overdue batches and failures retain retries. - Reused shared scoped deadline dispatch for secret expiry. The service owns company-filtered SQL and expiry policy. Custom-image expiry continues to use `registerDeadlineWork`. - Added real PostgreSQL producer, outer-transaction, concurrent-write, expiry, restart, interaction resolution, and drain/resume tests. Updated startup wiring fixtures and documented the supported writer/lifecycle contract. ## Verification - Landing reconciliation at `c10eb1bcf752b058713e05d3345e5cf38dd3fa72`: 160 tests pass across the complete secret-proposal, scoped deadline, company batch, coordinator, startup, custom-image service and custom-image worker suites; no cases skipped in the accepted runs. Server typecheck passes. This integrates master after #17443 landed; fresh remote CI and Ponytail review are required before merge. Current head: `5bbe17ad9ebc4573b08ed1a9323644ef9608ca09`. This remains a single-duty PR stacked on #17443. - Integrated pinned master `8548173fc9efdc0fa07644fb92dcc0b6851a95e5` with normal merges. Every branch passed generated-schema checks and its target-branch migration-order gate. Existing SQL is unchanged; the 25 stack migrations follow master’s new migration. - Duty-specific producer coverage, lifecycle tests, and earlier failure records: [2026-10-08-instance-sleep-and-scheduler-inventory.md](https://github.com/paperclipai/paperclip/blob/5bbe17ad9ebc4573b08ed1a9323644ef9608ca09/doc/plans/2026-10-08-instance-sleep-and-scheduler-inventory.md), [2026-10-24-recurring-server-sleep-stack.md](https://github.com/paperclipai/paperclip/blob/5bbe17ad9ebc4573b08ed1a9323644ef9608ca09/doc/plans/2026-10-24-recurring-server-sleep-stack.md). - Combined tip `51e6cbe67979b55b340ea9f0f434c5b5c682ccd6`: **355 startup/cancellation/recovery/dispatch/preservation tests**, **75 connection-management tests**, and production server typechecking pass. These combined checks do not mean every intermediate PR independently ran the full repository suite. - Real master-to-stack database upgrade passes: **379 unchanged prior migration receipts plus 25 new migrations**, with the gateway responsibility fixture preserved. - Owning-branch checks: 84 runner installation/settlement cases plus runner typechecking and generated TypeScript/Rust profile agreement; 253 GitHub review workflow cases. Stop-attribution and held-worker readiness regressions failed before their fixes. - Failure accounting: the initial combined run passed 349 cases and failed six idle assertions in a reused preservation database containing old cancelled runs. Repeating the combined command with a fresh preservation database passed. Earlier invalid project selection, merge import/type errors, and the interrupted full local suite are not counted as passing checks. - **Latest-head CI and review remain required.** Prior CI findings include GitHub idle observation, route teardown, attention cleanup, touch-picker E2E, workspace health, and voice-cleanup timing; local passes do not erase those failures. No full local repository-suite, deployed sleep, fleet cost, or live Copilot qualification claim is made. ## Risks - Notifications cover supported writers sharing the database signal owner. Independent SQL writers and other process roots require a separate ingress contract; startup recovery alone is not live replica support. - The shared coordinator and scoped worker also serve later stack duties. Their defaults remain intact; existing voice, chat, native, and startup consumers are included in integrated verification. - Startup now checks overdue proposals immediately. During drain, physical cleanup waits; approval still rejects expired proposals synchronously. - Each due company pass remains bounded to 100 rows. Failed scopes back off from 30 seconds to five minutes; healthy overdue work keeps draining. Self-generated write hints coalesce and do not erase a failed sweep's backoff. - Heartbeat-disabled behavior and Cloud sleep-safety gates remain unchanged. This does not establish deployed suspension or external wake coverage. Tool review and gateway token cleanup remain separate slices. ## Model Used OpenAI Codex, GPT-6 family, with reasoning and code execution. The exact serving model identifier and context window were not exposed. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [ ] All Paperclip CI gates are green - [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
100 lines
5.0 KiB
TypeScript
100 lines
5.0 KiB
TypeScript
import { takeCompanyWorkBatch } from "./company-work-batch.js";
|
|
import type { createDeliveryWorkCoordinator } from "./delivery-work-coordinator.js";
|
|
import type { DeliveryQueue } from "./delivery-work-notifications.js";
|
|
|
|
type ScheduledEntry = { id: string; companyId: string; dueAt: number };
|
|
|
|
/** Coalesced scope reconstruction and fair deadline dispatch. Domain owners
|
|
* supply persistence, eligibility, and execution; this helper owns no SQL. */
|
|
export function registerScopedDeadlineWork<Entry extends ScheduledEntry, Scope>(
|
|
coordinator: ReturnType<typeof createDeliveryWorkCoordinator>,
|
|
options: {
|
|
queue: DeliveryQueue;
|
|
batchSize?: number;
|
|
minimumPassIntervalMs?: number;
|
|
decodeScope(hint: string): Scope | undefined;
|
|
matches(entry: Entry, scope?: Scope): boolean;
|
|
load(scope?: Scope, signal?: AbortSignal): Promise<Entry[]>;
|
|
check(entry: Entry, signal?: AbortSignal): Promise<Entry | null>;
|
|
},
|
|
canRun: () => boolean,
|
|
) {
|
|
const dirty = new Set<string>(["*"]);
|
|
const entries = new Map<string, Entry>();
|
|
const failures = new Map<string, { count: number; retryAt: number }>();
|
|
const scopeFailures = new Map<string, { count: number; retryAt: number }>();
|
|
let earliest = 0;
|
|
let lastCompany: string | null = null;
|
|
function failed(map: typeof failures, id: string) {
|
|
const count = Math.min((map.get(id)?.count ?? 0) + 1, 5);
|
|
map.set(id, { count, retryAt: Date.now() + Math.min(300_000, 30_000 * 2 ** (count - 1)) });
|
|
}
|
|
function dirtyScopes() {
|
|
return [...dirty].map(hint => { try { return options.decodeScope(hint); } catch { return undefined; } });
|
|
}
|
|
function next() {
|
|
if (!canRun()) return dirty.size > 0 || entries.size > 0 ? Date.now() + 30_000 : null;
|
|
let nextAt: number | null = null;
|
|
const take = (at: number) => { nextAt = nextAt === null ? at : Math.min(nextAt, at); };
|
|
for (const hint of dirty.has("*") ? ["*"] : dirty) take(Math.max(earliest, scopeFailures.get(hint)?.retryAt ?? 0));
|
|
const unavailable = dirtyScopes();
|
|
for (const entry of entries.values()) if (!unavailable.some(scope => options.matches(entry, scope)))
|
|
take(Math.max(earliest, entry.dueAt, failures.get(entry.id)?.retryAt ?? 0));
|
|
return nextAt;
|
|
}
|
|
const worker = coordinator.register(options.queue, {
|
|
retryMs: 30_000,
|
|
pausePassiveMaintenance: true,
|
|
onSettled: hints => { for (const hint of hints ?? ["*"]) dirty.add(hint); },
|
|
run: async signal => {
|
|
if (!canRun() || Date.now() < earliest) return;
|
|
earliest = Date.now() + (options.minimumPassIntervalMs ?? 1000);
|
|
const errors: unknown[] = [];
|
|
const requested = (dirty.has("*") ? ["*"] : [...dirty]).filter(hint => (scopeFailures.get(hint)?.retryAt ?? 0) <= Date.now());
|
|
const covered = requested.includes("*") ? [...dirty] : requested;
|
|
for (const hint of covered) dirty.delete(hint);
|
|
for (let index = 0; index < requested.length; index++) {
|
|
if (signal.aborted || !canRun()) { for (const hint of requested.includes("*") ? covered : requested.slice(index)) dirty.add(hint); return; }
|
|
const hint = requested[index];
|
|
let scope: Scope | undefined;
|
|
let decoded = false;
|
|
try {
|
|
scope = options.decodeScope(hint); decoded = true;
|
|
const rows = await options.load(scope, signal), retained = new Set(rows.map(row => row.id));
|
|
for (const entry of entries.values()) if (options.matches(entry, scope) && !retained.has(entry.id)) {
|
|
entries.delete(entry.id); failures.delete(entry.id);
|
|
}
|
|
for (const entry of rows) entries.set(entry.id, entry);
|
|
if (!scope) scopeFailures.clear(); else scopeFailures.delete(hint);
|
|
} catch (error) {
|
|
const retryHint = decoded ? hint : "*";
|
|
dirty.add(retryHint); failed(scopeFailures, retryHint); errors.push(error);
|
|
}
|
|
}
|
|
const unavailable = dirtyScopes();
|
|
const due = [...entries.values()].filter(entry => !unavailable.some(scope => options.matches(entry, scope))
|
|
&& Math.max(entry.dueAt, failures.get(entry.id)?.retryAt ?? 0) <= Date.now())
|
|
.sort((a, b) => a.dueAt - b.dueAt || a.id.localeCompare(b.id));
|
|
const batch = takeCompanyWorkBatch(due, options.batchSize ?? 25, lastCompany); lastCompany = batch.lastCompany;
|
|
for (const entry of batch.entries) {
|
|
if (signal.aborted || !canRun()) break;
|
|
try {
|
|
const current = await options.check(entry, signal);
|
|
if (current) entries.set(entry.id, current); else entries.delete(entry.id);
|
|
failures.delete(entry.id);
|
|
} catch (error) { failed(failures, entry.id); errors.push(error); }
|
|
}
|
|
if (errors.length) throw new AggregateError(errors, `${options.queue} could not settle`);
|
|
},
|
|
// Retain scopes/deadlines for resume without retaining a settled write's
|
|
// idle hold during drain. The coordinator still fences unresolved XIDs.
|
|
hasPending: async () => canRun() && dirty.size > 0,
|
|
nextRunAt: next,
|
|
nextRunAtOnError: next,
|
|
});
|
|
return { ...worker, invalidate(hint = "*") {
|
|
dirty.add(hint);
|
|
worker.wake();
|
|
} };
|
|
}
|