Files
PaperClipAI/tests/runner-e2e/rolling-deployment-process.ts
T
DottaandPaperclip 16787e4167 Qualify rolling web deployments and preserve Stop through handoff (#18526)
## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work.
> - The web server owns request handling and remote execution
coordination.
> - Deployment must start a ready replacement while the old server still
serves.
> - An outage test does not prove that two live servers can overlap
safely.
> - This pull request adds a separate Product E2E cell for that
boundary.
> - The existing run, file, recovery, and retained-session checks still
apply.

## Linked Issues or Issue Description

Refs #18518. The runtime prerequisite is merged; this PR qualifies its
ephemeral server and deployment contracts.

## What Changed

- Add the explicit `rolling-web-deployment` Codex Daytona workflow.
- Start independent A/B/C homes and compiled builds behind a test
ingress.
- Wait for readiness before routing, then drain and delete the old home.
- Observe active authority before handoff and use the existing read-only
recovery oracle.
- Require ordinary reads and saves to succeed throughout replacement.
Read back every accepted save exactly once.
- Preserve the five-minute outage suites and their existing validators.
- Add a model-free supervisor smoke and an unready replacement control.
- Require graceful exit before deleting an old home; forced cleanup
cannot satisfy the oracle.
- Preserve a durable Stop through lease release/expiry until the
recovered execution owner acknowledges it. Permit only fenced
reattachment of the original execution for Stop cleanup; submit no new
turn.
- Exclude events saved by A during shutdown from evidence of B making
progress.

## Verification

- E2E TypeScript check passed.
- Affected harness checks: 143 passed. Catalog, fixture and report
checks: 120 passed.
- Actual supervisor smoke passed two replacements: 436 reads, 45 saves,
zero request failures, and confirmed owned resource cleanup.
- B became ready in 18.7 seconds; C became ready in 109.2 seconds. A
prior C timeout remains failed evidence.
- Fresh browser proof: 11 checks passed, 246 reads, 50 acknowledged
saves, zero failures, 1,058ms reconnect, both old homes deleted and
cleanup confirmed.
- Stop lease-gap regression: three PostgreSQL delivery tests passed with
a simulated provider edge. Current server TypeScript build/vendoring
passed.
- Full harness: 5,814 passed, 17 failed, four skipped. Two shutdown
races passed the focused file; two report timeouts passed an isolated
42-test rerun. Onboarding/workflow-security/Pi/date-expired fixtures are
unchanged on inspected master; the host embedded PostgreSQL fixture
remains a setup limitation. This is not a green full local suite.
- CI at `172509b8be` passed all gates. Greptile is 5/5 with every review
thread resolved. The earlier access-service race failure passed its
isolated regression and the subsequent full CI.
- Final review corrections: six focused executor cases, three PostgreSQL
command-delivery cases, 19 harness cases and server/E2E typechecks
passed.
- Three live attempts failed before agent creation: two harness setup
gaps were fixed, then provider authentication failed. The saved OpenAI
key returns 401; a refresh is pending. The Daytona probe reported
cleanup uncertain, and no sandbox with that attempt label was found
through the authenticated staging manager. No live model execution is
claimed.
- Live Runner overlap, released-container qualification and hosted
deployment proof remain pending. Merging this opt-in qualification lane
does not claim those results.

## Risks

- The source lane shares workspace dependencies and does not establish
container packaging correctness.
- The live workflow needs an explicitly owned S3 bucket, PostgreSQL,
pinned remote image and provider credentials.
- Qualification cleanup stops all owned processes after failure. A
failed replacement must not be reported as a pass.

## Model Used

OpenAI Codex, GPT-6. Tool use, code execution and repository review. The
runtime does not expose a more specific model ID or context-window size.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

---------

Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-11-01 02:53:27 -06:00

100 lines
5.4 KiB
TypeScript

import { spawn, type ChildProcess } from "node:child_process";
import { createWriteStream } from "node:fs";
import { cp, mkdir, readFile, rm, symlink, writeFile } from "node:fs/promises";
import path from "node:path";
import { setTimeout as delay } from "node:timers/promises";
import { paperclipConfigSchema } from "../../packages/shared/src/config-schema.js";
import { reserveRunnerE2EServerPort } from "./ports.js";
import { prepareRunnerE2EServerConfig } from "./server-config.js";
import { createRunnerE2EServerStopper } from "./server-stop.js";
import { runnerE2ETypeScriptProcessArgs } from "./web-server-command.js";
export async function startRollingDeploymentProcess(input: {
root: string;
name: string;
repositoryRoot: string;
databaseUrl: string;
ingressOrigin: string;
sharedEnvironment: NodeJS.ProcessEnv;
browser?: { omitAssets?: string[] };
}) {
const home = path.join(input.root, input.name);
const temporary = path.join(home, "tmp");
await mkdir(temporary, { recursive: true, mode: 0o700 });
const port = await reserveRunnerE2EServerPort();
const configPath = path.join(home, "instances/default/config.json");
const reservation = await prepareRunnerE2EServerConfig({ temporaryRoot: home, configPath, serverPort: port });
await reservation?.close();
const config = paperclipConfigSchema.parse(JSON.parse(await readFile(configPath, "utf8")));
config.database = { ...config.database, mode: "postgres", connectionString: input.databaseUrl };
config.server.serveUi = Boolean(input.browser);
await writeFile(configPath, JSON.stringify(config), { mode: 0o600 });
const log = createWriteStream(path.join(input.root, `${input.name}.log`), { mode: 0o600 });
const spawnErrors = new WeakMap<ChildProcess, Error>();
const stopper = createRunnerE2EServerStopper({
gracefulTimeoutMs: 90_000, forcedTimeoutMs: 5_000,
hasSpawnError: child => spawnErrors.has(child), markExpectedStop() {},
log: message => log.write(message),
});
let entry = path.join(input.repositoryRoot, "server/src/index.ts");
if (input.browser) {
// Independent build directories let the browser test remove A completely
// and omit an old lazy chunk from B without mutating the checkout's build.
const appRoot = path.join(home, "app/server");
await mkdir(appRoot, { recursive: true });
await cp(path.join(input.repositoryRoot, "server/dist"), path.join(appRoot, "dist"), { recursive: true });
await cp(path.join(input.repositoryRoot, "ui/dist"), path.join(appRoot, "ui-dist"), { recursive: true });
await symlink(path.join(input.repositoryRoot, "server/node_modules"), path.join(appRoot, "node_modules"));
// This lane uses workspace dependencies, whose exports include TypeScript.
// Preserve the normal development plugin loader beside each compiled copy.
await symlink(path.join(input.repositoryRoot, "cli"), path.join(home, "app/cli"));
await writeFile(path.join(appRoot, "package.json"), '{"type":"module"}');
for (const omittedAsset of input.browser.omitAssets ?? []) {
if (!/^[A-Za-z0-9_.-]+\.js$/.test(omittedAsset)) throw new Error("Unsafe omitted asset fixture");
for (const suffix of ["", ".br", ".gz"]) await rm(path.join(appRoot, "ui-dist/assets", omittedAsset + suffix), { force: true });
}
entry = path.join(appRoot, "dist/index.js");
}
const child = spawn(process.execPath, runnerE2ETypeScriptProcessArgs(input.repositoryRoot, entry), {
cwd: input.repositoryRoot,
env: {
...input.sharedEnvironment, PATH: input.sharedEnvironment.PATH ?? process.env.PATH, HOME: home, TMPDIR: temporary, XDG_CACHE_HOME: path.join(home, "cache"),
NODE_ENV: "test", PAPERCLIP_HOME: home, PAPERCLIP_CONFIG: configPath,
PORT: String(port), PAPERCLIP_INSTANCE_ID: "default", DATABASE_URL: input.databaseUrl,
PAPERCLIP_API_URL: input.ingressOrigin, PAPERCLIP_TELEMETRY_ENABLED: "false",
PAPERCLIP_DISABLE_TELEMETRY: "true", PAPERCLIP_LOG_LEVEL: "warn",
HEARTBEAT_SCHEDULER_ENABLED: input.sharedEnvironment.HEARTBEAT_SCHEDULER_ENABLED ?? "false",
},
detached: process.platform !== "win32", stdio: ["ignore", "pipe", "pipe"],
});
child.on("error", error => spawnErrors.set(child, error));
child.stdout!.pipe(log, { end: false }); child.stderr!.pipe(log, { end: false });
await stopper.watch(child);
const origin = `http://127.0.0.1:${port}`;
let stopped = false;
return {
child, home, configPath, origin,
async waitForReady() {
const started = performance.now();
while (performance.now() - started < 180_000) {
if (spawnErrors.has(child) || child.exitCode !== null || child.signalCode !== null) {
throw new Error(`Server ${input.name} exited before readiness; inspect ${input.name}.log`);
}
const health = await fetch(`${origin}/api/ready`, { signal: AbortSignal.timeout(2_000) })
.then(async response => response.ok ? await response.json() as { status?: string } : null).catch(() => null);
if (health?.status === "ready") return { elapsedMs: Math.round(performance.now() - started), pid: child.pid };
await delay(100);
}
throw new Error(`Server ${input.name} did not become ready; inspect ${input.name}.log`);
},
async stop(options: { requireGraceful?: boolean } = {}) {
if (!stopped) {
await stopper.stopAll();
await new Promise<void>(resolve => log.end(resolve));
stopped = true;
}
if (options.requireGraceful) stopper.assertGracefulExit(child);
},
};
}