Jannik/PaperClipAI
1
0 Fork 0
mirror of https://github.com/paperclipai/paperclip.git synced 2026-11-04 19:28:46 +01:00
Code Issues Packages Projects Releases Wiki Activity
Files
f7ad1dc7cacedf7153a45e854ddfdd544aa87abd
PaperClipAI/maps/feature-map/instance-operations.md
T
DottaandPaperclip a61cf38106 docs: keep the feature map focused on substantial features (#18767) 
## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work.
> - The feature map describes product capabilities and user journeys.
> - Small fixes and test changes have added long notes to that map.
> - These notes make substantial features harder to find.
> - This pull request removes those additions from the last week's
changes and sets a clear rule for future additions.
> - The benefit is a smaller map with stable capability IDs and accurate
entry points.

## Linked Issues or Issue Description

**Issue type**

Unclear or confusing documentation.

**Where is the issue?**

`maps/feature-map/`, the map maintenance instructions, and repository
rules.

**What's wrong?**

Between October 27 and November 3, 2026, 115 commits changed the feature
map. Many additions describe bug fixes, performance details, small UI
changes, or new tests. They do not introduce substantial product
features. The old synchronization instructions also encouraged a map
edit for every behavior change.

**Suggested fix**

Add a rule that requires a substantial new feature before expanding the
map. Remove minor-update notes. Keep genuine feature additions and
minimal corrections to existing instructions. The review covers master
through `b22ef22d56`; it does not revert application code. Conflict
resolution preserves later map changes from master outside that audit
snapshot.

Searched open GitHub PRs and issues for related feature-map work. No
duplicate cleanup was found. Substantial feature additions retained here
include Coordinator (#17983), the agent YAML editor (#18036), document
image galleries (#18157), remote workspace storage (#18403), native Kimi
(#18391), proactive chat messages (#18374), and the Sentry receiver
added in #18714.

## What Changed

- Add `rules/feature-map-scope.mdc` and register its `maps/**` scope
with Greptile.
- Align `AGENTS.md` and the shared map contract with that rule. Routine
fixes and test changes no longer require incidental map edits.
- Remove 755 net lines from 23 feature recipes. Preserve all 35 areas
and 192 capability IDs.
- Keep substantial features and the corrections needed for current
navigation, provider availability, and access boundaries.

Examples from the reviewed changes:

| Removed or shortened addition | Why it does not need a feature-map
expansion |
| --- | --- |
| Rounded composer image thumbnails (#18689) | Small UI change within
existing task creation. |
| Connection profile reads and review-count queries (#18687, #18688) |
Performance details within existing app permissions. |
| Warm-session, Retry, export-capacity, and tool-wait cases | Regression
details for existing execution and recovery. |
| New task-search, project-context, document-persistence, and routine
test journeys | Test additions for existing capabilities. The tests
remain in place. |
| New task button placement (#18703) | Another entry to an existing task
form. |
| Local browser verification notes | Run evidence belongs in the PR or
test report. |

## Verification

- `node scripts/check-maps.mjs` passes: 35 areas, 192 capability IDs,
valid references and contract fields.
- `node scripts/storybook-catalog.mjs` passes: 328 files and 3,068
stories. Generated indexes remain ignored.
- Compared capability keys and navigation metadata in every edited
recipe with the original source. All are unchanged.
- Checked rule frontmatter, Greptile registration, representative scope
matches, and `git diff --check`.
- `pnpm -r typecheck` and `pnpm build` pass on
`9a60eef8eb8da9bc7c3a02203c79bec12e8c8b6b`. The final
`a0801e8a939494ecde3739097a80258917428e94` commit only corrects two
lines in the plugin-panel recipe; map and catalog checks pass again.
- Greptile reviewed the final `a0801e8a939494ecde3739097a80258917428e94`
head at 5/5 with no findings. The earlier review found one inaccurate
phrase about unavailable plugin panels. The hook confirms that readiness
gates automatic opening, while declared panels remain selectable. The
final documentation commit corrects that phrase and the thread is
resolved. Paperclip's refreshed review is advisory and remains queued.
- The earlier CI run failed two assertions: [server
4/12](https://github.com/paperclipai/paperclip/actions/runs/41634761842/job/125914173960)
counted three Anthropic identity calls instead of two in
`connection-management.integration.test.ts`; [chat
1/3](https://github.com/paperclipai/paperclip/actions/runs/41634761842/job/125914174257)
observed zero publications instead of one in the same-principal
endpoint-settlement case. Both exact tests pass locally on the rebased
head. This PR changes neither their source nor their expectations. These
failed results remain historical evidence.
- Final-head CI passed server 4/12 and all other suites except the first
[chat 1/3
attempt](https://github.com/paperclipai/paperclip/actions/runs/41637834618/job/125925926131),
which repeated the same zero-publication assertion. The browser gate
passed. The single failed-job retry was accepted for this unchanged head
in [workflow attempt
2](https://github.com/paperclipai/paperclip/actions/runs/41637834618/attempts/2).
[Chat 1/3 passed on that
retry](https://github.com/paperclipai/paperclip/actions/runs/41637834618/job/125933199635),
and the aggregate verification gate passed. Both required gates, `ci /
verify` and `ci / e2e`, are green on
`a0801e8a939494ecde3739097a80258917428e94`. The one retry allowance is
consumed.
- The first full local `pnpm test:run` attempt was interrupted before
completion so master could be rebased without changing source under
running tests. It is not a passing test result. Full current-head CI
remains required.
- No application code, tests, schemas, or lockfiles changed.

## Risks

- Low runtime risk. This change only edits documentation and review
guidance.
- Detailed regression instructions become less visible in the feature
map. Their tests and technical documentation remain available.
- Some additions mix a new feature with a small fix. Those blocks retain
the feature and shorten the incidental detail.

## Model Used

- OpenAI Codex, GPT-6 family, with reasoning, Git history inspection,
repository tools, and code execution. The session does not expose a more
specific model deployment ID or context-window size.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass — map, catalog,
capability-ID, and rule-scope checks; full Vitest limits are stated
above
- [x] I have added or updated tests where applicable — no new runtime
tests apply to this documentation change
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

---------

Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-11-03 07:16:37 -06:00

157 lines
12 KiB
Markdown
Raw Blame History

---
navigation: {"section":"Oversight and operation","sectionOrder":70,"order":40}
---
# Instance operations
An operator can install and run Paperclip, diagnose the instance, configure supported deployment settings, manage its service, and produce a recoverable database backup.
Feature ID: `instance-operations`.
Implementation: [CLI entry point](../../cli/src/index.ts), [instance settings](../../ui/src/pages/InstanceExperimentalSettings.tsx), [backup command](../../cli/src/commands/db-backup.ts).
Agent access: [companion](../agent-access-map/instance-operations.md).
## Sub-features
- `install-update`: `instance-operations/install-update` — inspect install channel/version and apply supported update or rollback operations.
- `server-service`: `instance-operations/server-service` — start/stop the intended instance and inspect its service health.
- `configuration`: `instance-operations/configuration` — configure database, server binding, storage, secrets, and available experimental settings.
- `diagnostics`: `instance-operations/diagnostics` — use doctor/health output to distinguish readiness from a listening port.
- `backup`: `instance-operations/backup` — create and inspect backups and verify restore only into a separate disposable target.
- `runtime-setup`: `instance-operations/runtime-setup` — install verified Pi/Cursor runtime assets, stage pending Antigravity assets on macOS ARM64, or import a release-matched Linux Pi companion into an owned published installation.
## How to get to it (user POV)
### `operator-cli`
Use `paperclipai install`, `run`, `service`, `doctor`, `configure`, `channels`, or `update --help` for the intended operation.
### `settings-backup`
Use currently visible instance settings for experiments/access and `paperclipai db:backup --help` for one-off backup. Some legacy general-settings URLs redirect.
### `runtime-provisioning`
On an owned published server installation, use `paperclipai runtime setup pi`, `paperclipai runtime setup cursor`, `paperclipai runtime setup antigravity`, or `paperclipai runtime import-remote <companion-directory> --sha256 <trusted-companion-json-digest>`. Run as the OS user operating that installation; this is separate from source-checkout dependency installation. Antigravity setup stages a pinned patched macOS ARM64 runtime; it remains unavailable for tasks until native acceptance passes.
## Driving it with Playwright and the Paperclip CLI
Preconditions: follow the [baseline](./README.md#before-driving-a-journey). Use a disposable data directory/service identity. Do not update, restart, or restore over an unrelated live instance as a documentation test.
### `operator-cli`
Automated: [doctor](../../cli/src/__tests__/doctor.test.ts), [update command](../../cli/src/__tests__/update-command.test.ts), and [service manager](../../cli/src/__tests__/service-manager.test.ts) cover command contracts.
Manual: Inspect the selected installation/channel and configuration, start the isolated instance, confirm health and browser access, then stop that instance. For update changes, use the dry-run/check path first and verify installed version and rollback state on an owned disposable installation.
Routine HTTP monitoring may use `GET /api/liveness` (or `HEAD`). It returns only
process startup status and the public build commit without SQL or authentication.
It remains reachable during an idle drain. Use `/api/health` for explicit database
readiness, signed bootstrap, and authorized diagnostics; liveness does not
establish database health or claim a workspace.
Deployment routing uses public `GET /api/ready` (or `HEAD`). It returns 200 only
after startup recovery finishes and 503 while starting, recovering, or draining.
The probe reads in-memory state without SQL or session resolution. Local
[readiness tests](../../server/src/__tests__/liveness.test.ts) establish that
boundary; hosted overlap and active-run continuity require separate qualification.
Automated: [static UI idle completion](../../server/src/__tests__/static-ui-idle.test.ts)
covers real aborted file streams, disconnects before file lookup, nested routers,
and unfinished parent/fallback writes. Mounted Express applications retain their
conservative hold. It does not qualify provider cleanup or a hosted sleep/wake cycle.
Manual: On an otherwise idle disposable instance, close a static UI download
served by the admitted application before it finishes. Repeat with a disconnect
before headers arrive. Confirm that neither leaves a permanent request hold. An
unfinished application write must still prevent sleep after its client leaves.
### `settings-backup`
Automated: [experimental settings](../../ui/src/pages/InstanceExperimentalSettings.test.tsx) and [database backup routes](../../server/src/__tests__/instance-database-backups-routes.test.ts) cover their UI/API contracts.
Cloud migration: in one maintenance window, stop legacy file writers and run the
[configuration/package qualification command](../../doc/cloud-configuration-migration.md).
Inspect its database receipt, update a saved preference, then repeat against a
second owned application/image root with the first home unavailable. Use an
explicit package evidence digest for same-package comparison. Confirm stale
qualification and missing legacy files cannot clear blockers. This recipe covers
configuration/packages and does not qualify whole-server zero downtime, secret
bytes, or volume removal. [Local PostgreSQL evidence path](../../server/src/__tests__/cloud-configuration-migration-postgres.test.ts)
includes a real fixture worker; it does not establish a hosted replacement.
Manual: Change a harmless experimental setting, reload, and confirm the affected route honors it. Back up a disposable instance, inspect the reported file and metadata, and restore using the documented procedure into a second isolated target. Verify a known record after restoration.
Cloud staging: On a managed `*.staging.paperclip.app` instance, verify experiments
are visible, Cloud-enabled controls are locked on, and other experiments are
editable by a Cloud stack Admin or instance admin with changes surviving reload.
With an old stored false value and a Cloud true value, verify the effective
setting is true and an API attempt to disable it returns 403 without saving.
Repeat the enabled-feature check on production and managed stacks without a hostname.
As a stack Admin, verify a harmless experiment saves while general instance
settings and task-drain operations remain denied. Demote that user to Member
and verify the next experimental write is denied.
Production keeps its hidden controls and managed feature values. Staging retains
other Cloud restrictions. [Settings policy tests](../../server/src/__tests__/instance-settings-managed-overlay.test.ts),
[route tests](../../server/src/__tests__/instance-settings-routes.test.ts), and
[health tests](../../server/src/__tests__/health.test.ts) exercise simulated Cloud
identities and persistence; they do not establish a deployed staging walkthrough.
### `runtime-provisioning`
Automated: [Runtime commands](../../cli/src/__tests__/runtime.test.ts), [setup](../../cli/src/__tests__/runtime-setup.test.ts), [remote Pi companion](../../server/src/__tests__/remote-pi-companion.test.ts), and [Pi package provisioning](../../packages/paperclip-runner/scripts/provision-pi-package.test.mjs) cover parsing, fixtures, package identity, and integrity. They do not qualify every published installation or live provider.
Manual: Use a disposable published installation and its exact runtime release. Run setup for the intended host runtime, inspect verified version/path, and repeat to confirm the existing installation is reused. Test a corrupt, linked, or foreign installation and verify rejection preserves unrelated files. Import a matching Linux x64 Pi companion with an independently trusted manifest digest; repeat for verified_existing, then alter manifest, inventory, source/profile identity, or target files and verify failure without replacing unrelated state. Inspect cleanup/cancellation. Finally use the selected adapter/account to run a bounded task separately: installed bytes do not prove model execution.
Sources: [Runtime CLI](../../cli/src/commands/runtime.ts), [instance-config bypass](../../cli/src/index.ts), [Pi provisioning](../../packages/paperclip-runner/scripts/provision-pi.mjs), [Cursor provisioning](../../packages/paperclip-runner/scripts/provision-cursor.mjs), and [companion importer](../../server/src/services/native-runtime/remote-pi-companion.ts).
Antigravity: [provisioning](../../packages/paperclip-runner/scripts/provision-antigravity.mjs),
[closure/integrity regressions](../../packages/paperclip-runner/scripts/materialize-antigravity-distribution.test.mjs),
and [pending admission tests](../../packages/paperclip-runner/src/drivers/acpx/antigravity-models.test.ts).
Exercise public-layout setup and verify both native files and cleanup; separately
verify that configuration/API/driver/sidecar reject the pending provider. These
checks do not establish authenticated task execution.
## Gotchas
- Runtime setup operates on a published installation and verifies package assets. It is not a substitute for an account connection, environment qualification, or a useful task run.
- Source-checkout update/check commands report manual update guidance; they do
not qualify a managed installation. Rollback restores retained CLI payloads,
not database migrations. Service status applies to its selected service
identity, not automatically to an owned foreground dev server.
- A successful backup write does not prove restoration works.
- Settings visibility and mutability differ for cloud-managed and self-hosted instances.
- Keep the three data paths distinct: first-party Telemetry, operator-configured OpenTelemetry, and local run logs.
### Storybook verification
#### `backup`
Capability ID: `instance-operations/backup`.
Scope: ui
Storybook: Mount shipped InstanceGeneralSettings in CompanySettings with daily/weekly/monthly retention presets, selected values, saving/error/loading and cloud-hidden controls. Backup creation and restore remain separate CLI/operator checks.
Production: PATCH /api/instance/settings/general must enforce instance settings authority and managed hidden fields, persist retention and survive reload. Separately inspect a real backup and restore a known record into a second disposable target; a successful write does not prove restoration.
Sources: Source: [InstanceGeneralSettings.tsx](../../ui/src/pages/InstanceGeneralSettings.tsx), [CompanySettings.tsx](../../ui/src/pages/CompanySettings.tsx), [instance-settings.ts](../../server/src/routes/instance-settings.ts), [db-backup.ts](../../cli/src/commands/db-backup.ts). Tests: [InstanceGeneralSettings.test.tsx](../../ui/src/pages/InstanceGeneralSettings.test.tsx), [instance-settings-routes.test.ts](../../server/src/__tests__/instance-settings-routes.test.ts), [instance-settings-managed-overlay.test.ts](../../server/src/__tests__/instance-settings-managed-overlay.test.ts), [instance-database-backups-routes.test.ts](../../server/src/__tests__/instance-database-backups-routes.test.ts)
#### `install-update`
Capability ID: `instance-operations/install-update`.
Scope: cli
Storybook: No authored story required for install, channel selection, update or rollback command execution.
Production: Use an owned managed installation: check/dry-run, installed version, retained payload rollback and failure. Source-checkout guidance is a separate case; rollback does not undo database migrations.
Sources: Source: [index.ts](../../cli/src/index.ts), [install.ts](../../cli/src/commands/install.ts), [update.ts](../../cli/src/commands/update.ts). Tests: [install-command.test.ts](../../cli/src/__tests__/install-command.test.ts), [update-command.test.ts](../../cli/src/__tests__/update-command.test.ts)
#### `diagnostics`
Capability ID: `instance-operations/diagnostics`.
Scope: cli
Storybook: No authored story required for doctor/health command results.
Production: Run doctor against an owned data directory; check readiness and nonzero failures. A listening port alone does not prove readiness; repair requires observing the repaired result.
Sources: Source: [doctor.ts](../../cli/src/commands/doctor.ts). Tests: [doctor.test.ts](../../cli/src/__tests__/doctor.test.ts)
Reference in new issue View Git Blame Copy Permalink