paperclip/doc
Dotta bfe6369ef5
Guard cheap recovery model usage (#6371)
## Thinking Path

> - Paperclip is the control plane that coordinates AI-agent work
through issues, heartbeats, comments, approvals, and auditable recovery
paths.
> - The affected subsystem is heartbeat/recovery orchestration,
especially the optional cheap model profile used for operational
recovery overhead.
> - Cheap recovery should repair status and liveness, but it must not
become the worker lane that writes deliverables, continues source work,
or propagates cheap execution hints into downstream retries.
> - The gap was that cheap-profile hints could follow recovery wake
contexts and assignment overrides farther than intended, making real
work eligible to run on the cheap model.
> - This pull request separates status-only cheap recovery from normal
source-work continuations, adds route guards for deliverable mutations
during cheap status-only runs, and documents the invariant.
> - The benefit is safer retry/recovery behavior: cheap runs can clean
up control-plane state, while any remaining source work resumes through
a normal/original model path.

## What Changed

- Added recovery model-profile work classes so status-only recovery
carries explicit guard context and normal-model continuations scrub
cheap hints.
- Updated heartbeat, productivity review, liveness continuation, and
recovery service wakeups to request cheap only for bounded status-only
recovery work.
- Blocked cheap status-only recovery runs from writing issue documents,
plans, attachments, work products, or assigning downstream work back to
`modelProfile: "cheap"`.
- Added/updated server tests for cheap profile propagation,
artifact/document guards, route authorization, retry scheduling, and
successful-run handoff behavior.
- Documented the recovery model-profile lane in
`doc/SPEC-implementation.md` and `doc/execution-semantics.md`.
- After rebasing onto current `public-gh/master`, stabilized the new
`InstanceSidebar` plugin-filter tests so the PR check lane stays green.

## Verification

- Local: `pnpm exec vitest run --config vitest.config.ts
src/services/recovery/model-profile-hint.test.ts
src/__tests__/issue-agent-mutation-ownership-routes.test.ts
src/__tests__/issue-document-restore-routes.test.ts` from `server/` - 3
files, 37 tests passed after final edits.
- Local: `pnpm exec vitest run --config vitest.config.ts
src/__tests__/heartbeat-process-recovery.test.ts` from `server/` - 44
tests passed after rerunning the cleanup-sensitive file alone.
- Local: `pnpm --filter @paperclipai/ui exec vitest run
src/components/InstanceSidebar.test.tsx` - 4 tests passed.
- Local: `pnpm --filter @paperclipai/server typecheck` - passed.
- Local: `pnpm --filter @paperclipai/ui typecheck` - passed.
- PR checks on latest head `6f8c3b1380f5bd872c6f49f6f7188ecf3bb6d263` -
all green, including `verify`, build, typecheck,
server/general/serialized tests, e2e, Snyk, and policy.
- Greptile: pass 3 returned Confidence Score 5/5 with zero unresolved
Greptile review threads.

## Risks

- Medium risk: recovery behavior is intentionally stricter, so any path
that incorrectly relies on cheap recovery to keep doing source work will
now need to hand back to a normal-model run.
- Low migration risk: no schema changes.
- No product UI changes; the UI file touched is a test-only
stabilization after rebasing onto current `master`.

> For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and
discuss it in `#dev` before opening the PR. Feature PRs that overlap
with planned core work may need to be redirected — check the roadmap
first. See `CONTRIBUTING.md`.

## Model Used

- OpenAI Codex coding agent, GPT-5 model family (`gpt-5`), tool use and
local code execution enabled; context window not exposed in this
environment.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] If this change affects the UI, I have included before/after
screenshots (N/A: no product UI changes)
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
2026-05-19 13:46:02 -05:00
..
assets Add planning mode for issue work (#5353) 2026-05-06 07:01:28 -05:00
experimental updating paths 2026-03-10 14:43:34 -05:00
plans Scale issue kanban board for high-volume columns (#5309) 2026-05-15 10:53:09 -05:00
plugins docs: update plugin authoring guide for managed resources (#6261) 2026-05-18 10:14:27 -05:00
pr/5429 Add secrets provider vaults and remote import (#5429) 2026-05-09 18:22:17 -05:00
spec [codex] Add run liveness continuations (#4083) 2026-04-20 06:01:49 -05:00
AGENTCOMPANIES_SPEC_INVENTORY.md Add routine support to recurring task portability 2026-03-23 16:57:38 -05:00
CLI.md [codex] Add LLM Wiki plugin host support (#5597) 2026-05-10 07:34:12 -05:00
CLIPHUB.md refactor: rename packages to @paperclipai and CLI binary to paperclipai 2026-03-03 08:45:26 -06:00
DATABASE.md [codex] Add routine env secrets support (#6212) 2026-05-17 16:30:34 -05:00
DEPLOYMENT-MODES.md feat: implement multi-user access and invite flows (#3784) 2026-04-17 09:44:19 -05:00
DEVELOPING.md [codex] Add LLM Wiki plugin host support (#5597) 2026-05-10 07:34:12 -05:00
DOCKER.md chore(docker): improve base image and organize docker files 2026-04-01 11:36:27 +00:00
execution-semantics.md Guard cheap recovery model usage (#6371) 2026-05-19 13:46:02 -05:00
GOAL.md [codex] Refresh docs and agent skills (#4693) 2026-04-28 16:12:03 -05:00
memory-landscape.md chore: improve worktree tooling and security docs 2026-04-10 22:26:30 -05:00
OPENCLAW_ONBOARDING.md Introduce bind presets for deployment setup 2026-04-11 07:09:07 -05:00
PRODUCT.md [codex] Refresh docs and agent skills (#4693) 2026-04-28 16:12:03 -05:00
PUBLISHING.md fix(ci): gate new release packages on npm bootstrap (#5146) 2026-05-03 19:31:28 -07:00
README-draft.md docs: add README, draft README, and adapter logo assets 2026-03-02 10:31:59 -06:00
RELEASE-AUTOMATION-SETUP.md fix(ci): gate new release packages on npm bootstrap (#5146) 2026-05-03 19:31:28 -07:00
RELEASING.md Harden release flow with registry verification and dist-tag checks (#4800) 2026-04-29 15:56:20 -07:00
SECRETS-AWS-PROVIDER.md Add secrets provider vaults and remote import (#5429) 2026-05-09 18:22:17 -05:00
SPEC-implementation.md Guard cheap recovery model usage (#6371) 2026-05-19 13:46:02 -05:00
SPEC.md docs: update SPEC work artifacts and deprecate bootstrapPromptTemplate 2026-03-26 07:23:09 -05:00
TASKS-mcp.md Add product spec and MCP task interface docs 2026-02-16 19:07:30 -06:00
TASKS.md Add task management data model spec 2026-02-16 14:25:00 -06:00
UNTRUSTED-PR-REVIEW.md chore(docker): improve base image and organize docker files 2026-04-01 11:36:27 +00:00