nightly: referenced catalog skills (last30days), routine pause-suppression, company archive cascade

Cumulative window v2026.529.0 → e78c064 (24h-quarantined nightly cutoff).
Three user-visible surfaces newly documented this run:

- skills: app-shipped catalog now supports *referenced* entries fetched from
  an external GitHub repo pinned to a commit (CatalogSkill.source). First one
  is the research-category last30days skill. Documented in the Skills
  reference and the org Skills guide.
- routines: scheduled ticks are suppressed (recorded as skipped, no backfill)
  while the routine's project is paused.
- companies: archiving runs a cascade that pauses active agents
  (pauseReason company_archived) and cancels queued wake-ups.

All claims verified against parent code (Phase 5.5 clean). Build + link/nav
checks pass; no drift. Teams Catalog, company-artifacts page, and low-trust
review containment are quarantined (<24h) and deferred to the next run.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
This commit is contained in:
Aron PrinsandClaude Opus 4.8 committed 2026-06-06 15:56:57 +02:00
1 parent f78e67f361
commit 44d4c5d604
8 files changed
+78 -63

No files matched your search

+3 -3
View File
@@ -2,8 +2,8 @@
"branch_mode": "nightly",
"base_release_tag": "v2026.529.0",
"base_release_sha": "911a1e8b0d24205acd5006e837a5c5e8c4bfb447",
"last_seen_parent_sha": "1227bb8ead79c827c06d027d409f9ace71bfc7ba",
"last_applied_manifest_hash": "32ccf66baa0fd6d08019528bfc23b40b9526a40c951d1ccdee353eaff111916e",
"last_run_at": "2026-06-04T19:10:00Z",
"last_seen_parent_sha": "a4fa0eaf5ea62b3289b45fe52218ccdce6760891",
"last_applied_manifest_hash": "6e534b51ab288451f311df6cafd32874387538f49ec9a70623b603d3b1125edd",
"last_run_at": "2026-06-06T13:10:00Z",
"last_run_outcome": "applied"
}
+45 -36
View File
@@ -3,63 +3,72 @@
> Regenerated by `/sync-docs` every nightly run. Cumulative from `base_release_tag`.
- **Base release tag:** `v2026.529.0`
- **Parent window:** `v2026.529.0` → parent `master` HEAD `1227bb8`, effective cutoff `03e1e3ab` (24h quarantine)
- **Commits in window:** 34 effective (quarantined commits younger than 24h deferred to next run)
- **Doc-relevant manifest entries:** 3 new this run
- **Parent window:** `v2026.529.0` → parent `master` HEAD `a4fa0ea`, effective cutoff `e78c064` (24h quarantine)
- **Commits in window:** 72 effective (quarantined commits younger than 24h deferred to next run)
- **Doc-relevant manifest entries:** 3 new this run; 4 carried from prior runs
- **Drift candidates:** 0 (check-drift.mjs against master)
- **Reconciliation candidates:** 0 (cumulative base is the release tag; nothing previously applied was reverted upstream)
- **Reconciliation candidates:** 0 (nothing previously applied was reverted upstream)
- **Genuine new dirs (rename-checked):** none
## ⏳ Quarantined this run (deferred to next run)
These landed within the last 24h, so they are held back until reverts have time to settle. Expect them in the next nightly manifest:
- **Teams Catalog** (`fff3832a`, #7550) — new `packages/teams-catalog/**` package, `server/src/routes/teams-catalog.ts`, `ui/src/pages/TeamCatalog.tsx`. A brand-new product surface (installable team templates). Will need a new doc page next run.
- **Company artifacts page** (`4693d770`, #7621) — `server/src/services/company-artifacts.ts`, `ui/src/pages/Artifacts.tsx`.
- **Low-trust review containment** (`dbebf30c`, #7530) — `packages/shared/src/trust-policy.ts`, `server/src/services/source-trust.ts`, `trust-preset-resolver.ts`, `low-trust-runtime-containment.ts`, UI `TrustPresetSection`. New trust-presets feature.
- Comment redaction / deleted-comment cleanup, operator QoL (routines-by-project default, archived-routine hiding, inline video previews).
## Auto-merge
_None._ No `.env.example` / config / env-schema changes in the window — the env-vars watcher matched nothing.
## PR-tier — applied this run
### 1. CLI API-parity coverage (#6626) — full CLI reference handbook
### 1. `last30days` catalog skill + referenced (external-source) catalog entries
- **Watcher:** cli-commands
- **Parent files:** `cli/src/index.ts` + `cli/src/commands/client/*.ts` (12 new command groups: `project`, `goal`, `cost`, `token`, `connect`, `prompt`, `run`, `workspace`, `adapter`, `asset`, `skill`, `routine-api`, plus the large `access` group; modifications across `activity`, `agent`, `approval`, `auth`, `cloud`, `company`, `context`, `dashboard`, `feedback`, `issue`, `plugin`, `secrets`, `configure`, `worktree`).
- **Change kind:** added + modified.
- **Surface:** Parent shipped a large CLI/API-parity push — full client command coverage for the control plane from the terminal. This was in **quarantine** the previous run (commit `70b1a91`, <24h old then) and became eligible this run.
- **Decision (with maintainer):** Adopt the comprehensive, pre-written CLI handbook from `paperclip-cli/cli-documentation` as the **per-command reference**, replacing the single-page `commands.md` monolith. The guide/runbook track (operating-model, autonomous-operation, recipes, AI-operator) is **deferred** to a later expansion. No new top-level tier — everything stays under **Reference → CLI**.
- **Docs targets (28 pages under `docs/reference/cli/`):** `overview`, `installation`, `common-options`, `output-and-scripting`, `setup-commands`, `dev-environments`, `authentication` (auth/token/connect/context), `company`, `project`, `goal`, `issue`, `agent`, `prompt`, `run`, `routine`, `adapter`, `approval`, `activity`, `dashboard`, `cost`, `workspace`, `access`, `skills`, `secrets`, `cloud`, `plugin`, `asset`, `feedback`.
- **Retired:** `docs/reference/cli/commands.md` and `docs/reference/cli/control-plane-commands.md` → converted to "moved" tombstones + route redirects in `site/redirects.json` (`reference/cli/commands` & `…/control-plane-commands` → `reference/cli/overview`).
- **Nav:** `site/content.json` CLI section rebuilt to the 28-page list.
- **Inbound link fixups:** `docs/reference/skills.md`, `docs/how-to/sync-to-cloud-upstream.md` repointed off the retired pages.
- **Verification (Phase 5.5):** all new command pages verify clean against parent. One verify-edit "unverified" on `access.md:95 --claim-secret` is a **tooling false negative** — parent declares it via `.requiredOption(...)` (cli/src/commands/client/access.ts:197), which `verify-edit.mjs` does not scan (it only greps `.option(`). The doc claim is correct.
### 2. `wireframe` app-shipped catalog skill
- **Watcher:** skills-catalog (newly added watcher — see note below)
- **Parent files:** `packages/skills-catalog/catalog/bundled/product/wireframe/SKILL.md` (new), `packages/skills-catalog/generated/catalog.json` (modified).
- **Watcher:** skills-catalog
- **Parent files:** `packages/skills-catalog/catalog/optional/research/last30days/catalog-ref.json` (new), `packages/skills-catalog/src/types.ts`, `packages/skills-catalog/src/catalog-builder.ts`, `packages/skills-catalog/generated/catalog.json` (modified).
- **Change kind:** added.
- **Surface:** A new **bundled**, `product`-category catalog skill that produces low-fidelity black-and-white UI wireframes as standalone SVG files (recommended for `designer`/`product`/`engineer`; `defaultInstall: false`). Flagged as an anchor-map gap last run; the `skills-catalog` watcher has since been added, so it was caught automatically this run.
- **Docs targets:** `docs/reference/skills.md` (App-shipped catalog), `docs/guides/org/skills.md` (catalog flavours).
- **Surface:** The app-shipped catalog gained its first **referenced** entry — a catalog skill whose bytes are not bundled in the app but fetched from an external GitHub repo pinned to a commit (`CatalogSkill.source`, a `CatalogSkillGitHubSource`). `last30days` (optional, `research` category, `defaultInstall: false`) is sourced from `github.com/mvanhorn/last30days-skill` at `v3.3.0` / commit `daca71f`.
- **Docs targets:** `docs/reference/skills.md` (App-shipped catalog — new "Where a catalog skill's bytes come from" paragraph, `last30days` example, `source` field in the `CatalogSkill` inventory), `docs/guides/org/skills.md` (optional flavours + external-source note).
- **Verification (Phase 5.5):** clean.
### 3. OpenAPI document endpoint
### 2. Routine scheduled-tick suppression while project is paused
- **Watcher:** rest-routes
- **Parent files:** `server/src/routes/openapi.ts` (new).
- **Change kind:** added.
- **Surface:** The server now publishes a machine-readable OpenAPI document at `GET /api/openapi.json` (also fetchable via `paperclipai access openapi`).
- **Docs targets:** `docs/reference/api/overview.md` (new "OpenAPI Specification" subsection). CLI side covered by the new `access` page.
- **Watcher:** server-services
- **Parent files:** `server/src/services/routines.ts` (#7502, TON-2139).
- **Change kind:** modified.
- **Surface:** When a routine's project is paused, scheduled ticks no longer create work — they are recorded as a `skipped` run (`failureReason: "Skipped because the project is paused"`), the schedule advances, and the missed tick is not backfilled on resume.
- **Docs targets:** `docs/reference/api/routines.md` (run-status table `skipped` row + Practical Notes).
- **Verification (Phase 5.5):** clean.
## Considered, not documented
### 3. Company archive cascade pauses agents
- **`server/src/services/*` changes** (board-auth, issues, plugin-loader, plugin-tool-dispatcher, routines) — internal/behavioural; no user-visible surface shift in the eligible window (the routines pause feature lands in a quarantined commit — see below).
- **`ui/src/components/StandaloneBrowserControls`, `pwa-display-mode`, issue-output internals** — already folded into the issue-artifacts narrative documented in the prior run (`docs/guides/day-to-day/issues.md`, `docs/reference/api/issues.md`).
- **`.github/**`, dependabot, dep bumps** — repo CI/infra, not a product surface.
- **Watcher:** server-services / schemas
- **Parent files:** `server/src/services/companies.ts` (#7478), `packages/shared/src/constants.ts` (`PAUSE_REASONS` gained `company_archived`).
- **Change kind:** modified.
- **Surface:** Archiving a company now pauses every active agent (`pauseReason: "company_archived"`) and cancels their queued/in-flight wake-up requests, so an archived company stops doing background work. Non-destructive.
- **Docs targets:** `docs/administration/company.md` (Danger Zone), `docs/reference/api/companies.md` (Archive or delete).
- **Verification (Phase 5.5):** clean.
## PR-tier — applied in prior runs (carried in cumulative window)
These remain in the cumulative diff from `v2026.529.0` and were authored in earlier nightly runs; no re-work needed:
1. **CLI API-parity handbook** — 28 reference pages under `docs/reference/cli/` (window through `03e1e3ab`).
2. **`wireframe` bundled catalog skill** — `docs/reference/skills.md`, `docs/guides/org/skills.md`.
3. **OpenAPI document endpoint** — `docs/reference/api/overview.md`.
4. **Issue artifacts** (output playback, attachment streaming, skill upload) — `docs/reference/api/issues.md`, `docs/reference/skills.md`.
## ⚠ Drift
_None._
## ↻ Renames detected
## ⚠ Reconcile
_None._
## In quarantine (deferred to next run, <24h old at run time)
## Screenshots
- `d60f50e4` **feat(routines): suppress scheduled ticks while project is paused (TON-2139)** — user-facing routine behaviour; document next run once it clears quarantine.
- `bc0a076e` fix(ui): stop linking foreign tracker keys as Paperclip issues · `1227bb8e` Improve OpenAPI spec coverage and auth metadata · `244a5b80` plugins: allow agent JWTs to access plugin tool endpoints · `93206f73` stop archived companies from waking agents · `62863126` plugin-tool-dispatcher fix · plus dependabot/dep-bump commits.
10 stale entries flagged in `SCREENSHOTS_PENDING.md` (issue detail/list views, from the issue-artifacts UI changes). Recapture with `npm run screenshots:refresh` — PNGs go to a PR for human review, never auto-pushed.
+16 -17
View File
@@ -1,22 +1,21 @@
# Screenshots — pending recapture
> Regenerated by `/sync-docs` (nightly mode). Entries whose `depends_on` parent paths changed in the cumulative window.
> Regenerated by `/sync-docs` each nightly run. Lists screenshots whose `depends_on` parent paths changed in the current diff window.
- **Window:** `v2026.529.0` → parent `master` `1227bb8`, effective cutoff `03e1e3ab` (24h quarantine)
- **Stale entries:** 10 of 276
- **Recapture:** `npm run screenshots:refresh` (stale only) or `npm run screenshots:refresh:all` (full). Output PNGs land in a PR for human review — never auto-pushed.
- **Window:** `v2026.529.0` → `e78c0646` (24h-quarantined nightly cutoff)
- **Stale entries:** 10
## `ui/src/pages/IssueDetail.tsx` — 10
Recapture with `npm run screenshots:refresh` (PNGs land in a PR for human review — never auto-pushed).
> The **Output** section (inline video playback for agent artifacts) and the reworked attachment previews render inside `IssueDetail.tsx`. The `IssueAttachmentsSection.tsx` and `issue-output/*` components are still not tracked in `registry.json` — consider adding registry entries that capture an issue with a video/file artifact once these screenshots are recaptured. (Unchanged from the prior run — the issue-artifacts UI remains in the cumulative window.)
- `dark/issues/detail-activity.png`
- `dark/issues/detail-chat.png`
- `dark/issues/detail-sidebar.png`
- `dark/issues/list.png`
- `dark/tasks/task-detail-with-comments.png`
- `light/issues/detail-activity.png`
- `light/issues/detail-chat.png`
- `light/issues/detail-sidebar.png`
- `light/issues/list.png`
- `light/tasks/task-detail-with-comments.png`
| Screenshot | Route | Changed dependency |
|---|---|---|
| `dark/issues/detail-activity.png` | `/ACME/issues/{issueId}` | `ui/src/pages/IssueDetail.tsx` |
| `dark/issues/detail-chat.png` | `/ACME/issues/{issueId}` | `ui/src/pages/IssueDetail.tsx` |
| `dark/issues/detail-sidebar.png` | `/ACME/issues/{issueId}` | `ui/src/pages/IssueDetail.tsx` |
| `dark/issues/list.png` | `/ACME/issues` | `ui/src/pages/IssueDetail.tsx` |
| `dark/tasks/task-detail-with-comments.png` | `/ACME/issues/{issueId}` | `ui/src/pages/IssueDetail.tsx` |
| `light/issues/detail-activity.png` | `/ACME/issues/{issueId}` | `ui/src/pages/IssueDetail.tsx` |
| `light/issues/detail-chat.png` | `/ACME/issues/{issueId}` | `ui/src/pages/IssueDetail.tsx` |
| `light/issues/detail-sidebar.png` | `/ACME/issues/{issueId}` | `ui/src/pages/IssueDetail.tsx` |
| `light/issues/list.png` | `/ACME/issues` | `ui/src/pages/IssueDetail.tsx` |
| `light/tasks/task-detail-with-comments.png` | `/ACME/issues/{issueId}` | `ui/src/pages/IssueDetail.tsx` |
+2
View File
@@ -55,6 +55,8 @@ Below the feedback section, a **Company Packages** panel links out to the dedica
At the bottom of the page is a **Danger Zone** with an **Archive company** button. Archiving hides the company from the sidebar and persists the change in the database. A confirmation dialog appears before the archive takes effect, and the UI automatically switches you to the next non-archived company if one is available.
Archiving also quiets the company so it stops doing work in the background: every active agent is paused (with the pause reason `company_archived`), and any queued or in-flight wake-up requests are cancelled. Archiving is not destructive — unlike deletion, your agents, projects, and issues are all preserved — but the company will not wake its agents again until you bring it back.
---
## Access & Members
+4 -2
View File
@@ -96,9 +96,11 @@ You don't have to write every skill from scratch. Paperclip ships with a built-i
The catalog comes in two flavours:
- **Bundled** skills are the everyday kit — things like keeping docs maintained, triaging issues, planning tasks, running QA acceptance, managing a GitHub PR workflow, and sketching low-fidelity UI **wireframes**.
- **Optional** skills are extras you add when you need them — for example, browser-driving an agent, drafting a release announcement, or running a design critique.
- **Optional** skills are extras you add when you need them — for example, browser-driving an agent, drafting a release announcement, running a design critique, or researching what people have said about a topic in the last 30 days.
The catalog isn't only for engineers. Design and product roles get a head start too: the `wireframe` skill, for instance, lets an agent draft black-and-white, low-fidelity screen layouts as SVG files before anyone commits to building the real thing — handy for a designer or product agent who wants to show structure first. "Bundled" doesn't mean "forced on everyone": you still browse, pick, and install the ones you want.
The catalog isn't only for engineers. Design, product, and research roles get a head start too: the `wireframe` skill, for instance, lets an agent draft black-and-white, low-fidelity screen layouts as SVG files before anyone commits to building the real thing — handy for a designer or product agent who wants to show structure first — and the `last30days` skill pulls recent posts and engagement from across the web so a researcher or marketer can see what people are actually saying about a topic right now. "Bundled" doesn't mean "forced on everyone": you still browse, pick, and install the ones you want.
A few catalog skills aren't shipped inside the app at all — they're pulled from an external repository pinned to a specific version. You install and update them the same way; Paperclip just fetches the files on your behalf. Either way the app knows the exact version you have, so the keep-it-current, audit, and reset features below work for every catalog skill.
Browse the catalog, pick a skill, and install it into your company library. Installing puts the skill in the library only — it doesn't attach it to any agent, so you stay in control of who uses it. From there it behaves like any other installed skill: open it, read its `SKILL.md`, and assign it to the agents that need it.
+1 -1
View File
@@ -344,7 +344,7 @@ POST /api/companies/{companyId}/archive
DELETE /api/companies/{companyId}
```
Archiving changes the company status to `archived` and removes it from default listings. Deleting removes the company and its related data. Deletion is destructive and should be treated as irreversible.
Archiving changes the company status to `archived` and removes it from default listings. It also runs a cascade that pauses every active agent in the company (pause reason `company_archived`) and cancels their queued or in-flight wake-up requests, so an archived company stops doing background work. Deleting removes the company and its related data. Deletion is destructive and should be treated as irreversible.
---
+2 -1
View File
@@ -668,7 +668,7 @@ Routine runs use these statuses:
|---|---|
| `received` | The run was accepted and is being processed. |
| `coalesced` | A live execution already existed, so this run linked to it. |
| `skipped` | A live execution already existed, and the concurrency policy chose to skip. |
| `skipped` | The run did not create work. Either a live execution already existed and the concurrency policy chose to skip, or the routine's project was paused at tick time. Read `failureReason` to tell them apart — a paused project records `failureReason: "paused"` (the trigger's last result spells it out as `Skipped because the project is paused`). |
| `issue_created` | A new execution issue was created. |
| `completed` | The execution issue later moved to `done`. |
| `failed` | The execution issue failed, was cancelled, or the dispatch failed. |
@@ -705,6 +705,7 @@ Board operators need `tasks:assign` permission for actions that assign work to a
- Webhook triggers mint a company secret behind the scenes.
- The public webhook URL does not change when you rotate the secret.
- If a routine is archived, it will not fire again.
- If the routine's project is paused, scheduled ticks are suppressed: the firing is recorded as a `skipped` run and the schedule advances to the next tick, but no execution issue is created and the missed tick is **not** backfilled when the project resumes.
- If a run finds an active live execution issue and the concurrency policy is not `always_enqueue`, the run is linked or skipped instead of creating new work.
If you are wiring this from code, the common path is:
+5 -3
View File
@@ -202,9 +202,11 @@ Catalog skills are split into two **kinds** (`CatalogSkillKind`):
| Kind | Meaning | Examples |
|---|---|---|
| `bundled` | Core skills the app considers part of the baseline kit. | `doc-maintenance`, `issue-triage`, `task-planning`, `qa-acceptance`, `github-pr-workflow`, `wireframe` |
| `optional` | Extra skills you opt into when you need them. | `agent-browser`, `release-announcement`, `design-critique` |
| `optional` | Extra skills you opt into when you need them. | `agent-browser`, `release-announcement`, `design-critique`, `last30days` |
Each catalog skill also carries a `category` you can filter on. Most of the baseline kit is coding- and process-oriented, but the catalog is not limited to engineering work — for example, the `product`-category **`wireframe`** skill teaches an agent to produce low-fidelity, black-and-white UI wireframes as standalone SVG files (recommended for `designer`, `product`, and `engineer` roles). A bundled skill is not the same as a *required* one: `wireframe` ships in the baseline kit but installs only when you choose it (its `defaultInstall` is `false`), so designers and product folks can pull it in without it being forced on every agent.
Each catalog skill also carries a `category` you can filter on. Most of the baseline kit is coding- and process-oriented, but the catalog is not limited to engineering work — for example, the `product`-category **`wireframe`** skill teaches an agent to produce low-fidelity, black-and-white UI wireframes as standalone SVG files (recommended for `designer`, `product`, and `engineer` roles), and the `research`-category **`last30days`** skill (recommended for `researcher`, `marketer`, `product-manager`, and `analyst` roles) researches what people have said about a topic across Reddit, X, YouTube, and the rest of the web in the last 30 days. A bundled skill is not the same as a *required* one: `wireframe` ships in the baseline kit but installs only when you choose it (its `defaultInstall` is `false`), so designers and product folks can pull it in without it being forced on every agent.
**Where a catalog skill's bytes come from.** Most catalog skills are shipped inside the app itself. A few are **referenced** instead — they point at an external GitHub repository pinned to a single commit, and the app fetches their files for you. `last30days`, for example, is sourced from `github.com/mvanhorn/last30days-skill` at a pinned commit. You install and manage a referenced skill exactly like any other catalog skill; the only difference is that its `source` field tells you where it originally came from (owner, repo, the `ref`/`commit` it is pinned to, and a browseable `url`). Because the pin is a specific commit, you still get the same byte-exact, version-tracked guarantees as a fully bundled skill.
Once installed, a catalog skill becomes an ordinary company-skill row, but it is tagged as **catalog-managed**: its `sourceType` is `catalog` and its `metadata.sourceKind` is `catalog`. The catalog kind (`bundled` / `optional`) is carried through on `metadata.catalogKind`, and the byte-exact origin it was pinned to is stored in `metadata.originHash`.
@@ -226,7 +228,7 @@ The list route accepts three optional query filters:
- `category` — exact-match on the skill's category.
- `q` — free-text query matched against the skill's id, key, slug, name, description, category, kind, recommended roles, and tags.
Each catalog entry (`CatalogSkill`) carries `id`, `key`, `kind`, `category`, `slug`, `name`, `description`, `trustLevel`, `compatibility`, `defaultInstall`, `recommendedForRoles`, `requires`, `tags`, a `files[]` inventory (each with `path`, `kind`, `sizeBytes`, `sha256`), and a `contentHash` — the byte-exact identity of the shipped skill.
Each catalog entry (`CatalogSkill`) carries `id`, `key`, `kind`, `category`, `slug`, `name`, `description`, `trustLevel`, `compatibility`, `defaultInstall`, `recommendedForRoles`, `requires`, `tags`, a `files[]` inventory (each with `path`, `kind`, `sizeBytes`, `sha256`), and a `contentHash` — the byte-exact identity of the shipped skill. Referenced skills (the ones fetched from an external repo) also carry an optional `source` object describing where the bytes came from: `type` (`github`), `hostname`, `owner`, `repo`, the `ref` and `commit` it is pinned to, the `path` inside the repo, and a browseable `url`.
The files route returns one file at a time. By default it reads `SKILL.md`; pass `?path=references/example.md` to read another file in the inventory. Asset files are not previewable.