Paperclip July 2026 Newsletter: Agent Attribution Fixes, Telemetry Contracts, Sandbox & Workspace Recovery

Issue #7 — Highlights from July 1–31, 2026 · 377 total commits · 200 commit summaries included in this report. If you build, self-host, or extend Paperclip — the open-source orchestration layer for AI agents — these changes affect how agents interact with issues, how you manage workspaces, and how your telemetry pipeline validates events.

🐛 Agent Comments No Longer Render as "Board"

Agent-authored comments on issue threads were mislabeled as right-aligned "Board" bubbles when the author was a non-human local-board / system user. This was confusing for human overseers and could trigger false wake/reconciliation logic for agents.

The fix: Server-side attribution now resolves the authoring agent via a lossless run-ID join first, then checks an explicit run-log post marker. The resolved agent is persisted so reads no longer rescan run logs. Genuine human board comments are never reattributed.

fb2b760 — fix(issues): attribute agent-authored comments instead of rendering them as "Board"

🧠 Issue-Thread Interaction Lifecycle

Ask-User Questions Now Supersede on New Comments

Pending ask_user_questions interactions could stay open after a later board/user comment effectively answered the request. Confirmation interactions already had this supersede-on-comment behavior — questions now follow the same lifecycle, including an amber "expired" state with a jump link to the superseding comment. New question interactions default to supersedeOnUserComment: true.

ac9a883 — Expire ask-user questions superseded by comments

Interaction Resolved Telemetry

Paperclip now emits interaction.resolved telemetry from terminal resolution paths (accepted, rejected, answered, stale-target expiry, superseded-by-comment). Aggregate-safe: no raw IDs, answer text, rejection reasons, or document content are exposed. Telemetry failures are logged but do not block the user-visible interaction flow.

3522b1c — Emit interaction resolved telemetry

📡 Generated Telemetry Client Types

First-party telemetry track() now accepts a closed union of generated Paperclip event names instead of an open string. Plugin-defined events use an explicit trackDynamic() method. Helper wrappers pass raw categorical dimensions through to the backend instead of client-side enum coercion — the backend remains the source of truth for normalization.

8a93a0d — Implement generated client telemetry types

🖥️ Managed Workspace Branch Coherence

Managed git workspaces now validate the actual checked-out branch against the recorded execution workspace branch before reuse, heartbeat setup, and finalization. Clean same-HEAD mismatches are repaired automatically; dirty or divergent worktrees fail with explicit workspace_validation_failed evidence and manual-repair next actions.

d68c34f — Fix managed workspace branch coherence recovery

🧪 Sandbox Bridge Credentials & Stalled Review Recovery

Credentials for Sandbox Shells

Sandboxed local adapters now pass bridge credentials through the sandbox runner environment instead of embedding them in the visible command string. The sandbox shell surface can call Paperclip through the bridge without leaking tokens into stdout/stderr or runtime files.

Stalled Execution-Policy Review Recovery

A reviewer run that finishes without recording a decision no longer leaves the source issue in in_review forever. One bounded recovery wake is attempted; exhausted or non-invokable participants escalate to blocked/source-scoped recovery with clear evidence and next-action text.

2eba718 — Fix sandbox bridge credentials and stalled review recovery

🗂️ Environment Custom Images Scoped to Instance

Custom-image templates and setup sessions are now owned by the saved environment instead of requiring a redundant company_id. Secret-backed runtime config still respects company context when secrets are involved. Saved sandbox environment probes also opt into active custom-image template application.

b4815bf — Scope environment custom images to instance environments

🤖 New Model: Gemini 3.1 Pro (gemini-local Adapter)

The gemini-local adapter model dropdown now surfaces gemini-3.1-pro-preview and gemini-3.1-pro-preview-customtools above existing 2.x entries. Users can select the current flagship directly instead of guessing IDs and hitting ModelNotFoundError.

4105984 — feat(gemini-local): add Gemini 3.1 Pro models

♿ Accessibility

aria-pressed on Toggle Buttons

Date range presets (Costs page) and day-of-week selectors (ScheduleEditor) now have aria-pressed={isActive} so screen readers announce which toggle is selected. Previously all buttons sounded identical.

be8ae52 — fix(a11y): add aria-pressed to date preset and day-of-week toggle buttons

ARIA Attributes on Issues View Toggle & Goal Tree

The IssuesList view-mode toggle now has role="group", aria-label, and aria-pressed. GoalTree expand/collapse chevrons now have a stable aria-label and aria-expanded for expanded/collapsed state.

de837e2 — refactor(a11y): issues view toggle aria attributes and goal tree expand buttons

✅ What to Watch Next

• Telemetry contract migration: If you consume Paperclip telemetry, check that your pipeline handles the new generated event types. The trackDynamic() method is available for plugin-defined events.
• Managed workspace validation: Branch drift is now caught earlier for managed git workspaces. Self-hosters should review recovery evidence fingerprints if runs begin failing with git_worktree_branch_incoherence.
• Interaction lifecycle: If you build custom adapters or UI extensions that interact with ask_user_questions, test behavior when a recent board comment exists — questions now expire by default.

Next issue: August 2026 commits. Have a change you want highlighted? Open a PR or tag @paperclipai/committers in the #dev channel.