Paperclip Weekly #38

2026-07-20 – 2026-07-26 · 113 commits (highlights from available summaries)

For operators, contributors, and self-hosters of Paperclip — this week shipped the v2026.720.0 release (195 commits, 16 contributors), alongside critical health-gate and security fixes, a reworked secrets UI, and CI improvements that shorten PR feedback loops.

🚀 v2026.720.0 Release

903bd15 — Changelog for the v2026.720.0 release, superseding the unpublished v2026.715.0 draft. Covers 195 commits from 16 contributors since v2026.707.0.

Highlights: - Decision Training — library, inspector, snapshot foundation, and decision image galleries - Built-in Summarizer & summary slots - Skill organization — nested folders, "My Skills", import-from-project, open-by-default company skill policy, Skill Studio - Issue monitor visibility across task surfaces + issue properties - Reworked secrets dialog with in-sheet per-agent access - Active PR-gardening workflow - Recovery / hot-restart / codex-auth reliability fixes and inbox/list polish

No breaking changes. DB migrations are additive and run automatically.

🛡️ Security & Correctness

Cookie Redaction in Server Logs

1568300 — The HTTP logger now redacts cookie, set-cookie request/response headers alongside the existing authorization header redaction. Reduces risk of session material leaking into durable server.log collection or sharing.

Graceful Comment Creation on Bad Run IDs

a59aa12 — POST /api/issues/:id/comments now validates the X-Paperclip-Run-Id header before writing to the created_by_run_id foreign key. Non-UUID, synthetic, or deleted run IDs degrade gracefully to an unattributed comment (HTTP 201) instead of a 500, keeping multi-agent coordination working.

CLI Test Isolation

230126d — Added vi.unstubAllGlobals() to API client test cleanup so a mocked global fetch does not leak across tests sharing the same Vitest worker.

☁️ Cloud-Managed Instance Bootstrap Fix

2f42a49 — Instances configured with PAPERCLIP_CLOUD_TENANT_SERVER_TOKEN were permanently stuck at the "waiting on first admin" claim screen because the cloud-tenant trust middleware never grants instance_admin (by design). The health gate is now cloud-aware: when the tenant token is set, bootstrapStatus reports ready. Self-hosted behavior is unchanged and pinned by a new regression test.

🧭 Secrets UX Overhaul

Folder Navigation for Slash-Delimited Names

b94907f — The Secrets page now renders dev/github/oauth/clientid style names as browsable folders. Client-side only — no server-side folder entity or schema migration. Includes URL-addressable ?path= navigation, global search, create-in-folder with removable prefix chips, and persisted view preference in localStorage.

Searchable Agent Picker for Secret Access

b9f4073 — The secret access grant form replaces its native <select> with a searchable single-agent picker. Filter by agent name or title, consistent with other agent-assignment surfaces across the app.

🏗️ Infrastructure & CI

Docker Images Labeled with Schema Migration Metadata

fa4f900 — Every published Docker image now carries OCI labels for its bundled schema migration set (io.github.paperclipai.schema.last-migration, io.github.paperclipai.schema.migration-count). Deployment tooling can verify image/schema compatibility with two cheap registry requests — no pull required.

E2E Sharding with Stable Aggregate Check

1944c86 — The Playwright e2e lane now runs across two sharded runners (partitioned by recorded per-spec duration) while emitting a fast aggregate check named exactly e2e for branch protection. PR feedback loop shortens without breaking the required-check contract.

📋 Documentation Refresh

631cca5 — README and ROADMAP.md synchronized with shipped capabilities. Introduces the four-pillar product framing (Agentic Task Manager, Org Chart for Agents, Agent Employee Training, Agentic OS) with a theme-aware graphic. Several entries corrected from planned to shipped: Cloud/Sandbox agents, Artifacts & Work Products, Deep Planning, Enforced Outcomes, MCP Tool Gateway, per-agent Secrets Manager, activity logging, self-healing recovery, agent evals/feedback, Skill Studio and Skills Store.

📊 Telemetry Baseline & Config Scaffolding

bf63656 — Phase-1 of telemetry retry work: characterisation tests pin the current silent-drop-on-error behaviour (429/413/400/network error). A typed config surface (maxEventsPerBatch, maxBodyBytes, maxPendingRetryBatches, backoff) with defaults is added but not yet consumed — ready for the retry implementation in the follow-up PR.

Highlights from 113 commits this week. Full changelog: v2026.720.0.