Paperclip

On 24 October 2026, Paperclip v2026.1023.0 was published as a stable GitHub release. Existing active human Operators can receive missing configuration and tool-administration grants at startup or Cloud sign-in. Review their roles and stored restrictions before restarting.

Where it stands, 2026-10-24

For existing installations: stop all servers and workers before upgrading, review permissions after startup, and test recovery before allowing jobs to run. Avoid preview upgrades until Pipelines dependencies and unsaved work are protected.

Install stable. For a fresh instance, pin the documented onboarding command as npx paperclipai@2026.1023.0 onboard --yes on Node 24.11.0 or newer. Skip the guide’s Node 20 VPS recipe.

As of 24 October 2026, 10:24 UTC, preview choices were beta 2026.1023.0-beta.0, nightly 2026.1024.0-nightly.0 and canary 2026.1024.0-canary.7. Assistant MCP, GitHub bot management, Dot and fast responses default off.

Review human permissions before restarting jobs. Stable brings the fourteen-grant human Operator preset, including agent configuration and connection/tool administration to existing deployments: startup or Cloud sign-in can add missing grants for existing active human Operators without overwriting restrictions already stored on a grant. Change inappropriate roles or store restrictive scopes. Then inspect persisted grants after startup/sign-in. Deleting a preset row alone can let seeding recreate it.

Drain every old writer before upgrade or rollback. Stop old servers and workers across hosts and containers, preserve SQLite lock files and unfinished-run evidence, restart every writer on the chosen compatible version, and verify provider interaction and file restoration before reopening dispatch.

Reconcile interrupted costs before releasing held work. Stable keeps usage receipts until settlement commits and deduplicates final accounting. Unpriced usage defaults to blocking only under applicable active, positive-amount policies with hard stops enabled. Choose that policy explicitly. Compare interrupted runs with provider bills; reservations cannot cap the provider’s final charge. Before raising a cap, check the incident type and actual run state: stable still labels soft warnings as paused work; beta contains the wording repair.

Update bot scheduling assumptions. Stable ignores saved per-person automaticReviews switches in favor of event and author filters; authorized mentions bypass automatic scheduling filters. Review those filters and guest sponsorship before restart. Hiding bot management leaves existing bots running.

Set agent authority before the first job. Separately from human roles, new standard agents receive fourteen grants, including unscoped tool use; existing agents are not backfilled. Hiring approval defaults off; enable requireBoardApprovalForNewAgents where a person must decide. Narrow explicit tool grants that take precedence over profile exclusions, and set harness permissions separately: native ACPX defaults to approve-all and OpenCode to allow.

Use private tasks as record-access controls. Stable restricts private reads by participation and current responsible-user access. Company administrators without ordinary task access need audited break-glass reads, while instance administrators and implicit local authority bypass the checks; opt-in Cloud inspection is separate. Test deployed principals and privacy settings. Trusted agents can still copy learned content into shared files or external tools.

Choose scopes before handing setup to an assistant. Stable’s Assistant MCP can configure agents, instructions, projects and skills as well as delegate work. Configuration needs a distinct scope and current user permissions, but one write checkbox approves requested mutation scopes together. Inspect consent in a test company. If a write has an unknown outcome, inspect current task state and reuse the same request ID and arguments for any retry; revocation does not undo delegated work.

Recover failed copy-back before deleting its sandbox. Stable can retain the exact stopped source and a repair hold when required legacy copy-back fails. Inspect the retained source before replacing work. Storage charges can continue, and successful repair does not automatically resume the task.

Check Codex compatibility before updating a worker’s CLI. Stable’s Runner declares Codex 0.160.0. Native local Codex prefers the installed CLI; remote admission remains >=0.149.0 and <0.161.0. The standalone stable Codex release, 0.164.0, falls outside that remote range. For remote workers, keep Codex within the stated version range and test provider interaction and file restoration before allowing jobs to run. Record the executable, account and selected model.

What changes in beta

Migrate Pipelines automation before trying beta. Beta removes its application, API and CLI while retaining database records. Export or replace dependent automation before upgrading. Opt-in Cases keeps phase handoffs on one primary task, potentially reducing relay work. Cases is separate from Pipelines, with no automatic migration.

Recheck shared checkouts before beta. Beta drops file-access restrictions based on a checkout’s task history. Current task/configuration authority and OS isolation govern files, while application-record privacy remains. Test shared directory bindings separately from private-task reads before upgrading.

Back up unsaved work outside preview retention. If cleanup and restore settings permit, beta can delete worktrees containing uncommitted or unpushed work. The default delays are 3 days closed or 7 days idle/open. Encrypted restore points default to 90-day retention after terminal closure. Eligible closed-session backups have a separate 7-day default expiry. Beta omits ignored files; canary adds selected ignored-file snapshots with exclusions and a payload older servers reject. Check switches, deadlines, file coverage and master-key backups.

Check reviewer completion directly on stable. The guard against replacing policy and marking Done while discarding a live, unexecuted review has reached beta but remains absent from stable. Inspect the stored review stage. Test that exact edit/completion sequence before relying on the beta guard.

Test native Stop with the provider you use. Beta repairs native Stop accounting wake-up and requires a later user message to resume queued pre-Stop input. Test interruption and resumption on your actual worker/account before relying on the repair.

Choose which credentials the legacy Codex shell may read. Beta delivers assigned service secrets to legacy Codex ACP/CLI shells, including runs without an agent identity; provider/login and unassigned host secrets remain excluded from this opt-in. Narrow the assigned service account.

Approve the telemetry destination before enabling export. Beta’s managed Codex/Claude OTLP export defaults off; enabling it defaults prompt, answer and tool-content capture on, and the harness can access export credentials. Use ingestion-only credentials or a separate collector. Inspect destination records from a real remote task.

Retest runtime selection after a beta conversion. Qualified new Codex, Claude, Pi and OpenCode agents default to Runner. Existing agents keep saved choices; eligible Codex/Claude upgrades are explicit, save pending form edits and start fresh sessions. Before comparing jobs, review those edits and record runner, target and model.

Canary reaches vaults and deployments

Try canary actions on disposable resources. 1Password’s authorized secret reads return values to agents and ordinary tool history. Review read/write policies first. Paperclip’s Vercel connector rejects preview creation on an empty project because Vercel can make its first deployment production. Inspect ambiguous remote outcomes before retrying.

Back up approval keys with the database. Canary encrypts sensitive arguments in new approval payloads with a signing key or persisted master-key fallback, and makes new default retry keys actor-scoped. Existing signed approvals are not rewritten; key rotation can invalidate retry matching. Reconcile unverifiable old effects before issuing a new write.

What is unresolved

• Validate the stable migration on your instance. Before/after member-grant snapshots and provider-matched interrupted/retried runs with priced/unpriced admission tests would show migration results beyond the implemented rules.
• Establish what preview can restore. Record expiration, restore and rollback trials with the actual storage, keys and file coverage to see what survives the retention policies.
• Measure the coordination cost. The shorter-manual comparison still lacks a completed behavioral trial. Run the same workload with both manuals and compare quality, spend, task creation and human interventions. For the wider pilot, also count manual handoffs and time spent recovering interrupted jobs. Keep Paperclip if it reduces that human work while maintaining completed-task quality.
• Require a full browser lifecycle trial. Browser Use’s basic live journey leaves revocation, restart, approval and rate-limit cases open. Provider-backed trials that record cancellation and recovered state would settle those cases.