Paperclip
Sourced signals for Paperclip: release changes, governance moves, runtime shifts, and operator consequences. Each links to the run that produced it. The Paperclip profile carries the current evergreen state.
July 2026
-
Paperclip v2026.626.0 tags its master-only control plane: daily run/cost budget caps, a split skills:create permission, cross-company auth hardening
- Carry-forward resolved: v2026.626.0 (2026-06-27) tagged 128 commits of previously master-only control-plane work. The operator-relevant pieces: hard daily run-count and cost ceilings enforced before an adapter runs (preflight budget caps), skill mutations now gated behind a dedicated `skills:create` permission split from `agents:create`, and cross-company access authorization hardened with single-issue read enforcement.
- If you run Paperclip, these are now in a stable tag you can adopt: wire the budget caps to bound runaway spend, and split skill-creation authority from agent-creation in your permission model.
Run: 2026-07-01-weekly-digest-2026-06-24_2026-07-01-frontier-v0
June 2026
-
Last window's multi-tenant authority cluster finally tagged in v2026.618.0
- v2026.618.0 (June 18) is the tag that finally contains last window's master-only authority cluster: cloud-tenant instance-admin deprivileging (#7525), per-company JWT signing keys (#5864), plugin tenant isolation (#5865), the negated-phrasing review-approval fix (#5839), and HTTP-log credential redaction (#8013). Shared-pool and cloud-tenant operators must upgrade.
- Provision a separate non-cloud-tenant admin identity first: the deprivileging purges stale instance-admin rows by design.
Run: 2026-06-23-weekly-digest-2026-06-16_2026-06-23-frontier-v0
-
Preflight budget caps that cancel queued work before an adapter starts (master, unreleased)
- PR #8347 (merged to master 2026-06-20, NOT in a tagged release) adds heartbeat preflight gates for daily-run and daily-cost caps (`maxDailyRuns`, `maxDailyCostCents`): a capped agent stops before new execution, with the cap re-checked immediately before execution. This moves budget from surfacing to enforced state.
- Paperclip operators tracking master can stage a per-agent daily cost cap in a test company and confirm work is refused at claim time, not mid-run; operators running the tagged binary do not yet have it.
Run: 2026-06-23-weekly-digest-2026-06-16_2026-06-23-frontier-v0
-
A recovery watchdog whose actors structurally cannot mutate approvals (master, unreleased)
- PR #8339 (merged to master 2026-06-19, NOT tagged) adds a task watchdog control plane whose recovery and status-only actors must remain limited to status reporting and cannot create approvals, link approvals, or submit approval comments — enforced via a scoped mutation guard.
- Operators relying on automated recovery should know the next tag structurally prevents a recovery actor from escalating into an approval; the running binary does not yet carry this guard.
Run: 2026-06-23-weekly-digest-2026-06-16_2026-06-23-frontier-v0
-
Shared-pool tenants were instance admins of the whole instance (fixed, unreleased)
- PR #7525 (merged to master 2026-06-12, NOT in a tagged release) removes a grant that made every cloud tenant on a shared pool an instance admin with reach into every other tenant's data, and purges stale admin rows. Shared-pool operators must track the next tag and provision a non-cloud-tenant admin identity first (the purge is destructive).
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Per-company JWT signing keys and a 1-hour TTL replace a single master key (unreleased)
- PR #5864 (master, unreleased) derives a per-company signing key and cuts the agent-token TTL from 48h to 1h, so one tenant's leaked key can no longer forge tokens for other tenants. Multi-tenant blast-radius control; track the next tag.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
A 'NOT APPROVED' comment could auto-complete an issue (fixed, unreleased)
- PR #5839 (master, unreleased) tightens an approval regex that matched negated phrasings (so 'NOT APPROVED' auto-completed an issue) and wraps comment + status + decision in one transaction. Makes 'a rejection can never auto-complete' and 'observable state cannot diverge from intended state' true invariants of the approval gate.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Deny-by-default authority preset for agents reviewing untrusted content
- PR #7530 (in v2026.609.0) adds a low_trust_review authority preset, source-trust tagging, route containment, and quarantine so an agent reviewing a hostile PR/comment/attachment gets narrower authority and its output cannot flow into higher-trust context. Enforced authority for the untrusted-input boundary, not a dashboard label.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Paperclip drops 'zero-human companies' for 'manage AI agents for work'
- PR #7580 retires the 'zero-human companies' tagline for 'the app people use to manage AI agents for work', a repositioning its in-window engineering backs up (human board visibility, audited recovery, approval gates). Calibration signal: the autonomous-company metaphor is being repriced toward human-in-the-loop operating software.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Unclaimed self-hosted deployments get a one-time browser claim to bootstrap the first admin
- Operators standing up a private self-hosted deployment now have a defined bootstrap path to create the first admin before any invite exists, replacing ad-hoc seeding.
- Whoever completes the one-time browser claim becomes the first admin, so an operator must claim a freshly deployed instance promptly to avoid a race for control.
- This changes the deployment runbook: the claim step is now the gate that establishes ownership of the control plane.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
Company skills become first-class resources with an install/reset/audit/export/assign CLI
- Skills move from implicit configuration to governed resources: an operator can now audit which skills are installed and assigned, and export the catalog for review or provenance tracking.
- The CLI verbs (install, reset, audit, export, assign) give platform operators a programmatic path to manage agent capabilities across a company instead of clicking through a board.
- Assignment is a distinct authority action — an operator decides which agents get which skills — so capability grants become reviewable operating state rather than ambient defaults.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
May 2026
-
Scoped agent permissions, layered routine secrets, document locks
- Multi-agent operators: re-evaluate Paperclip's authz model. The principal-access backfill means pre-existing data is being normalized to the new model — confirm any operator action needed for older versions.
- Secret-handling operators: read PR #6212 before configuring routine env in a deployment where secrets matter — the `agent < project < routine` precedence is a structural operator concept.
- Approval-discipline operators: migrate to lock-backed approval; document locks give approval a persistent surface.
- ACPX-Claude operators: confirm `~/.claude/settings.json` is configured as the source of truth for Claude permissions — the Paperclip control plane defers to it.
Run: 2026-05-27-weekly-digest-2026-05-13_2026-05-27-frontier-v0
-
Secrets provider vaults (AWS Secrets Manager), host env isolation fix, cursor_cloud adapter
- Operators running SSH-managed execution environments should upgrade immediately: the host env isolation fix (PR #5142) closes a path where host environment variables (API keys, tokens, paths) were being forwarded to remote execution targets.
- Operators managing credentials at scale should evaluate the AWS Secrets Manager import path in Secrets settings UI — this enables rotation-aware credential management with an access-event audit trail.
- Operators using Cursor as an adapter can now configure the new `cursor_cloud` adapter for cloud-hosted Cursor routing with session reuse, streaming, and cancellation.
Run: 2026-05-12-partial-cycle-paperclip-2026-05-07_2026-05-12-frontier-v0
-
Agent labor needs operating state, not just parallelism.
-
The agent interface is becoming a visible computer
- A serious agent harness increasingly needs browser, desktop, file, runtime, sandbox, and artifact surfaces that can be inspected.
Run: 2026-05-07-commit-harvest-2026-04-23_2026-05-07-frontier-v1
-
Permissions, secrets, and sandboxes are moving into the foreground
- The harness must make trust state visible: what can be read, what can be changed, which credentials are exposed, and where execution happens.
Run: 2026-05-07-commit-harvest-2026-04-23_2026-05-07-frontier-v1
-
Agent systems are growing control planes
- Once agents coordinate across tasks, runtimes, gateways, and integrations, operators need liveness, cost, role, session, and recovery controls.
Run: 2026-05-07-commit-harvest-2026-04-23_2026-05-07-frontier-v1