chore: adopt Paperclip 2026.626 plugin baseline

[alvarosanchez]

Summary

• adopt Paperclip/plugin SDK 2026.626.0
• re-evaluate GitHub Sync features against Paperclip 2026.626.0 host capabilities instead of duplicating them
• retire the GitHub Sync commentAnnotation UI slot because Paperclip's built-in GitHub external-object provider now owns generic GitHub URL detection/rendering on issue content/comments
• document and test that GitHub Sync does not register a duplicate external.objects.* provider
• document and test the task-watchdog boundary: watchdogs are host issue-tree liveness, not GitHub PR-state sync
• leave package.json#version unchanged; the manual publish flow updates the plugin version

2026.626 feature supersession analysis

• External object references: Paperclip now detects GitHub issue/PR URLs, stores external object mentions, resolves GitHub issue/PR liveness snapshots, and exposes issue/project external-object summaries. That supersedes the plugin's generic GitHub-link comment annotation. GitHub Sync now relies on host external objects for generic link rendering/status pills and keeps only GitHub Sync-specific ownership: repository mappings, imported/synced issue state, project PR dashboards, KPI attribution, and mutating GitHub agent tools.
• External object provider registration: GitHub Sync should not register another GitHub external.objects.* provider while the host ships one. A future product PR can connect host object mentions back to GitHub Sync entities if we need richer cross-filtering or "already synced" affordances.
• Task watchdogs: Paperclip watchdogs detect stopped Paperclip issue trees by looking for live runs/wakeups/retries. GitHub CI, mergeability, review threads, and maintainer approval are external waits, so GitHub Sync should not use watchdogs as a PR-state monitor. Existing sync behavior already avoids waking executors for healthy PR waits and keeps GitHub snapshots as the status source of truth.
• Tool scope: GitHub Sync tools are normal company-scoped plugin tools, not task-watchdog-scope-aware today. Mutating GitHub tools should not claim watched-subtree enforcement until Paperclip exposes an explicit host/plugin contract.

Staging notes

• Staging installed an unreleased tarball from this PR
• plugin loader status: ready
• Browser check: GitHub URL mentions render as host-owned external objects with no duplicate GitHub Sync comment annotation
• Browser check: GitHub Sync PR dashboard loads mapped PR data for Micronaut Test Resources
• Expected warning remains: plugin secret refs fall back to the worker-local company token until company-scoped plugin config is fully wired

Verification

• pnpm typecheck
• pnpm test — includes assertions that manifest does not declare external.objects.*, ui.commentAnnotation.register, commentAnnotation slots, watchdog capabilities, or worker /watchdog calls
• pnpm build

Staging GH token propagation removal / plugin-tool smoke — 2026-06-30

• Removed GitHub token propagation UI/logic from the GitHub Sync plugin source. The settings page no longer renders the agent propagation picker; worker/UI normalization drops githubTokenPropagationAgentIds; docs/spec/e2e were updated accordingly.
• Deployed the rebuilt plugin package to Paperclip staging for validation.
• Removed adapterConfig.env.GITHUB_TOKEN bindings from all 9 DEV Hermes agents in staging, including the live-only UI/UX Designer. Verification now shows 0 DEV agents with GITHUB_TOKEN env bindings and 0 plugin-state rows containing githubTokenPropagationAgentIds.
• Created staging task DEV-1444: https://staging.cliponaut.micronaut.fun/DEV/issues/69c2b151-1f62-4e94-885c-0a6c0e97a2cb to smoke-test the GitHub Sync read-only agent tools without gh/GITHUB_TOKEN.
• Root cause fixed at the deployment boundary: Paperclip plugin tools were registered and executable through the host dispatcher, but hermes_local did not bridge them into Hermes tool schemas. A deployment-owned paperclip-plugin-tools stdio MCP bridge now discovers /api/plugins/tools with the per-run agent JWT and dispatches calls through /api/plugins/tools/execute.
• Retry result: PASS. QA run d6387f2a-9392-4f8f-be3c-12567d6c3835 completed successfully and exercised all eight requested read-only GitHub Sync operations through MCP-bridged runtime tool names. It did not use gh, inspect GITHUB_TOKEN, or invoke mutation fallback. Full matrix is in DEV-1444 qa-verification.
• Staging plugin jobs are paused again (catalog-auto-sync, sync.github-issues). Note: a scheduled GitHub sync briefly started after the staging server restart and was cancelled; final sync state is cancelled.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.