Paperclip connects heartbeat runs to checked-out issues while rotating subscription credentials

Paperclip maintainers opened PR #13650 on September 21, 2026, repairing a critical disconnect between autonomous runner processes and project issue tracking. Under Paperclip's task server architecture, periodic heartbeat workers check out designated issues to execute background progress updates and health assessments. However, previous security permissions restricted heartbeat execution contexts from modifying the checkout issue's metadata, preventing agents from posting status comments, recording intermediate progress, or flagging blocker states. PR #13650 grants heartbeat runs explicit write permissions to the specific issue they have checked out, closing the feedback loop between background execution and issue boards. In tandem, PR #13726 introduces file-based credential rotation for Claude subscription connections, allowing external secret managers to update authentication tokens dynamically without restarting the server. This directly addresses issue #13725, which reported that Claude subscription sessions expired after approximately eight hours and failed to refresh automatically. Concurrently, issue #13720 details an orchestration bug where expiring a superseded decision card fails to emit a continuation wake, stranding waiting subagents indefinitely.

The facts

- PR #13650 allows Paperclip heartbeat runs to post comments and update status metadata on the issues they check out. - Closes an execution loop where background monitoring agents were previously barred from documenting findings on checked-out tasks. - PR #13726 implements file-based token rotation for Claude subscription connections to prevent long-running session drops. - Issue #13725 explains that Claude subscription credentials stopped working after eight hours due to missing token refresh logic. - Issue #13720 highlights that expiring superseded decision cards omits continuation wakes, leaving dependent agents stranded.

Why it matters

An issue tracking platform for AI agents must allow the agents doing the work to record their status on the tickets assigned to them. When heartbeat workers are locked out of their own checked-out tasks, operational visibility collapses, forcing engineers to inspect raw daemon logs to determine task progress. Furthermore, long-running agent workflows require seamless token rotation; without dynamic credential reloads, multi-hour autonomy collapses as soon as provider session cookies expire.

Current

Inspected on 2026-09-21. The Paperclip stable-channel baseline is v2026.916.0 published 2026-09-16T18:15:11Z. The primary source was open (not merged) when captured. Mainline merges, open proposals and packaged releases are distinct availability states; the release baseline does not establish that a proposal has shipped.

Evidence

Primary evidence: paperclipai/paperclip PR #13650 (https://github.com/paperclipai/paperclip/pull/13650). Supporting context: paperclipai/paperclip PR #13726 (https://github.com/paperclipai/paperclip/pull/13726); paperclipai/paperclip issue #13725 (https://github.com/paperclipai/paperclip/issues/13725); paperclipai/paperclip issue #13720 (https://github.com/paperclipai/paperclip/issues/13720). The source bodies and linked context were inspected. Test results quoted from contributors remain attributed reports, not independently reproduced experiments.

Operator take

Runner execution identity and ticket authority must be synchronized. A background worker assigned to a task must possess the requisite write permissions to update that task's state. Teams utilizing Paperclip for autonomous project management should review runner permission matrices and deploy file-based credential rotation to ensure background agents remain authenticated across multi-day operations without requiring service restarts.

Caveat

PR #13650 and PR #13726 are open pull requests currently under active review. Until PR #13726 is integrated, instances relying on Claude subscription connections must manage credential refreshes through periodic manual re-authentication.