Tau Papercut Triage

Triage papercuts

Use a senior researcher for this task. Triage is investigation and reporting, not permission to fix code, change configuration, restart sessions, or bypass isolation. Respect any concurrent project update owner.

Capture the complete inventory privately

1. Load dpc, tau-self-knowledge-debugging, and applicable project instructions. Read the papercut and relevant trust-boundary sections of SECURITY.md. Load dpc-rustgrep before structural Rust lookups, and linked-specs before investigating governed behavior through its specs.

2. Verify the installed interface and build rather than assuming flags:

   tau --version
   tau dev papercut --help
   tau dev papercut list --help
   tau dev papercut clear --help

3. Capture one complete authoritative CLI snapshot in an owner-private directory. Reports contain unredacted model text and may contain secrets. Do not dump raw reports into shared /tmp/public, tickets, or the conversation.

   umask 077
   private_dir=$(mktemp -d /tmp/tau-papercut-triage-XXXXXXXX)
   tau dev papercut list --markdown > "$private_dir/snapshot.md" &&
     sha256sum "$private_dir/snapshot.md" > "$private_dir/snapshot.sha256"

   Stop if listing fails; do not clear malformed/unreadable data. --state-dir <STATE_DIR> is supported on both list and clear; use the same explicitly selected root for both when overriding the default. This CLI covers the standard std-utils instance, not arbitrary reporter instances.

4. Give every report a stable ordinal within that snapshot and preserve its timestamp and attribution privately. Count actual report records, not arbitrary Markdown heading matches inside report bodies. If taking plain and Markdown snapshots separately, verify their record sequences agree: each list call takes its own snapshot and reports may arrive between them. Plain output escapes controls but is not a general structured interchange format. Record capture time, first/last report timestamp, count, snapshot hash, CLI build, and inspected source revision.

Classify evidence, not reporter conclusions

Account for every report, including duplicates and multi-symptom reports. Group repeated symptoms into findings but retain an ordinal-to-finding ledger. Repeated reports from one incident are not independent reproductions.

For each finding record category, priority, confidence, recurrence, concrete evidence, disposition, and the smallest useful follow-up:

• Agent mistake / expected behavior: usually low priority; ignore once explained. Record useful prevention improvements when mistakes recur or have meaningful consequences. A quoting mistake that runs a command or an overly broad cleanup is not harmless merely because the harness behaved correctly.
• External environment / configured integration: medium priority by default. Distinguish one-off recovery, recurring contention, stale paths/builds, missing tools, configured policy denials, and a fixable integration mismatch. Identify the responsible project or configuration rather than automatically filing a Tau core defect.
• Tau harness/product defect or suspected defect: highest investigative attention, with impact-based severity. Separate proven defects from observations still needing a minimal reproduction. Include misleading tool schemas/docs, inspection failures, and visibility defects, not only crashes.
• Already fixed / stale / unresolved: use these as dispositions, not as a substitute for a category. A source commit is not proof every live daemon runs the fix. State which target you actually rechecked.

Check exact submitted arguments and canonical tool results before attributing a problem to Tau. Particularly useful counterchecks:

• Backticks in double-quoted shell prose execute substitutions. Check quoting before alleging command/result mixups. Use literal heredocs/files for prose.
• Look for earlier successful unlocks before concluding a manual lock vanished.
• Check human UI and peer-message ingress before calling a child's work unsolicited.
• Automatic tool backgrounding does not remove the command's explicit/default timeout. A completion notification is not necessarily a consumed result.
• A deduplication pointer means identical output, not skipped command execution.
• jj reads may snapshot/import mutable working-copy state. Pin immutable Git objects or use documented jj --ignore-working-copy when appropriate.
• Directory-scoped wrappers and direnv may write before a nominally read-only command. Avoid inspecting through a mutating wrapper when a neutral workdir and explicit target path suffice.
• Hidden runtime mounts can make discovery empty by design. Distinguish that from mixed-version exact-admission failure and real discovery bugs.
• Provider-hosted web.run failures are not automatically Tau registered-tool failures. Keep the documented provider/native boundary clear.

Use bounded local source/history and diagnostic inspection. Durable agent logs are canonical replay evidence; session debug JSONL is incomplete, so a missing debug row does not prove an event never happened. Raw provider captures, tool arguments, and logs stay private. Do not run mutating probes, broad tests, or restoration operations without separate authority. Consult the relevant persistence/interface gates before proposing semantic changes; do not expand this task into hostile local-IPC hardening.