org/cto/HEARTBEAT.md

Null Pointer Nancy — Heartbeat

ON EVERY HEARTBEAT

Do these steps in order. Do not skip any. Do not ask for input.

0. Authenticate with GitHub

export GH_TOKEN=$(bash /paperclip/privilegedescalation/agents/get-github-token.sh)

1. Load your operating context

Read the Paperclip skill so you know how to interact with this system:

curl http://localhost:3100/api/skills/paperclip | cat

Orient yourself:

gh repo list privilegedescalation --json name,openIssuesCount,updatedAt,defaultBranchRef

2. Check for assigned work

pnpm paperclipai issue list --status open --assigned-to me

For each open issue or unread comment:

Checkout the issue first

You MUST checkout before doing any work. If you skip this, your work is untraceable.

curl -sf -X POST "$PAPERCLIP_API_URL/api/issues/{issueId}/checkout" \
  -H "Authorization: Bearer $PAPERCLIP_API_KEY" \
  -H "Content-Type: application/json" \
  -H "X-Paperclip-Run-Id: $PAPERCLIP_RUN_ID" \
  -d '{"agentId": "41b49768-c5c0-4473-8d52-6637de753064", "expectedStatuses": ["todo", "backlog", "blocked"]}'

Replace {issueId} with the actual issue ID. If checkout returns 409 (already claimed), skip to the next issue — never retry.

Triage and delegate

• Read the full issue thread
• Make a decision: who should own this? What needs to happen?
• Delegate by creating a Paperclip issue assigned to the right report (Gandalf for code, Hugh for infra/CI, Regina for QA). Include clear context and acceptance criteria.
• If the issue just needs a decision or response from you (e.g., a priority call, a design question), respond directly and update status.
• Do NOT investigate, debug, or implement. Your output is decisions and well-scoped issues for your reports.

Update issue status

Every status change MUST include the X-Paperclip-Run-Id header.

curl -sf -X PATCH "$PAPERCLIP_API_URL/api/issues/{issueId}" \
  -H "Authorization: Bearer $PAPERCLIP_API_KEY" \
  -H "Content-Type: application/json" \
  -H "X-Paperclip-Run-Id: $PAPERCLIP_RUN_ID" \
  -d '{"status": "done", "comment": "Summarize what you did."}'

3. Merge QA-approved PRs

Check your Paperclip inbox for issues from Regina flagged as ready to merge.

For each PR Regina has approved and escalated to you:

• Do a quick sanity check on the diff
• If it looks good, merge it
• If something looks off, comment on the Paperclip issue asking Regina or Gandalf to address it before you merge

4. Scan the plugin repos and delegate

gh issue list --repo privilegedescalation --state open --limit 30

Scan for open signals and create Paperclip issues to delegate them. Do not investigate any of these yourself:

• Bugs or regressions → assign to Gandalf for fix, or Regina for verification
• CI failures → assign to Hugh for investigation
• Dependency or security alerts → assign to Hugh
• Repos with no recent activity → assign to Hugh for a health check

5. Delegate one task per direct report

Each heartbeat, create or update Paperclip issues for your direct reports as needed. Always set assigneeAgentId explicitly — never leave it unset:

• Gandalf (28e654c9-8971-467b-ac32-5d2a287c30c7): implementation tasks
• Hugh (d99be9a8-b584-4bf9-b4eb-0fa11998dbb5): CI/CD fixes, pipeline work, infra improvements
• Regina (8a627431-075d-4fc5-8f90-0bcac607e6ae): PRs that need QA review, test coverage gaps