feat(scripts): end-to-end evaluation of Paperless suggestions #756
Closed
claude-bot
wants to merge 2 commits from
paperless-eval into main
pull from: paperless-eval
merge into: :main
:main
:claude/shelly-manager-mdns
:feat/wiki-encyclopedia-pilot
:ci-image/claude-2.1.310
:claude/mosquitto-legacy-auth-removal
:claude/egress-lockdown
:fix/gate-embedded-refresh-interval
:fix/gate-embedded-browser-host
:feat/authentik-gate-forwardauth
:docs/drop-wildcard-references
:fix/netbird-controller-disable-dns
:feat/dns-labels-split-2
:feat/dns-labels-split-1
:fix/cloudflare-lb-sync-image-tag
:feat/cloudflare-lb-sync
:fix/wordpress-php85-php2shell
:feat/update-os
:chore/talos-1.13.12
:atlas/talos-v1.13.12-cve-2026-99999
:fix/gitea-webhook-sync-org-scope
:atlas/kuma-mcb-www-retries
:feat/hermes-gitea-pr-review-loop
:atlas/traefik-chart-42
:fix/monitoring-k8s-gateway-probe
:alert-fix/issue-1081-rotator
:ci-image/claude-2.1.306
:alert-fix/issue-1084-v2
:atlas/flux-2.9.6
:alert-fix/issue-1082
:feat/hermes-gitea-issues-kanban
:worktree-restore-test-real
:fix/hermes-multiplex-env
:feat/hermes-experts
:feat/hermes-ha-mcp
:feat/kuma-status-page
:fix/hermes-ha-updates-review
:feat/hermes-alert-monitor
:feat/hermes-ha-updates
:fix/turn-tcp-router
:fix/crowdsec-own-ca
:fix/livekit-service-links
:fix/crowdsec-lapi-transport-ca
:feat/matrix-element-call
:feat/kuma-public-coverage
:feat/ha-matrix-nabu-secret
:feat/hermes-matrix-cross-signing
:feat/hermes-matrix
:fix/wiki-basic-auth-in-service
:proposal/traefik-vip-maglev-dsr
:fix/hermes-dashboard-ws-ping-timeout
:fix/hermes-dashboard-ws-ping-interval
:fix/hermes-dashboard-refresh-token
:feat/wiki-drop-gate
:feat/wiki-oidc-provider
:fix/hermes-soul-talos-node-names
:claude/docs-konairius-main
:claude/drop-k-renner-org-secrets
:claude/prompts-main
:claude/default-branch-main
:feat/hermes-cli-logins
:claude/plan-step0-claude-bot
:alert-fix/issue-1363
:claude/homelab-konairius
:claude/konairius-org-secrets
:fix/hermes-image-registry-bot
:feat/hermes-use-custom-image
:feat/hermes-image
:feat/kuma-task5-monitors
:feat/hermes-gitea
:fix/hermes-configmap-namespace
:feat/hermes-homelab-context
:fix/uptime-kuma-script-mount
:feat/kuma-task4-bootstrap
:feat/kuma-task4-cluster
:feat/kuma-sync-default-notifications
:fix/hermes-image-policy
:fix/kuma-sync-foreign-key-create
:feat/hermes-agent
:chore/kuma-sync-smoke-remove
:feat/kuma-sync-smoke
:feat/kuma-sync-deploy
:ci-image/claude-2.1.303
:renovate/authentik
:renovate/home-assistant-minor-patch
:renovate/pin-image-digests
:feat/kuma-sync
:docs/uptime-kuma-plan
:chore/remove-autokuma
:fix/uptime-kuma-ipv6
:feat/autokuma-pilot-update
:fix/drop-flux-image-automation-alert
:feat/autokuma-pilot
:feat/autokuma
:fix/uptime-kuma-fail-guard
:fix/uptime-kuma-setup-diagnostics
:feat/uptime-kuma-vps
:ci/ansible-image-hvac
:claude/plan-homelab-konairius-main
:fix/kubejobfailed-resolve-on-later-success
:claude/homeassistant-konairius
:claude/ha-config-sync-identity
:feat/site-base-domain
:claude/review-bot-repos-konairius
:claude/authentik-konairius-images
:claude/notes-renovate-konairius
:claude/vsftpd-konairius-image
:claude/registry-bot-read-scope
:claude/registry-bot
:ci-image/claude-2.1.302
:claude/review-bot-approved
:claude/review-bot-backends
:fix/wp-pg-recovery-source
:feat/review-bot-status
:worktree-hcloud-wg-site
:node-dns-via-k8s-gateway
:chore/remove-paperclip
:worktree-k8s-gateway-chart-4
:fix/review-bot-approve-with-unverified
:chore/remove-wiki-maintenance-ci
:fix/review-bot-unique-tag
:fix/review-bot-rereview
:fix/review-bot-build-trigger
:fix/review-bot-backoff-cap
:fix/review-bot-rate-limit
:chore/disable-old-pr-review
:feat/review-bot-deploy
:feat/review-bot-service
:feat/pr-review-mistral
:fix/gitea-mcp-public-gitea-url
:alert-fix/issue-1242
:alert-fix/issue-1241
:fix/gitea-mcp-command
:feat/gitea-mcp
:claude/netbird-service-sync-pin
:claude/gitea-public
:feat/embed-knn-bench
:claude/pr-review-latest-cli
:ci-image/claude-2.1.296
:chore/decommission-openproject
:claude/pr-review-central
:feat/openproject-authentik-oidc
:fix/alloy-syslog-udm-cef-regex
:alert-fix/issue-1217
:alert-fix/issue-1214
:atlas/ren-1363-openproject-seeder-order
:atlas/ren-1367-gitea-1.27
:atlas/ren-1367-gitea-pre-upgrade-snapshot
:atlas/ren-1363-openproject
:atlas/ren-1345-ops-image-jq
:atlas/ren-1345-hermes-prometheus-read
:atlas/ren-1345-bridge-agent-secrets
:atlas/ren-802-retire-sml2mqtt
:atlas/ren-953-remove-legacy-users
:atlas/ren-1307-edge1-register
:atlas/ren-1307-edge1-cred-receiver
:atlas/ren-953-controller-ha-cert
:atlas/ren-1256-prune-shellies-secret
:atlas/ren-953-ha-mqtt-cert-sync
:atlas/ren-1256-adopt-shellies-secret
:atlas/ren-1203-eso-gitea-namespace
:atlas/ren-1203-gitea-package-retention
:atlas/ren-1196-agent-runtime-tzdata
:atlas/ren-1017-remove-legacy-shellies
:atlas/ren-1017-ht-wake-reland
:atlas/ren-1017-shelly-30
:atlas/ren-1167-revert-1183
:alert-fix/issue-1184
:atlas/ren-1017-ht-wake
:atlas/ren-1017-shelly-group5c
:atlas/ren-1017-shelly-group5b
:atlas/ren-1080-controller-1d03144-rotate-hold
:atlas/ren-1017-shelly-group5
:atlas/ren-1017-shelly-group4
:atlas/ren-1053-controller-a307693
:atlas/ren-1017-shelly-group3
:atlas/ren-1017-shelly-group2
:atlas/ren-1017-shelly-group1
:atlas/ren-1017-device-list
:atlas/ren-1017-shelly-accounts
:atlas/ren-953-agents-read-paperclip-pod
:atlas/ren-953-agents-read
:atlas/ren-953-ha-mqtt-tls
:atlas/ren-953-ha-account
:atlas/ren-953-evcc-cert
:atlas/ren-953-evcc-account
:atlas/ren-953-z2m-cert
:atlas/ren-953-z2m-account
:atlas/ren-953-health-probe-cert
:atlas/ren-931-agent-shelly-manager
:atlas/ren-900-controller-bump
:atlas/ren-900-mosquitto-dynsec
:atlas/ren-888-revoke-test-account
:atlas/ren-888-mqtt-account-controller
:atlas/ren-841-remove-repair-job
:atlas/ren-841-k8s-plugin-termination-receipt
:atlas/ren-841-lease-receipt-repair
:atlas/ren-802-suspend-open3e-int-rotator
:atlas/ren-826-remove-read-job
:atlas/ren-826-room-setpoint-read
:atlas/ren-809-remove-capture
:atlas/ren-809-open3e-fbh-capture
:atlas/ren-723-authentik-2026.8.3
:atlas/ren-772-remove-rekey-job
:atlas/ren-772-wp-repo4-rekey
:atlas/ren-722-mdns-relay-v191-attach
:atlas/ren-723-openbao-rolling
:atlas/ren-722-dhcp-lease-renew
:atlas/ren-722-cni-plugins-installer-v1.9.1
:atlas/ren-723-influxdb-snapshot
:atlas/ren-722-cni-plugins-v1.9.1
:atlas/ren-722-job-force-annotations
:atlas/ren-717-matrix-bridge-1791195981
:atlas/ren-702-paperclip-cap-kill
:atlas/ren-691-matrix-bridge-1791179547
:atlas/ren-685-matrix-bridge-1791177680
:ci-image/claude-2.1.289
:atlas/ren-671-matrix-bridge-1791152484
:atlas/ren-663-matrix-public
:atlas/ren-587-matrix-bridge
:atlas/ren-567-authentik-grant-types
:atlas/ren-567-mas
:atlas/ren-627-edge1-ssh-egress
:atlas/ren-621-loki-read-gateway
:atlas/ren-603-pclp-pg-memory
:atlas/ren-583-gitea-pvc-volumename
:atlas/ren-583-gitea-volume-60gi
:atlas/ren-563-claude-session-resume
:atlas/ren-563-revert-1111
:atlas/ren-567-matrix
:atlas/ren-563-acpx-session-resume
:atlas/ren-544-argus-token-v3
:atlas/ren-539-atlas-token-v3
:atlas/ren-541-claude-auto-memory
:atlas/ren-540-hestia-token-v3
:atlas/ren-528-review-bot-verify-repo
:atlas/ren-533-shelly-manager-probe
:atlas/ren-525-rotate-argus-token
:atlas/ren-509-rotate-agent-tokens
:atlas/ren-487-hubble-relay
:atlas/ren-488-govulncheck
:atlas/ren-487-agent-pod-egress
:atlas/ren-453-retire-immich-library
:atlas/ren-451-restore-abort
:atlas/ren-451-restore-test-skip-cnpg
:alert-fix/issue-1095
:atlas/ren-442-restore-capacity-gate
:z2m-ws90-converter
:alert-fix/issue-1089
:atlas/ren-419-ephemeral-wear-alert
:alert-fix/issue-1084
:alert-fix/issue-1081
:atlas/ren-414-agent-kubectl-sa
:atlas/ren-411-agent-gitea-egress
:atlas/ren-409-paperclip-14769
:atlas/ren-405-k8s-plugin-dist
:atlas/ren-401-kaniko-oom
:atlas/ren-401-paperclip-patched-image
:z2m-memory-limit
:atlas/ren-350-beets-write-retry
:fix/navidrome-native-api
:atlas/ren-350-paperclip-lidarr-cnp
:atlas/ren-350-beets-retry-skips
:atlas/ren-350-beets-write
:atlas/ren-350-beets-phase2
:atlas/ren-350-beets-cronjob
:atlas/ren-339-restore-test-teardown
:atlas/ren-339-restore-roll
:atlas/ren-339-restore-plugin
:atlas/ren-339-ha-backup-cleanup
:atlas/ren-339-ha-restore-test
:atlas/ren-315-renovate-groups
:atlas/ren-315-renovate-tool-install
:atlas/ren-107-retention-divergence-alert
:atlas/ren-159-remove-ren28-negative-probes
:atlas/ren-302-claude-agent-acp
:atlas/ren-298-agent-sandbox-v0.5.6
:atlas/ren-294-ical-proxy-926ead0
:atlas/ren-286-agent-runtime-own-workflow
:atlas/ren-285-agent-sandbox-labels
:atlas/ren-286-agent-runtime-images
:atlas/ren-285-agent-sandbox
:atlas/ren-148-paperless-ingress-scoping
:atlas/ren-93-promql-gate
:atlas/ren-268-ha-hacs-proxy
:atlas/ren-266-hacs-versions
:atlas/ren-245-ha-critical-alerts
:atlas/ren-243-ha-window
:feat/openbao-secret-exists-check
:atlas/ren-239-ical-proxy-main-73b5d97
:atlas/ren-238-ical-proxy-main-4783abe
:atlas/ren-201-ical-proxy-gitea-image
:atlas/ren-216-renovate
:atlas/ren-152-wal-backlog-retune
:atlas/ren-198-pin-kps-chart
:atlas/ren-176-ha-pg-walstorage
:atlas/ren-166-cilium-verdict-metric
:atlas/ren-7-alert-contacts
:atlas/ren-177-velero-cephfs-readonly-backuppvc
:feat/paperclip-api-door
:atlas/ren-186-cost-ledger-sync
:atlas/ren-183-yaml-anchors
:atlas/ren-161-promtool-ci
:atlas/ren-163-ceph-nearfull-headroom
:atlas/ren-7-restore-audiobooks
:atlas/ren-127-podmonitor-comment
:atlas/ren-165-wal-maxparallel-stage
:atlas/ren-141-ha-pg-32gi
:atlas/ren-147-cilium-agent-metrics-service
:atlas/ren-142-negative-control-probe
:atlas/ren-140-negative-test-probes
:atlas/ren-102-flux-ksm-crs
:atlas/ren-7-pilot-endpointmonitors
:atlas/ren-131-openbao-unavailable-for
:atlas/ren-106-narrow-eso-failed
:atlas/ren-116-probe-citation-path
:atlas/ren-103-scrape-doc-gaps
:atlas/ren-6-imc-deploy
:atlas/ren-100-externalsecret-healthcheck
:atlas/ren-91-imagepolicy-total-order
:atlas/ren-88-ceph-ec-pool-false-page
:atlas/ren-86-paperclip-dependson-monitoring
:atlas/ren-36-prometheus-read-path
:docs/probe-egress-dependency-and-revert-recipe
:docs/paperclip-claude-token
:fix/paperclip-memory
:docs/probe-cnp-egress-and-status-caveats
:feat/ren-21-paperless-app-health-probe
:feat/ren-21-navidrome-app-health-probes
:alert-fix/issue-968
:feat/paperclip-wiki-key
:feat/lidarr
:feat/wiki-api-key-paperclip
:feat/paperclip-signup-off
:feat/paperclip
:feat/netbird-retire-vps-proxy
:feat/navidrome
:feat/immich-bulk-cutover
:feat/immich-bulk-pvcs
:feat/wiki-image-automation
:chore/wiki-image-fact-drafter
:chore/wiki-image-facts-page
:chore/abs-drop-old-books-pvc
:chore/wiki-image-judge-one-request
:feat/abs-books-bulk
:feat/libation-strip-branding
:feat/cephfs-ec-bulk
:feat/open3e-int-broker-user
:feat/wiki-reloader
:chore/wiki-image-phases-4-6
:feat/wiki-anthropic-key
:feat/wiki-service-write-token
:chore/retire-python-wiki-index
:feat/wiki-machine-door
:chore/wiki-phase3-image
:chore/wiki-phase2-image
:chore/wiki-build-1790250017
:feat/wiki-gate
:fix/gitea-egress-wiki
:feat/wiki-service-manifests
:docs/proposal-wiki-web-api
:alert-fix/issue-937
:fix/alertmanager-info-inhibitor
:feat/cephx-allowed-ciphers-aes256k
:feat/cephx-drop-prior-csi-keys
:ci/wiki-consolidate-tilde-paths
:feat/cephx-csi-aes256k
:ci/wiki-consolidate-in-ci
:chore/talos-1.13.10
:feat/drain-tolerant-singletons
:ci/wiki-distill-skip-empty
:ci/wiki-audit-script
:fix/k8s-gateway-oci-chart
:docs/network-traffic-classes-as-built
:feat/node-ip-vlan-46
:alert-fix/issue-920
:feat/bird-attached-node0
:feat/node-vlan-46-link
:chore/cni-drop-stage-labels
:feat/cni-sole-writer-converge-b2
:feat/cni-sole-writer-converge-b1
:chore/cni-stage-k8s-1
:fix/whereabouts-reconciler-cordon
:chore/cni-stage-k8s-2
:chore/cni-stage-k8s-3
:feat/cni-staged-sole-writer
:feat/netbird-service-sync-phase2
:feat/netbird-service-sync-phase1
:chore/gitea-namespace-phase3
:feat/gitea-namespace-phase2
:feat/gitea-namespace-phase1
:ci-image/claude-2.1.280
:fix/ci-claude-refresh-mixed-pins
:fix/align-ci-claude-pins
:fix/ci-claude-bump-token-newline
:worktree-fix-paperless-memory-limit
:alert-fix/issue-897
:alert-fix/issue-896
:fix/wiki-maintenance-merge-verify
:feat/pick-model-newest-among-comparable
:feat/pick-model-typesafe
:fix/wiki-maintenance-rebase-push
:fix/wiki-maintenance-strip-secrets
:fix/wiki-maintenance-image-2.1.278
:feat/wiki-maintenance-ci
:fix/wiki-index-commit-tags
:fix/wiki-index-pin-digest-2
:alert-fix/issue-880
:fix/wiki-index-tree-paging
:fix/wiki-index-pin-digest
:fix/wiki-index-strip-credentials
:fix/gitea-webhook-egress-wiki-index
:fix/wiki-index-openbao-ingress
:feat/wiki-index-deploy
:feat/wiki-index-image
:fix/eso-allow-ai
:feat/wiki-embed
:fix/multus-only-cni-writer
:fix/cilium-cni-uninstall
:feat/onebase-room-telemetry
:fix/external-dns-scrape-policy
:feat/dns-monitoring
:fix/external-dns-annotation-prefix
:fix/ftp-scanner-probe
:fix/libation-accounts-persistence
:fix/libation-pin-14.2.1
:feat/ceph-read-affinity
:fix/bird-local-cidr
:feat/single-pod-table
:docs/traffic-classes
:feat/podpod-rules
:fix/bird-static
:fix/bird-digest
:feat/bird-mesh2
:feat/bird-kubectl
:feat/bird-mesh
:feat/bird-image-api
:feat/bird-daemonset
:alert-fix/issue-844
:feat/bird-image
:alert-fix/issue-843
:feat/pod-egress-vlan47
:docs/576-rejected-options
:feat/antrea-eval
:feat/nodeip-pod0
:feat/cilium-native-pod0
:feat/bgp-peer-ingress
:feat/bgp-listen-ingress
:feat/ingress-static-addressing
:feat/k8s-net-split-phase-a
:feat/cilium-pin-devices
:chore/ci-k8s-2026-09-08
:feat/flux-2.9.5
:feat/ci-tool-pins
:feat/openbao-seal-key-bootstrap
:feat/openbao-static-seal
:fix/openbao-alerts-immediate
:feat/intel-gpu-dashboard
:feat/intel-gpu-exporter
:feat/intel-gpu-monitoring-resource
:fix/reloader-configmap-annotations
:netbird-proxy-protocol-digest
:netbird-proxy-protocol-deploy
:netbird-proxy-protocol
:netbird-proxy-services-uid
:netbird-proxy-services-deploy
:netbird-proxy-services
:proxy-watchdog-cooldown
:proposal-node-roll-downtime
:alert-fix/issue-808
:lapi-transport-phase-2
:ceph-address-ranges
:fix/arp-flux-second-nic
:rehearsal-san
:osd-partlabel-no-ceph
:lapi-transport-post-crds
:san-host-device-nad
:san-rollout
:san-role-rename
:ceph-20-cutover
:rebuild-tooling
:apply-set-hygiene
:rebuild-image-resilience
:cold-rebuild-ordering
:fix/bootstrap-honour-vm-state
:chore/remove-paperless-eval
:issue-fix/789-cilium-node-ula
:issue-fix/787-mdns-relay-supervisor
:trmnl-firmware-sync-off
:trmnl-device-tls
:vmtest-flux
:eval-script-fixes
:alert-fix/issue-780
:worktree-eval-script-fixes
:eval-out-of-iac
:paperless-eval-jobs
:paperless-eval-fixes
:paperless-eval-instance
:crowdsec-tailer-polling
:crowdsec-alerting
:llama-single-slot
:llama-ctx-revert
:arm-crowdsec-proxy-1
:fix-proxy-deploy-triggers
:llama-ctx-fix
:arm-crowdsec-proxy-2
:llama-ctx-assist
:crowdsec-metrics-dashboard
:alert-fix/issue-761
:embed-batch-fix
:crowdsec-lapi-service-annotations
:ha-llm-agent
:paperless-eval
:crowdsec-bouncer-unpack-on-host
:embed-bgem3
:crowdsec-bouncer-fetch-controller
:crowdsec-edge-lapi
:alert-fix/issue-750
:embed-pvc
:immich-drop-pgvectors
:fix-stale-migration-docs
:embed-oom
:embed-eval
:paperless-reloader
:close-paperless-data-migration
:paperless-llm
:paperless-3x
:llama-gate-flow
:llama-authentik-gate
:alert-fix/issue-726
:llama-single-alias
:llama-alias-order
:llama-model-alias
:ai-eval
:remove-netbird-backup
:llama-thinking-alias
:llama-split-embed
:netbird-backup-vacuum-into
:llama-server
:intel-gpu-device-plugin
:ceph-osd-by-label
:alert-fix/issue-714
:alert-fix/issue-712
:cilium-track-untracked-settings
:proposal-cilium-single-owner
:fix-cilium-bootstrap-seed
:woodpecker-agent-probe
:add-missing-probes
:paperless-http-probes
:gatus-hardening
:gatus-drop-file-check
:gatus-config-reload
:drop-pbs2-gatus
:generic-blackbox-alert
:probe-ci-openbao
:cleanup-nas-1-remnants
:ci-image/claude-2.1.250
:woodpecker-deployment-dispatch-rest
:woodpecker-deployment-dispatch-pilot
:fix-monitor-selector-comments
:fix-wear-alert-design
:trim-comments-authentik
:trim-comments-apps
:trim-comments-helm
:trim-comments-netpol
:trim-comments-infra
:trim-comments-talos
:alert-fix/issue-675
:trim-manifest-comments
:drop-unused-barman-creds
:hetzner-creds-shared-path
:ephemeral-framing
:disk-dashboard-smart
:smartctl-privileged
:smartctl-seccomp
:smartctl-exporter
:disk-dashboard-status
:disk-dashboard
:ci-image/claude-2.1.247
:kaniko-fork-rest
:kaniko-replacement
:proposal-traffic-classes
:runbook-remote-rebuild-possible
:runbook-cold-rebuild-baremetal
:alert-fix/issue-657
:velero-stale-60h
:talos-1-13-9
:ceph-mon-disk-warn-default
:ceph-san-pool-widen
:no-ipv6-on-vlan-parents
:alert-fix/issue-649
:alert-fix/issue-645
:openbao-alerting
:openbao-ha-3-replicas
:alert-fix/issue-635
:ceph-san-cleanup
:ceph-san-nad
:whereabouts-ipam
:talos-1-12-11
:mdns-relay
:netbird-rotate-migration
:runbook-stale-sockets
:drop-monitoring-agent
:ansible-drop-dead-plays
:ansible-rotate-netbird
:ansible-drop-pve
:tofu-state-verify
:alert-fix/issue-603
:drop-decommissioned-dns
:tofu-drop-proxmox-vm
:drop-pve-monitoring
:talos-factory-installer
:cilium-reloader
:drop-talos-image-seeding
:cilium-vlan-bypass
:restore-replicapool-size
:restore-cephfs-metadata-size
:alert-fix/issue-592
:ceph-readd-neptune
:k8s-3-baremetal
:ceph-drop-neptune
:alert-fix/issue-591
:ceph-readd-saturn
:alert-fix/issue-590
:remove-vm-605
:remove-vm-151
:k8s-2-baremetal
:ceph-remove-k8s-2
:baremetal-conversion-runbook
:restore-after-jupiter
:alert-fix/issue-579
:ceph-readd-k8s-1
:k8s-1-network-fix
:alert-fix/issue-573
:k8s-1-ephemeral-on-crucial
:alert-fix/issue-571
:alert-fix/issue-569
:immich-window-scaledown
:ceph-exclude-k8s-1
:crowdsec-cpu-requests
:jupiter-baremetal-u2
:velero-restore-test-monthly
:ws90-reporting-config
:alert-fix/issue-562
:fix-ws90-merge-overclaim
:fix-ws90-debounce-rationale
:worktree-z2m-2.13.0-ws90-debounce
:kaniko-no-debug-image
:alert-fix/issue-557
:alert-fix/issue-554
:alert-fix/issue-550
:bump-stale-ci-images
:document-pool-no-redundancy-meaning
:fix-ci-pool-blocks-osd-maintenance
:rotate-cephx-daemon-keys
:fix-ceph-health-alert
:repoint-ci-workspaces
:ci-throwaway-cephfs
:rollout-archive-timeout
:archive-timeout-gf-pg
:reduce-pg-wal-fpi
:reduce-wal-segment-padding
:fix-prometheus-cardinality
:fix-barman-sidecar-visible
:feat-paperless-data-repoint
:feat-paperless-data-block
:fix-cnpg-write-tuning
:fix-emptydir-tmpfs
:fix-trmnl-renderer-tmpfs
:feat-ha-recorder-db-url
:alert-fix/issue-525
:fix-cnpg-backup-alerting
:feat-ha-recorder-postgres
:fix-ceph-mon-write-amplification
:fix-ceph-replica-size-2
:fix-ceph-deferred-write-amplification
:fix-326-noise-log-suppression
:fix-381-z2m-discovery
:decommission-rustfs-lxc
:document-hairpin-id-diff
:fix-rustfs-shim-replace
:fix-rotator-woodpecker-url
:alert-fix/issue-510
:bump-woodpecker-cli
:migrate-woodpecker-stage3
:migrate-woodpecker-stage2
:fix-eso-woodpecker-namespace
:migrate-woodpecker-namespace
:ceph-mon-data-avail-warn
:revert-image-gc-thresholds
:fix-ceph-toolbox-and-gc-thresholds
:fix-cilium-policy-map-exhaustion
:drop-stale-hetzner-dns
:fix-outpost-callback-path
:bump-ci-k8s-pins
:fix-wordpress-config-extra
:wordpress-renner-uno
:fix-authentik-double-passkey-touch
:pin-ical-proxy-image
:fix-trmnl-renderer-reloader
:fix-trmnl-render-lang
:fix-trmnl-session-expiry
:fix-trmnl-graphite-theme
:fix-trmnl-token-lifetime
:fix-trmnl-renderer-runtime
:feat-trmnl-renderer
:fix-trmnl-lb-address
:feat-trmnl-terminus
:retire-dead-monitoring
:heating-can-supervisorctl
:fix-native-teardown
:edge-capability-groups
:heating-can-image
:edge-bootstrap-selfcontained
:prometheus-pve-hostnames
:inventory-pve-hostnames
:chrony-allow-ipv6
:ntp-vrrp-linklocal-and-dad-sequencing
:ntp-service-address-health-gated
:ntp-anycast-capture-drift
:ntp-health-clock-correctness
:chrony-comment-correction
:worktree-chrony-makestep
:ci-k8s-validate
:rotator-repin
:mosquitto-rotate-health
:alert-fix/issue-454
:alert-fix/issue-452
:mosquitto-rotation-proposal
:mosquitto-openbao
:mosquitto-drop-apk
:paperless-drop-apk
:cni-plugins-image
:multus-drop-apk
:fix-jq-comment
:rename-alpine-jq
:fix-ci-yaml
:z2m-seed-drop-apk
:z2m-interview-watchdog
:alert-fix/issue-439
Labels
Clear labels
apollo
atlas
clio
daedalus
hestia
Hermes expert: Immich, Audiobookshelf, Libation, Navidrome, Music Assistant
Hermes expert: Talos, Flux, network, Authentik, Matrix, monitoring
Hermes expert: Paperless, wiki, ical-proxy, TRMNL, websites
Hermes expert: Gitea, Woodpecker, Renovate, review-bot, Hermes
Hermes expert: Home Assistant, IoT, MQTT, ESPHome, voice
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: konairius/homelab#756
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
The harness for measuring what actually matters: does Paperless suggest the labels a human already chose?
Why this is needed
scripts/embed-eval-real.shscores whether a document's nearest neighbours carry its labels. That is a proxy. Paperless does not act on the neighbours directly — it hands them to an LLM together with the document text and a candidate list of existing tags and correspondents, and the LLM decides. It can override poor context, or fail with good context.So a better embedding score does not automatically mean better suggestions, and that link has never been verified. Optimising a proxy without checking it predicts the outcome is exactly the error made with MTEB, one level up — and MTEB turned out to be anti-correlated with the embedding metric.
It also settles an older question
Paperless ships two engines, and this runs both on the same documents:
/api/documents/<id>/suggestions//api/documents/<id>/ai_suggestions/With ten years of hand-curated labels the built-in classifier has excellent training data. It can never invent a new tag or a title — that is the LLM's advantage — but for assigning labels that already exist it may simply be better. That was flagged as a possibility back in #739 and never tested. This answers it with a number instead of an assumption.
Reading the output
The most-frequent-correspondent floor is reported alongside the scores, for the same reason
embed-eval-real.shreports it: the archive is skewed enough (one correspondent holds 672 of 3939 documents) that "70% correct" is unreadable on its own.Ground truth is the current filing, and that deserves care: over ten years conventions change, so a disagreement with an old document is not automatically an error. The comparison between the two engines is the durable result; the absolute numbers are indicative.
Usage
Requests are issued from inside the paperless pod, because the namespace policy admits only the Authentik gate outpost. Sampling is deterministic (md5 of the id), so both engines and repeated runs see identical documents.
Not yet runnable — and deliberately so
ai_suggestionsreturns400unlessai_enabledis set. The settings landed in the ConfigMap in #739, but the running pod predates the Reloader annotation from #741, so it still holds the old environment.That restart should come from a real configuration change — the embedding model, once the comparison finishes — not from an imperative
rollout restartand not from a change invented to force one. Merging this adds the harness; running it waits for that.The
classicengine needs none of this and can be measured immediately, which gives the baseline the LLM has to beat.🤖 Generated with Claude Code
🤖 Automated review — model
claude-sonnet-5(complexity: normal), commitba1125b1e345e3345ee43263167b2e407e783c60.Summary
Adds
scripts/paperless-eval.sh, a new manual ops script that samples labelled documents from the Paperless Postgres DB and scores both the classic (/suggestions/) and LLM (/ai_suggestions/) engines against the existing correspondent/document-type filing, viakubectl exec. The script closely follows the conventions already established byscripts/ai-eval.sh(arg parsing,set -uo pipefail,mktempworkdir with trap cleanup,-h/--helpviasedover the header comment) and is not wired into anything else, so the blast radius is limited to this one new, opt-in script. No blocking issues; one real (cosmetic) bug in--helpand a documentation inconsistency worth confirming before merge.🟡 Suggestions
scripts/paperless-eval.sh:38/kubernetes/apps/llama-server/pvc.yaml:11— the script's own rationale (and the PR description) leans entirely onscripts/embed-eval-real.shas an existing, working script ("scripts/embed-eval-real.shmeasures whether a document's nearest neighbours carry its labels"). That file does not exist anywhere in this repository — not in the current tree, not at the PR's merge-base (60cfcf9e), not on any other local branch (git branch -ashows onlymaster). It's referenced the same way, and is equally absent, inkubernetes/apps/llama-server/pvc.yaml:11, so this predates this PR rather than being introduced by it — but this PR's whole framing ("that is a proxy... nothing so far has verified that it does") depends on that script actually existing and producing the embedding scores being compared against. Worth confirming it's real (maybe added in an unmerged branch/PR) rather than a stale/miscopied reference, since as written it will mislead anyone reading the header comment into looking for a script that isn't there.scripts/paperless-eval.sh:100-104—PAPERLESS_TOKENis passed as a literalcurl -H "Authorization: Token $PAPERLESS_TOKEN"argument insidekubectl exec. That puts the bearer token in the exec'd process's argv, visible to anything withps//procaccess inside the pod and potentially captured in API-server audit logs for theexecrequest itself. For a short-lived, manually-created token per the script's own instructions ("create one... then remove it when finished") the exposure window is bounded, but passing it via a header file (curl -K -/--header @file) or an env var set on the exec'd process would avoid the argv leak entirely.scripts/paperless-eval.sh:92-98— the twocorr_max/corr_totalpsqlcalls both redirect stderr to the same$WORK/pg-err.txt, so the second call's redirect (line 96-98) silently overwrites any error from the first (line 92-95), and neither is ever surfaced to the user (unlike the maindocs.txtquery, whosepg-err.txtiscat'd on failure at line 84). If either of these two queries fails, the script just printsfloor: ?%with no indication why.🟢 Nits
scripts/paperless-eval.sh:57—sed -n '2,40p' "$0"for--helpincludes line 40, which isset -uo pipefailitself, not a comment. Confirmed by runningsed -n '2,40p' scripts/paperless-eval.sh: the last line of--helpoutput is the literalset -uo pipefail. Should be2,39p(the sibling scriptai-eval.sh:44uses2,30p, correctly stopping one line before its ownset -uo pipefailon line 33).scripts/paperless-eval.sh:119— the debug line on a bad response is German ("keine gueltige Antwort") while every other user-facing string in the script (including inai-eval.sh) is English; looks like a stray leftover rather than intentional, since the archive content being classified is German but this message isn't part of that content.Tests
No tests, and none expected — this mirrors
scripts/ai-eval.sh, which is also an untested manual ops/diagnostic script in this repo, and both require a live cluster (kubectl exec into Postgres and the paperless pod) that isn't available in CI. The PR body is explicit that the AI-engine path is not yet runnable pending a real pod restart, which is a reasonable reason to not gate this on CI.Recommendation
Looks reasonable — no blocking issues; comments above are optional (though the
embed-eval-real.shreference and the--helpoff-by-one are cheap to fix before merge).🤖 Automated review — model
claude-sonnet-5(complexity: normal), commitbe27e33735a7bbe76aa4a4ca8a69b97ba68b11b2.Summary
Adds
scripts/paperless-eval.sh, a new operator-run harness that samples labelled Paperless documents from Postgres and scores both suggestion engines (suggestions/andai_suggestions/) against the existing filing, with a strict/lenient hit definition to separate genuine LLM misses from a matcher (difflib) that drops correct-but-verbose answers. It's a single new executable script, no other files touched. The logic is careful and its odd pieces (deterministicmd5(id)sampling, the lenient-match jq, the most-frequent-correspondent floor) are all explained and check out against the checkout (pod names, container name,PAPERLESS_AI_ENABLED, and the Reloader annotations referenced in the PR body all matchkubernetes/apps/paperless/*.yaml). No blocking issues found — the items below are all robustness/polish suggestions.🟡 Suggestions
scripts/paperless-eval.sh:79—limit $SAMPLEinterpolates the-n/--samplevalue (or$PAPERLESS_EVAL_SAMPLE) directly into the SQL text run viapsql -c. A non-numeric value breaks the query with a raw Postgres error surfaced only viapg-err.txt; anything else is arbitrary SQL run as thepostgressuperuser (enableSuperuserAccess: trueinkubernetes/apps/paperless/cluster.yaml). Given this is an operator-invoked local tool, not attacker input, this is low real risk, but a one-linecase $SAMPLE in ''|*[!0-9]*) echo "..." >&2; exit 2;; esacwould close it cheaply and turn a cryptic psql error into a clear one.scripts/paperless-eval.sh:11— the "why" section states as fact thatscripts/embed-eval-real.shmeasures nearest-neighbour label overlap, but that file doesn't exist anywhere in this repository (checked working tree andgit grepforembed-eval; the only other hit is a comment inkubernetes/apps/llama-server/pvc.yaml:11referencing the same nonexistent script). Either it lives in an unmerged branch/PR and the reference is premature, or it was never committed — worth confirming before merge so the comment doesn't point future readers at a script that was never there.scripts/paperless-eval.sh:100-102— the Paperless API token is passed as acurl -Hargument insidekubectl exec, so the expanded token value travels through the exec request (and is visible to anything reading that pod's process args, e.g.psfrom another process in the same pod). The script already tells the operator to use a scoped, throwaway token ("Create one for an existing user, then remove it when finished"), which mitigates the impact, but piping it via a header file (curl -K -) or an in-pod env var set throughkubectl exec -- env ...would avoid the argv exposure entirely.scripts/paperless-eval.sh:192-197—$ENGINEis only validated in thecaseat the end, after both Postgres round-trips (docs.txt,corr_max.txt,corr_total.txt) have already run. A typo like--engine alifails late with wasted work. Validating right after arg parsing (next to thePAPERLESS_TOKENcheck) would fail fast.🟢 Nits
scripts/paperless-eval.sh:51—sed -n '2,40p' "$0"for-h/--helpincludes line 40 (set -uo pipefail) in the printed help text, since the header comment block actually ends at line 39. Comparescripts/ai-eval.sh:44,sed -n '2,30p', where 30 is correctly the last comment line beforeset -uo pipefailon line 33 — this one script is one line eager. Running--helpwill print the strayset -uo pipefailline after the Usage block.scripts/paperless-eval.sh:130/:128—index([$t])(subarray search for a one-element array) is equivalent toindex($t)here since$haveis always an array of plain strings; the extra wrapping array works but reads oddly against the destination and doesn't decode as originally intended for anyone unfamiliar with jq's array-vs-scalarindexsemantics.scripts/paperless-eval.sh:102—$WORK/err.txtis reused (overwritten) on everyapi()call inside the per-document loop, so only the last request's stderr survives if several fail; not currently surfaced anywhere inscore()anyway, so low value as-is.Tests
No automated test is added, but this matches the existing convention for this class of script:
scripts/ai-eval.sh(the closest sibling — a manually-invoked comparison/eval tool) also ships without a test, and.woodpecker/ci-scripts-test.ymlonly exercisesscripts/ci/*. Also note.woodpecker/ci-manifests-test.yml'sshellcheckstep only globskubernetes/**/*.sh, so this script (like its siblings underscripts/) isn't linted by CI either — again consistent with existing scripts, not a gap introduced here. Nothing in this PR needs a regression test given the script is explicitly "not yet runnable" for theaiengine and theclassicpath is a straightforward read-and-report tool.Recommendation
Looks reasonable — no blocking issues; comments above are optional.
Geschlossen als überholt durch #778.
Dieser Branch ist der Vorgänger: er würde vollständig löschen und durch das alte Einzelskript ersetzen. Der Diff gegen master ist -2992/+253 Zeilen.
Was hier begonnen wurde, steht in master — inklusive der Erkenntnis, dass die erste Ergebnisrunde ungültig war: llama-server-Slots werden von echten Paperless-Anfragen dauerhaft zerstört, und ein Harness mit einem Slot für fünfzig Dokumente misst danach nur noch sich selbst. Der Harness in master erkennt das jetzt (Kanarienvogel) und verhindert es (Slot-Löschung zwischen Dokumenten).
Geschlossen als überholt durch #778.
Dieser Branch ist der Vorgänger: er würde scripts/paperless-eval/ vollständig LÖSCHEN und durch das alte Einzelskript scripts/paperless-eval.sh ersetzen. Der Diff gegen master ist -2992/+253 Zeilen.
Was hier begonnen wurde, steht in master — inklusive der Erkenntnis, dass die erste Ergebnisrunde ungültig war: llama-server-Slots werden von echten Paperless-Anfragen dauerhaft zerstört, und ein Harness mit einem Slot für fünfzig Dokumente misst danach nur noch sich selbst. Der Harness in master erkennt das jetzt über eine Kontrollfrage mit bekannter Antwort und verhindert es durch Slot-Löschung zwischen den Dokumenten.
Pull request closed