eval-session agentCoreProfile requires provider aws_agentcor

Error message

eval-session agentCoreProfile requires provider aws_agentcore

What it means

parseEvalSessionRequest in packages/paperclip-runner/src/cli/eval-session-contract.ts is a fail-closed validator for eval-session requests at the runner executable boundary. It throws this error when the request includes an agentCoreProfile field but the provider field is not "aws_agentcore". The profile bundle (ARNs, memory, context bucket, cost/iteration limits) is only meaningful for AWS AgentCore sessions, so pairing it with any other provider is rejected rather than silently ignored.

Source

Thrown at packages/paperclip-runner/src/cli/eval-session-contract.ts:267

    throw new Error("eval-session acpxAgent requires provider acpx");
  }
  const managedProfileInput = input.managedProfile === null
    ? undefined
    : input.managedProfile;
  const agentCoreProfileInput = input.agentCoreProfile === null
    ? undefined
    : input.agentCoreProfile;
  const managedProfile = provider === "claude_managed"
    ? parseManagedProfile(managedProfileInput)
    : undefined;
  const agentCoreProfile = provider === "aws_agentcore"
    ? parseAgentCoreProfile(agentCoreProfileInput)
    : undefined;
  if (provider !== "claude_managed" && managedProfileInput !== undefined) {
    throw new Error("eval-session managedProfile requires provider claude_managed");
  }
  if (provider !== "aws_agentcore" && agentCoreProfileInput !== undefined) {
    throw new Error("eval-session agentCoreProfile requires provider aws_agentcore");
  }
  if (input.nativeResume !== undefined) {
    throw new Error(
      "eval-session nativeResume requires a retained live-session checkpoint",
    );
  }
  if (input.includeCollaborationModeInstructions === false) {
    throw new Error(
      "current CapabilityLiveSessionService requires collaboration-mode instructions",
    );
  }

  const runnerd = object(input.runnerd, "request.runnerd");
  const digest = text(runnerd.sha256, "request.runnerd.sha256");
  if (!/^(?:sha256:)?[a-f0-9]{64}$/i.test(digest)) {
    throw new Error("request.runnerd.sha256 must be a SHA-256 digest");
  }
  const limits = object(input.limits, "request.limits");

View on GitHub (pinned to 01ad858492)

Solutions

Remove the agentCoreProfile field from the request when provider is not aws_agentcore.
Set provider to "aws_agentcore" if the AWS AgentCore profile is actually intended (and include the required agentCoreProfile fields plus model global.anthropic.claude-sonnet-4-6).
Fix the request-building code/config to only emit agentCoreProfile when provider === "aws_agentcore".

Example fix

// before
{ "provider": "claude_managed", "agentCoreProfile": { "memoryId": "..." }, ... }
// after
{ "provider": "claude_managed", "managedProfile": { ... }, ... }

Defensive patterns

Strategy: validation

Validate before calling

function hasNoAgentCoreProfile(input) { return input.agentCoreProfile === undefined || input.provider === "aws_agentcore"; }
if (!hasNoAgentCoreProfile(req)) throw new Error("agentCoreProfile requires provider aws_agentcore");

Type guard

function isAgentCoreRequest(input) { return input.provider === "aws_agentcore" && typeof input.agentCoreProfile === "object"; }

Try / catch

try { return parseEvalSessionRequest(raw); } catch (e) { if (String(e.message).includes("agentCoreProfile requires provider aws_agentcore")) { delete raw.agentCoreProfile; return parseEvalSessionRequest(raw); } throw e; }

Prevention

Build requests with a provider-specific factory that only emits agentCoreProfile for aws_agentcore.
Validate request payloads against the eval-session contract before sending.
Never copy agentCoreProfile blocks across provider templates.

When it happens

Trigger: Calling parseEvalSessionRequest (or the eval-session CLI 'request' path) with provider set to codex/opencode/claude_managed/acpx while also passing input.agentCoreProfile (even if it is an empty object).

Common situations: Copy-pasting a request template from an AWS AgentCore eval and switching provider without removing agentCoreProfile; a config generator that always emits agentCoreProfile regardless of provider; leftover fields after migrating a session from aws_agentcore to another provider.

Related errors

AI-assisted analysis of paperclipai/paperclip@01ad858492 (2026-09-10). Data as JSON: /api/errors/7594e11dcd207502. Report an issue: GitHub.