What the template manages

The template’s start scripts run at every start of each app service: after a deploy, a restart or an update. They create what is missing and rewrite only their own parts, so template updates reach existing servers. Your own files and settings are left alone.

On CloudCLI

What	When	Notes
A block in ~/.claude/CLAUDE.md	Every start, and after each setup step	Between <!-- paperclip-cloudcli:start --> and <!-- paperclip-cloudcli:end -->. The rest of the file is yours and kept.
The scheduled-jobs skill, in ~/.claude/skills/scheduled-jobs/	Every start	Its instructions, the jobs script, and the connectors guide. Don’t edit them: they are replaced.
The connection to Paperclip, in ~/.config/scheduled-jobs/paperclip.json	Every start, if the stored key stopped working	A board API key named “CloudCLI scheduled-jobs”, created with your login. Revocable in Paperclip. Readable only by CloudCLI’s user.
Your repos in CloudCLI’s sidebar	Every start, and when you add a repo	One project per connected repo.
The shared-memory setting	Every start, and when you add a repo	In each clone’s .claude/settings.local.json, git-excluded, for repos with .claude/memory/.
Git’s identity	Every start	Your login email, and its part before @ as the name, machine-wide. A ~/.gitconfig identity you set wins.
The Runner’s Claude and GitHub secret bindings	Every start	Checked, and added if missing.
What Claude may do without asking	Once	See below. A rule you remove stays removed.
CloudCLI’s first-run wizard	Once	Marked done: the setup page covers it.
REPO_URL’s clone	Once, if the variable is set	Never pulled at start: your clone is your working copy.

Approved in the chat

Approved once, in Claude Code’s user settings on CloudCLI (~/.claude/settings.json), so a first job doesn’t stop at permission prompts:

• the jobs script: node ~/.claude/skills/scheduled-jobs/jobs.mjs;
• Edit, Write and Monitor;
• git add, commit, push, pull, status, diff and log;
• gh issue list, gh issue view, gh pr list and gh pr view.

Everything else still asks.

On Paperclip

What	When	Notes
The first admin	First start	From ADMIN_EMAIL and ADMIN_PASSWORD.
The admin’s password	Every start, if ADMIN_PASSWORD changed	Checked by signing in; the old one is kept if that fails. Every browser is signed out.
The company “Jobs”	Created if missing	Tasks are numbered JOB-n.
A project per repo	Created if missing	Never renamed or changed once it holds a repo.
The Runner agent	Created if missing	Claude Code, Sonnet at creation only: a model you pick later is kept.
The Runner’s instructions	Every start, if they differ	Replaced: don’t edit them in Paperclip.
The Runner’s working folder	Every start	REPO_URL’s clone, or a fallback folder. Each job runs on its own repo’s checkout anyway.
Paperclip’s check of the Runner	Every start, if it failed	Retried, so a sign-in added later takes effect.
The Codex agent’s instructions and working folder	Every start, if Codex is connected	Never created at start; only the setup page creates it.
GH_TOKEN as the secret GITHUB_TOKEN	Every start, if the variable is set and changed
Git’s credential helper and identity	Every start	Machine-wide, so every run can use GitHub and commit.
The shared-memory setting	Every minute	For checkouts with .claude/memory/.

Paperclip’s environment doesn’t contain your admin email or password once it starts: agents never see them.

Never touched

• Your repos’ content, except what Claude commits when you ask (skills and .claude/jobs.json) and the git-excluded shared-memory setting.
• Your jobs, once created, except through the jobs script.
• The Runner’s model, once you change it.
• Secrets you add, and bindings other than the template’s own.
• Apps, connections and plugins in Paperclip.
• The rest of ~/.claude/CLAUDE.md and your own Claude Code settings.

Claude is told not to create agents, companies or projects, and not to change the Runner’s or Codex’s instructions. Add repos on /setup, which gives each its project.