feat(reborn): per-user agent-context profile (timezone/locale/location)

[henrypark133]

Summary

Adds a per-user, always-injected agent-context profile (timezone, locale, location) so IronClaw Reborn behaves as a competent general assistant — knowing the user's local time and context without being told each turn.

This is part 1 of a two-part memory split: persistent always-injected context (this PR). Part 2 (searchable/indexed memory) is a separate future PR.

What it does

• builtin.profile_set capability — closed typed field set (timezone | locale | location), authoritative param validation, CAS field-merge write to context/profile.json. The model calls it when the user states one of these facts.
• HostUserProfileSource producer — reads context/profile.json at loop start and fills LoopRuntimeContext.user_profile, rendered into the prompt every turn (correct DST-aware local time via chrono-tz when timezone is known; User profile: locale=…, location=… line).
• Timezone is folded into the profile — the standalone LoopRuntimeContext.user_timezone field is removed; user_timezone's long-unwired producer slot now has a real source.
• Elicitation — when timezone is unset and local time matters, the prompt asks the user and offers to save it via profile_set.
• Stops double-injection — context/profile.json no longer prose-injected as raw JSON (it renders via typed runtime context instead); still write-protected.

Architecture / boundaries

• Strong types: Locale newtype, typed Tz; no stringly-typed internals.
• ironclaw_turns (contracts crate) carries only primitives — no ironclaw_memory dep (forbidden, enforced by architecture tests).
• The memory read is routed through the HostUserProfileSource trait (in ironclaw_loop_support) with the reader in ironclaw_host_runtime and the trait impl as a composition-layer adapter — mirroring WorkspaceIdentityContextSource. ironclaw_reborn gains no ironclaw_memory dependency (verified by cargo test -p ironclaw_architecture).
• Profile is keyed (tenant, user, None, None) regardless of run scope, via one shared profile_scope_and_path helper used by both reader and writer.
• Out of scope (by design): searchable memory; geo→timezone derivation (location is a label only); project-scope override; all system config (provider/model/approval) — never LLM-visible or LLM-writable (safety boundary).

Testing

• Unit: field validators (timezone IANA parse, locale syntax, location trim/length, non-object/empty-object rejection, 200/201-char boundary), render (local-time + profile line, elicitation hint, sanitization), CAS-exhaustion path.
• Caller-level integration round trip proving the scope-narrowing: profile_set writes under an agent/project-scoped run, the reader reads back at user-only scope through the real backend, and the rendered runtime context shows correct local time + profile line. Plus per-user isolation.
• cargo test -p ironclaw_architecture green (no new forbidden dependency edges).

Multi-agent code review run; all straightforward findings fixed (corrupt-doc fail-loud, location trim+byte-cap, model-safe location render, +missing-validation tests).

Deferred follow-ups (tracked, not in this PR)

1. Shared CAS helper — profile_merge_into and patch_document share a read→hash→compare-and-write skeleton; extracting a generic helper would dedup them but modifies the stable patch_document path — blast radius not justified in a feature PR.
2. Cache the profile backend — resolve_user_profile rebuilds the (stateless) repository/backend per loop start; caching is blocked by generics on RepositoryMemoryBackend<R>/FilesystemMemoryDocumentRepository<F> (would force the source generic and break its new(Arc<dyn RootFilesystem>) API). Per-call alloc is cheap.
3. profile_scope_and_path Result<_, ()> — unit error erases cause, but both ID inputs are validated newtypes upstream so failure is effectively unreachable; low value.
4. Trait/file naming — HostUserProfileSource lives in user_profile_context.rs (mirrors sibling identity_context.rs convention) while dropping the Context infix; renaming is churn for a nit.

Notes

• 3 sandbox_process tests fail locally with SocketNotFoundError("/var/run/docker.sock") — Docker absent in the dev env, pre-existing on main, untouched here.
• Also fixes a pre-existing red test on main: trace_commons.profile_set declares PermissionMode::Ask but the capability-declaration test expected Allow (verified red on a clean origin/main checkout).

🤖 Generated with Claude Code

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[railway-app]

🚅 Deployed to the ironclaw-pr-5008 environment in ironclaw-ci-preview

Service	Status	Web	Updated (UTC)
ironclaw	✅ Success (View Logs)	Web	Jun 17, 2026 at 6:23 am

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

📝 Walkthrough

Summary by CodeRabbit

Release Notes

• New Features

  • Added builtin.profile_set to create/update per-user profile data (timezone, locale, location) via validated, closed-schema JSON.

• Changes

  • Loop runtimes now resolve a per-user profile at startup and render a “User profile” prompt section (with safety-neutralized location content and clearer unknown-timezone messaging).
  • Updated runtime capability wiring and local-dev policy to include builtin.profile_set.

• Tests

  • Added end-to-end roundtrip coverage and CAS-conflict retry assertions.
  • Added authorization tests for missing memory mount authority.
  • Updated runtime/prompt-context tests for the new user-profile context shape.

Walkthrough

Adds builtin.profile_set first-party capability writing IANA timezone, BCP-47 locale, and location into per-user JSON profile document via CAS merge. Replaces LoopRuntimeContext.user_timezone with user_profile: Option<UserProfileContext>; introduces Locale and LocaleError types. Adds MemoryBackedUserProfileSource for reading profiles. Wires HostUserProfileSource trait through RebornLoopDriverHostFactory and composition layer. Propagates EmptyUserProfileSource defaults across all test harnesses and exempts capability from approval gate.

Changes

builtin.profile_set capability and UserProfileContext pipeline

Layer / File(s)	Summary
UserProfileContext, Locale, and LoopRuntimeContext field replacement crates/ironclaw_turns/src/run_profile/runtime_context.rs, crates/ironclaw_turns/src/run_profile/mod.rs, crates/ironclaw_turns/tests/agent_loop_host_contract.rs, crates/ironclaw_turns/src/run_profile/prompt.rs, crates/ironclaw_reborn/tests/llm_gateway.rs	LoopRuntimeContext.user_timezone field removed and replaced with user_profile: Option<UserProfileContext>. New public Locale newtype with Locale::new fallible validation; LocaleError enum; UserProfileContext struct holding timezone: Option<Tz>, locale: Option<Locale>, location: Option<String>, plus has_any_fields() predicate. render_model_content derives time rendering from user_profile.timezone, updates "timezone unknown" fallback to mention profile_set capability, emits "User profile:" line when locale present, renders sanitized untrusted location on separate line with double-quote neutralization. sanitize_prompt_string allows commas in model-visible interpolation. Locale/LocaleError/UserProfileContext re-exported from run_profile::mod. All LoopRuntimeContext test fixtures updated from user_timezone: None to user_profile: None.
HostUserProfileSource trait and EmptyUserProfileSource crates/ironclaw_loop_support/src/user_profile_context.rs, crates/ironclaw_loop_support/src/lib.rs	New public async trait HostUserProfileSource with resolve_user_profile(run_context) → Option<UserProfileContext>. Default no-op EmptyUserProfileSource struct implementing trait, always returning None. Both exported from crate root.
MemoryBackedUserProfileSource read path crates/ironclaw_host_runtime/src/user_profile_source.rs, crates/ironclaw_host_runtime/src/lib.rs	PROFILE_DOCUMENT_PATH constant ("context/profile.json"). profile_scope_and_path(tenant_id, user_id) helper computing MemoryDocumentScope/MemoryDocumentPath via tenant/user hierarchy. MemoryBackedUserProfileSource::resolve_user_profile derives user id from run context actor, reads profile bytes from in-memory filesystem, enforces 64KiB size cap, deserializes JSON, parses timezone to chrono_tz::Tz (invalid yields None), validates locale via Locale::new (invalid field dropped), normalizes blank location to None. Returns None on missing actor/doc, read/parse failure, invalid timezone, oversized document, or all-default fields. Unit tests verify success/failure paths including missing document, no actor, blank/invalid fields, oversized document behavior.
memory.rs helper visibility widening for profile_set reuse crates/ironclaw_host_runtime/src/first_party_tools/memory.rs	MAX_MEMORY_PATCH_RETRIES, MemoryCapabilityState::backend_for, ensure_memory_mount, and write_options visibility widened to pub(super) for profile_set module reuse. Manifest description string updated (clarity only).
builtin.profile_set capability: manifest, validation, dispatch, CAS merge crates/ironclaw_host_runtime/src/first_party_tools/profile_set.rs, crates/ironclaw_host_runtime/src/first_party_tools/schemas.rs, crates/ironclaw_host_runtime/src/first_party_tools/mod.rs	PROFILE_SET_CAPABILITY_ID constant. manifest() declaring ReadFilesystem/WriteFilesystem effects. validated_fields() enforces non-empty object, closed field set (timezone/locale/location only), trims whitespace, parses timezone as chrono_tz::Tz, validates locale via Locale::new (ASCII + alphanumeric + dash + underscore, max 35 chars per schema), trims and validates location (non-empty, ≤200 chars, ≤800 bytes). Rejects unknown keys, non-object, empty object as input errors. dispatch() validates input, calls profile_merge_write which ensures memory mount, resolves per-scope document path via profile_scope_and_path, builds MemoryContext with audit/correlation, selects backend via MemoryCapabilityState::backend_for, delegates to profile_merge_into. profile_merge_into implements bounded CAS retry loop: reads and hashes prior document bytes, rejects non-JSON stored documents with operation error, refuses to overwrite when existing known fields present but non-string type, merges only validated incoming keys, serializes to JSON bytes, attempts compare_and_write_document_with_backend_options with prior hash. Returns {status:"ok"} on Written; retries on Conflict; logs debug and returns operation failure after MAX_MEMORY_PATCH_RETRIES exhaustion. Comprehensive unit tests: timezone persistence, locale merge without clobbering existing timezone, invalid timezone/locale rejection, too-long locale (201 chars rejected, 200 succeeds), location boundary tests (200 succeeds, 201 fails), unknown field rejection, empty-object/non-object rejection, refusal to overwrite corrupt existing known fields (non-string), refusal to overwrite non-JSON existing documents, CAS exhaustion retry count verification. Input JSON schema added (profile_set.input.v1.json): non-empty object, optional timezone/locale/location strings, locale maxLength 35, minProperties 1, additionalProperties false.
RebornLoopDriverHostFactory and DefaultPlannedRuntimeParts wiring crates/ironclaw_reborn/src/loop_driver_host.rs, crates/ironclaw_reborn/src/runtime.rs	RebornLoopDriverHostFactory.user_profile_source: Arc<dyn HostUserProfileSource> field defaulting EmptyUserProfileSource. Public builder method with_user_profile_source(source) → Self. During host build in build_text_only_host_with_capabilities, async resolve_user_profile(&run_context).await call populates LoopRuntimeContext.user_profile (replaces prior user_timezone: None). DefaultPlannedRuntimeParts<G> adds required user_profile_source field, wired to host_factory via with_user_profile_source in build_default_planned_runtime_with_optional_wake_channel.
MemoryBackedUserProfileSourceAdapter in reborn_composition crates/ironclaw_reborn_composition/src/runtime.rs	Orphan-rule workaround: local newtype MemoryBackedUserProfileSourceAdapter wrapping MemoryBackedUserProfileSource, implementing HostUserProfileSource by delegating async resolve_user_profile to wrapped instance. Wired into DefaultPlannedRuntimeConfig.user_profile_source when local_runtime present (using local_runtime.extension_filesystem as backing); falls back to EmptyUserProfileSource when absent. Imports added for MemoryBackedUserProfileSource and UserProfileContext.
Integration tests and test harness propagation crates/ironclaw_host_runtime/tests/user_profile_roundtrip.rs, crates/ironclaw_product_workflow/tests/inbound_turn_contract.rs, crates/ironclaw_product_workflow/tests/support/planned_agent_loop.rs, crates/ironclaw_reborn/tests/loop_driver_host.rs, crates/ironclaw_reborn_composition/tests/product_live_adapters.rs, tests/support/reborn/harness.rs	New user_profile_roundtrip.rs: NoopRuntimeHttpEgress stub always returning "network unavailable", test helpers (EffectiveRuntimePolicy, trust policy, mount view, dispatch_grant_with_mounts, agent_scoped_context, loop_run_context_with_user, build_runtime factory). Round-trip test: invokes builtin.profile_set with agent+project scoped context, asserts Completed with status="ok", reads profile via MemoryBackedUserProfileSource from same backend under narrowed user-only scope, asserts timezone/locale/location survived, verifies rendered model content includes profile/timezone/locale/location and excludes "timezone unknown" fallback. Scope-isolation test: writes profile for user-A, reads for user-B, asserts None to prevent cross-user leakage. All DefaultPlannedRuntimeParts across harnesses (inbound_turn_contract, planned_agent_loop, loop_driver_host, product_live_adapters, main harness) updated with explicit user_profile_source: Arc::new(EmptyUserProfileSource). Adds FixedUserProfileSource test double returning fixed UserProfileContext in loop_driver_host, plus text_only_host_factory_threads_user_profile_source_to_runtime_context test verifying profile injection through prompt/model content rendering.
Capability policy, identity guard, authorization, E2E coverage crates/ironclaw_reborn_composition/src/local_dev_capability_policy.toml, crates/ironclaw_reborn_composition/src/local_dev_authorization.rs, crates/ironclaw_reborn_composition/src/local_dev_capability_policy.rs, src/workspace/reborn_identity_context.rs, crates/ironclaw_host_runtime/tests/first_party_builtin_tools.rs, tests/reborn_trace_first_party_tool_coverage.rs, tests/support/reborn/harness.rs	builtin.profile_set exempted from approval gate (user-scoped fixed-path memory write with closed validated field set, no network/secrets/external/process behaviors). Policy file grants dispatch_capability, read_filesystem, write_filesystem against memory mount with network = "default". local_dev_authorization.rs adds regression test local_dev_builtin_profile_set_skips_approval_gate verifying Allow decision for PROFILE_SET_CAPABILITY_ID with ReadFilesystem/WriteFilesystem effects. local_dev_capability_policy.rs test asserts exemption membership and validates grant properties (effects, mounts, network profile). reborn_identity_context.rs documents context/profile.json is typed LoopRuntimeContext consumption (not prose-injected from identity), adds profile_json_is_not_prose_injected contract test asserting paths::PROFILE absent from stable/personal identity paths. First-party builtin tools test: adds TRACE_COMMONS_PROFILE_SET_CAPABILITY_ID to PermissionMode::Ask for manifest expectations, extends all_builtin_capability_ids() to include PROFILE_SET_CAPABILITY_ID for handler enumeration, adds builtin_profile_set_rejects_missing_memory_mount_authority test verifying authorization failure when /memory write grant absent. E2E parity test (reborn_trace_profile_set_first_party_tool_parity) dispatches scripted profile_set tool call, asserts final reply and status == "ok" in result. Harness core-builtin runtime adds PROFILE_SET_CAPABILITY_ID to memory-mount override list and overall capability allowset.

Sequence Diagram

sequenceDiagram
    participant Agent as Agent / App
    participant Factory as RebornLoopDriverHostFactory
    participant Source as MemoryBackedUserProfileSource
    participant Dispatcher as builtin.profile_set dispatch
    participant Backend as MemoryBackend

    Agent->>Factory: build host with user_profile_source
    Factory->>Source: resolve_user_profile(run_context)
    Source->>Backend: read context/profile.json
    Backend-->>Source: bytes or NotFound
    Source-->>Factory: Some(UserProfileContext) or None
    Factory-->>Agent: host with LoopRuntimeContext.user_profile

    Agent->>Dispatcher: invoke_capability(builtin.profile_set, {timezone,locale,location})
    Dispatcher->>Dispatcher: validated_fields: non-empty object, closed set, type constraints
    loop up to MAX_MEMORY_PATCH_RETRIES
        Dispatcher->>Backend: read + hash context/profile.json
        Dispatcher->>Dispatcher: decode JSON, merge validated fields
        Dispatcher->>Backend: compare_and_write(prior_hash, merged_bytes)
        Backend-->>Dispatcher: Written or Conflict
    end
    Dispatcher-->>Agent: {status:"ok"} or OperationError

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Possibly related issues

• nearai/ironclaw#5013: Requests completion of production-graph composition path to use non-Empty user profile context sources instead of degrading to EmptyUserProfileSource; this PR lays the trait and local-dev adapter groundwork that #5013 builds upon.

Possibly related PRs

• nearai/ironclaw#4795: Introduced user_timezone: Option<Tz> on LoopRuntimeContext; this PR replaces it with user_profile: Option<UserProfileContext> and extends rendering to emit "User profile:" lines with locale and location sanitization.
• nearai/ironclaw#4836: Also modifies LoopRuntimeContext and render_model_content() in the same runtime_context.rs file; this PR's changes interact with product_context/origin rendering in the same code path.

Suggested reviewers

• serrrfirat

Poem

A profile arrives in the memory store,
CAS retries guard the concurrent write war.
Timezone parsed, locale trimmed and neat,
user_timezone gone—the refactor's complete,
{status: "ok"} seals the user's lore. 🦀

🚥 Pre-merge checks | ✅ 3 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	Description provides comprehensive context: summary, architecture/boundaries, testing strategy, deferred follow-ups, and known issues. All required sections present except Database Impact, Security Impact, and Reborn Trust-Boundary Checklist (marked as required for security/runtime changes).	Complete Reborn Trust-Boundary Checklist (required for runtime/security changes) and Security Impact sections to fully satisfy template requirements.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	Title follows Conventional Commits format (feat(reborn): summary), clearly describes the main change (per-user profile feature), and is directly related to the changeset.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 6

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/ironclaw_host_runtime/src/first_party_tools/profile_set.rs`:
- Around line 118-121: The backend.read_document call and similar IO-boundary
calls are using map_err(|_| operation_error()) pattern which discards the actual
error details and replaces them with a generic operation_error(). Replace the
map_err(|_| operation_error())? pattern with the ? operator directly on the
.await call to preserve the root cause error information from the backend
operation. This same pattern should be applied to all similar calls in the
read/write path mentioned at lines 140-149.

In `@crates/ironclaw_host_runtime/src/first_party_tools/schemas.rs`:
- Around line 246-263: The schema definition for
"schemas/builtin/profile_set.input.v1.json" currently allows empty objects to
pass validation, but the runtime's validated_fields() function rejects them,
causing a contract mismatch. Add a minProperties constraint set to 1 in the
schema object to enforce that at least one property must be present, ensuring
the schema validation aligns with what the runtime will actually accept.

In `@crates/ironclaw_host_runtime/src/user_profile_source.rs`:
- Around line 31-39: The profile_scope_and_path function violates the fail-loud
invariant by collapsing all errors into an empty error tuple () using
map_err(|_| ()). Replace the Result<(MemoryDocumentScope, MemoryDocumentPath),
()> return type with a more specific error type that preserves the actual error
details from MemoryDocumentScope::new_with_agent and
MemoryDocumentPath::new_with_agent calls, and propagate those errors directly
instead of silently erasing them. This will ensure that invalid scope/path
errors, backend failures, and other issues can be properly diagnosed rather than
being hidden as missing documents.

In `@crates/ironclaw_loop_support/src/user_profile_context.rs`:
- Around line 16-20: The resolve_user_profile method in the
HostUserProfileSource trait currently returns Option<UserProfileContext>, which
conflates actual errors with missing profiles. Change the return type to
Result<Option<UserProfileContext>, HostUserProfileSourceError> by first defining
a new error type HostUserProfileSourceError that captures DB/IO/workspace
failures, then update the method signature to return this Result type instead.
This allows callers to distinguish between "profile not found" (Ok(None)),
"profile found" (Ok(Some(...))), and "read failed" (Err(...)), enabling proper
error propagation upstream rather than silent failure.

In `@crates/ironclaw_reborn/tests/loop_driver_host.rs`:
- Around line 4293-4363: The test
text_only_host_factory_threads_user_profile_source_to_runtime_context extracts
the system_content from the prompt bundle but then discards it with `let _ =
system_content;` without performing any assertion, so the test passes regardless
of whether with_user_profile_source actually threads the injected profile into
the runtime context. Replace the discard statement with an actual assertion that
verifies the system_content contains the expected user profile data injected via
the FixedUserProfileSource (such as the locale "ja-JP" or location "Tokyo,
Japan"), ensuring the factory call to the source and the profile rendering in
the runtime context is verified through the real caller path.

In `@crates/ironclaw_turns/src/run_profile/runtime_context.rs`:
- Around line 89-97: The Locale::new method currently only validates that the
entire string is non-empty and contains allowed characters, but does not
validate individual locale subtags (the parts separated by hyphens). This allows
malformed tags like "-" or "en--US" where empty subtags exist between hyphens.
Add validation after the character check to split the string by hyphens and
ensure that every resulting subtag is non-empty, returning a LocaleError if any
empty subtags are found. This ensures the validated-type contract is properly
maintained.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d927b514-8beb-4e91-9bcf-7e6a3fc1b630

📥 Commits

Reviewing files that changed from the base of the PR and between 31eacd4 and 2af5812.

📒 Files selected for processing (24)

• crates/ironclaw_host_runtime/src/first_party_tools/memory.rs
• crates/ironclaw_host_runtime/src/first_party_tools/mod.rs
• crates/ironclaw_host_runtime/src/first_party_tools/profile_set.rs
• crates/ironclaw_host_runtime/src/first_party_tools/schemas.rs
• crates/ironclaw_host_runtime/src/lib.rs
• crates/ironclaw_host_runtime/src/user_profile_source.rs
• crates/ironclaw_host_runtime/tests/first_party_builtin_tools.rs
• crates/ironclaw_host_runtime/tests/user_profile_roundtrip.rs
• crates/ironclaw_loop_support/src/lib.rs
• crates/ironclaw_loop_support/src/user_profile_context.rs
• crates/ironclaw_product_workflow/tests/inbound_turn_contract.rs
• crates/ironclaw_product_workflow/tests/support/planned_agent_loop.rs
• crates/ironclaw_reborn/src/loop_driver_host.rs
• crates/ironclaw_reborn/src/runtime.rs
• crates/ironclaw_reborn/tests/llm_gateway.rs
• crates/ironclaw_reborn/tests/loop_driver_host.rs
• crates/ironclaw_reborn_composition/src/runtime.rs
• crates/ironclaw_reborn_composition/tests/product_live_adapters.rs
• crates/ironclaw_turns/src/run_profile/mod.rs
• crates/ironclaw_turns/src/run_profile/prompt.rs
• crates/ironclaw_turns/src/run_profile/runtime_context.rs
• crates/ironclaw_turns/tests/agent_loop_host_contract.rs
• src/workspace/reborn_identity_context.rs
• tests/support/reborn/harness.rs

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (3)

crates/ironclaw_turns/src/run_profile/runtime_context.rs (1)

157-159: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Guard locale with the model-safe label path.

Line 159 trusts Locale because it is ASCII-only, but the validator still accepts arbitrary ASCII tokens; a saved value like authorization can pass and later trip the same prompt-safety policy this file already degrades for delivery labels. Render it through model_safe_label until the locale validator is strict enough.

As per coding guidelines, "Do not expose raw secrets, backend paths, private URLs, transport internals, raw SQL/backend errors, or unredacted runtime/user content across public surfaces."

Proposed fix

             let mut fields = Vec::new();
             if let Some(locale) = &profile.locale {
-                // Locale is already validated (ascii-alnum/hyphen) — no sanitize needed.
-                fields.push(format!("locale={}", locale.as_str()));
+                fields.push(format!(
+                    "locale={}",
+                    model_safe_label(locale.as_str(), "a saved locale")
+                ));
             }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/ironclaw_turns/src/run_profile/runtime_context.rs` around lines 157 -
159, The locale field is being directly appended to the fields vector without
passing through the model_safe_label function, which creates a potential
security issue since arbitrary ASCII tokens could be accepted by the validator.
Wrap the locale.as_str() call with the model_safe_label function before
including it in the format string on the line that pushes to the fields vector,
ensuring that the locale value is sanitized according to the model-safe label
requirements before being exposed in the output.

Source: Coding guidelines

crates/ironclaw_host_runtime/src/first_party_tools/memory.rs (1)

213-216: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Split write-only and write+delete mount checks before sharing this helper.

Now that ensure_memory_mount is shared, write = true pulls in permissions.delete at Line 322. builtin.profile_set only CAS-writes context/profile.json and declares/grants read+write, so least-privilege memory mounts without delete will fail or need overbroad authority. Use an access mode such as Read, Write, and WriteDelete; keep memory_write on WriteDelete, but call profile_set with Write.

As per coding guidelines, "Fail closed for auth, approvals, trust, filesystem containment, network policy, secret leases, runtime selection, and adapter identity."

Also applies to: 301-323

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/ironclaw_host_runtime/src/first_party_tools/memory.rs` around lines
213 - 216, The ensure_memory_mount helper currently treats all write operations
the same way, granting delete permissions whenever write is true, which violates
least-privilege principles. Create an access mode enum or type with variants
such as Read, Write, and WriteDelete to distinguish permission levels. Modify
the ensure_memory_mount function signature to accept an access mode parameter
instead of a boolean write flag, and update the permission checking logic at the
point where permissions.delete is validated to only grant delete permissions
when the access mode is WriteDelete. Then update the call from
builtin.profile_set to pass the Write access mode (since it only needs CAS-write
without delete), while keeping the memory_write capability call using
WriteDelete access mode to maintain its current behavior.

Source: Coding guidelines

crates/ironclaw_host_runtime/src/first_party_tools/profile_set.rs (1)

45-51: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Validate locale through the shared profile type.

Line 48 reimplements locale validation as raw ASCII/hyphen checks at the authoritative write boundary. That lets builtin.profile_set persist values the profile newtype/rendering should not trust. Route this through the shared Locale validator and add dispatch regression cases for malformed subtags and prompt-policy-denied ASCII tokens.

As per coding guidelines, "Prefer strong types over strings (enums, newtypes)."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/ironclaw_host_runtime/src/first_party_tools/profile_set.rs` around
lines 45 - 51, The locale validation in the "locale" case (around line 48) uses
inline ASCII and hyphen checks instead of leveraging a shared Locale validator
type. Replace the manual validation logic (is_empty and chars().all checks) with
a call to the shared Locale type validator, which should enforce proper
validation rules. This ensures the validation is consistent with the profile
type system and prevents invalid values from being persisted through
builtin.profile_set. Additionally, add dispatch regression test cases to verify
that malformed subtags and prompt-policy-denied ASCII tokens are properly
rejected.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/ironclaw_reborn_composition/src/local_dev_capability_policy.toml`:
- Around line 69-70: The comment explaining the exemption for
builtin.profile_set contains a contradictory statement about memory_write being
"also not gated" when in fact builtin.memory_write is not in exempt_capabilities
and is therefore gated. Remove the reference to memory_write not being gated and
revise the comment to focus only on why builtin.profile_set is exempted: that it
is a fixed-path, closed-field, and non-external write operation that operates on
a structurally restricted scope.

---

Outside diff comments:
In `@crates/ironclaw_host_runtime/src/first_party_tools/memory.rs`:
- Around line 213-216: The ensure_memory_mount helper currently treats all write
operations the same way, granting delete permissions whenever write is true,
which violates least-privilege principles. Create an access mode enum or type
with variants such as Read, Write, and WriteDelete to distinguish permission
levels. Modify the ensure_memory_mount function signature to accept an access
mode parameter instead of a boolean write flag, and update the permission
checking logic at the point where permissions.delete is validated to only grant
delete permissions when the access mode is WriteDelete. Then update the call
from builtin.profile_set to pass the Write access mode (since it only needs
CAS-write without delete), while keeping the memory_write capability call using
WriteDelete access mode to maintain its current behavior.

In `@crates/ironclaw_host_runtime/src/first_party_tools/profile_set.rs`:
- Around line 45-51: The locale validation in the "locale" case (around line 48)
uses inline ASCII and hyphen checks instead of leveraging a shared Locale
validator type. Replace the manual validation logic (is_empty and chars().all
checks) with a call to the shared Locale type validator, which should enforce
proper validation rules. This ensures the validation is consistent with the
profile type system and prevents invalid values from being persisted through
builtin.profile_set. Additionally, add dispatch regression test cases to verify
that malformed subtags and prompt-policy-denied ASCII tokens are properly
rejected.

In `@crates/ironclaw_turns/src/run_profile/runtime_context.rs`:
- Around line 157-159: The locale field is being directly appended to the fields
vector without passing through the model_safe_label function, which creates a
potential security issue since arbitrary ASCII tokens could be accepted by the
validator. Wrap the locale.as_str() call with the model_safe_label function
before including it in the format string on the line that pushes to the fields
vector, ensuring that the locale value is sanitized according to the model-safe
label requirements before being exposed in the output.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 231d2168-050f-4f99-b6ba-f9ae6c553006

📥 Commits

Reviewing files that changed from the base of the PR and between 2af5812 and 5e50981.

📒 Files selected for processing (7)

• crates/ironclaw_host_runtime/src/first_party_tools/memory.rs
• crates/ironclaw_host_runtime/src/first_party_tools/profile_set.rs
• crates/ironclaw_host_runtime/src/first_party_tools/schemas.rs
• crates/ironclaw_reborn_composition/src/local_dev_authorization.rs
• crates/ironclaw_reborn_composition/src/local_dev_capability_policy.rs
• crates/ironclaw_reborn_composition/src/local_dev_capability_policy.toml
• crates/ironclaw_turns/src/run_profile/runtime_context.rs

[henrypark133]

Code Review (multi-agent)

Intent: Add a per-user always-injected agent-context profile for timezone, locale, and location, and thread it through runtime prompts and profile_set.

Stats: 5 selected findings from 8 raw reviewer findings across 3 files. Reviewers run: security, bugs, performance, tests, conventions, local-patterns, maintainability, approach. Reviewers failed: none. Body-only: 2. Existing unresolved review threads were re-checked and not duplicated inline.

Findings

1. Medium Bound locale before persisting it into every future prompt (crates/ironclaw_host_runtime/src/first_party_tools/profile_set.rs:45-51, confidence 90) — anchor: crates/ironclaw_host_runtime/src/first_party_tools/profile_set.rs:45
locale has no length cap but is persisted and rendered into the model-visible runtime context on every turn.

2. Medium Record wall-clock usage for builtin.profile_set (crates/ironclaw_host_runtime/src/first_party_tools/mod.rs:369-373, confidence 95) — anchor: crates/ironclaw_host_runtime/src/first_party_tools/mod.rs:369
   The dispatch branch returns before setting wall_clock_ms, so profile writes are reported as zero-duration operations.

3. Medium Normalize known profile fields during CAS merge (crates/ironclaw_host_runtime/src/first_party_tools/profile_set.rs:125-140, confidence 76) — anchor: crates/ironclaw_host_runtime/src/first_party_tools/profile_set.rs:125
   The merge preserves malformed existing known fields; a later write to another field can leave the reader unable to parse the profile.

4. Medium Cover the CAS retry success path (crates/ironclaw_host_runtime/src/first_party_tools/profile_set.rs:116-158, confidence 86) — body only
   The tests cover total CAS exhaustion and sequential writes, but not one transient conflict followed by success.

5. Low Keep PROFILE_DOCUMENT_PATH private unless a downstream consumer needs it (crates/ironclaw_host_runtime/src/lib.rs:60, confidence 69) — body only
   The crate-root re-export is unused outside user_profile_source.rs; keeping only the source type public is narrower.

Existing Threads Still Valid

I also re-checked the live CodeRabbit threads and agree these are still actionable, so I did not duplicate them inline here: HostUserProfileSource read errors are collapsed into None; the host-factory user-profile wiring test still discards system_content without asserting the profile reached the runtime/prompt path; locale validation still should reject empty subtags and share the Locale boundary; profile_set currently asks the shared memory mount helper for delete permission even though this fixed-path CAS write only needs read/write; and the local-dev policy comment still incorrectly says fixed-path memory_write is not gated.

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

crates/ironclaw_host_runtime/src/first_party_tools/profile_set.rs (1)

126-139: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

CAS merge preserves malformed fields from prior corrupt writes.

If context/profile.json already has {"timezone": 123} (wrong type) and a subsequent call sets only locale, the merge loop preserves the malformed timezone. The reader (MemoryBackedUserProfileSource) then fails the entire ProfileJson parse and returns None, silently losing the valid locale.

Deserialize through the typed profile contract before re-serializing:

Sketch

-        let mut doc: serde_json::Map<String, serde_json::Value> = match &current {
-            Some(bytes) => match serde_json::from_slice(bytes) {
-                Ok(map) => map,
+        let mut doc: serde_json::Map<String, serde_json::Value> = match &current {
+            Some(bytes) => match serde_json::from_slice::<ProfileJson>(bytes) {
+                Ok(profile) => serde_json::to_value(&profile)
+                    .ok()
+                    .and_then(|v| v.as_object().cloned())
+                    .unwrap_or_default(),
                 Err(error) => {

This requires importing or defining ProfileJson (the same shape the reader uses) and ensures only valid known fields survive.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/ironclaw_host_runtime/src/first_party_tools/profile_set.rs` around
lines 126 - 139, The issue is that the merge loop in the profile field update
preserves malformed fields from prior corrupted writes, causing subsequent reads
to fail silently. After merging the new fields into the document map (after the
for loop iterating over fields), deserialize the merged map through the typed
ProfileJson schema to validate and normalize the data before re-serializing it
back to JSON. This ensures that only valid, well-typed fields survive the
update, preventing malformed data from corrupting valid updates. Import or
define the ProfileJson type that matches the shape expected by
MemoryBackedUserProfileSource to ensure consistency between the writer and
reader contracts.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@crates/ironclaw_host_runtime/src/first_party_tools/profile_set.rs`:
- Around line 126-139: The issue is that the merge loop in the profile field
update preserves malformed fields from prior corrupted writes, causing
subsequent reads to fail silently. After merging the new fields into the
document map (after the for loop iterating over fields), deserialize the merged
map through the typed ProfileJson schema to validate and normalize the data
before re-serializing it back to JSON. This ensures that only valid, well-typed
fields survive the update, preventing malformed data from corrupting valid
updates. Import or define the ProfileJson type that matches the shape expected
by MemoryBackedUserProfileSource to ensure consistency between the writer and
reader contracts.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ba83db3b-b9dc-4452-a4ed-748a358694c8

📥 Commits

Reviewing files that changed from the base of the PR and between 87c7e58 and e705722.

📒 Files selected for processing (6)

• crates/ironclaw_host_runtime/src/first_party_tools/mod.rs
• crates/ironclaw_host_runtime/src/first_party_tools/profile_set.rs
• crates/ironclaw_host_runtime/src/first_party_tools/schemas.rs
• crates/ironclaw_reborn/tests/loop_driver_host.rs
• crates/ironclaw_reborn_composition/src/local_dev_capability_policy.toml
• crates/ironclaw_turns/src/run_profile/runtime_context.rs

[henrypark133]

Code Review (multi-agent)

Intent: Add a per-user injected agent-context profile for timezone, locale, and location, with runtime injection and profile-setting support.
Stats: 6 findings (from 12 raw, 6 after filtering/dedup) across 4 files. Reviewers run: security, bugs, performance, tests, conventions, local-patterns, maintainability, approach. Reviewers failed: none. Body-only: 0

Findings

1. High profile_set advertises a missing output schema (crates/ironclaw_host_runtime/src/first_party_tools/profile_set.rs:19-30, confidence 95) — anchor: crates/ironclaw_host_runtime/src/capability_catalog.rs:95
   The first-party manifest helper derives both input and output schema refs for every model-visible builtin. This PR adds builtin.profile_set and its input schema, but there is no schemas/builtin/profile_set.output.v1.json resolver/asset, while the hot capability catalog reads output_schema_ref for every model-visible capability. A profile_set-capable catalog build will fail before the tool can be used.
2. High Production still injects an empty user-profile source (crates/ironclaw_reborn_composition/src/runtime.rs:2686-2691, confidence 90) — anchor: crates/ironclaw_reborn_composition/AGENTS.md:39
   The new HostUserProfileSource is only constructed from local_runtime. When local_runtime is absent, this branch installs EmptyUserProfileSource, so production-shaped composition keeps LoopRuntimeContext.user_profile as None and the per-user timezone/locale/location feature becomes local-dev only. That also conflicts with the crate guardrail that production and migration-dry-run profiles fail closed on missing required handles.
3. Medium profile_set lacks a mount-authority rejection test (crates/ironclaw_host_runtime/src/first_party_tools/profile_set.rs:89-103, confidence 82) — anchor: crates/ironclaw_host_runtime/src/first_party_tools/profile_set.rs:89
   The new builtin.profile_set path gates writes through ensure_memory_mount(true), but no test invokes the capability without a /memory write mount. This leaves the new user-visible capability's authorization failure path uncovered at the actual call site.
4. Medium non-JSON existing profile docs are not covered (crates/ironclaw_host_runtime/src/first_party_tools/profile_set.rs:129-136, confidence 79) — anchor: crates/ironclaw_host_runtime/src/first_party_tools/profile_set.rs:130
   profile_merge_into now fails closed when an existing profile file is not valid JSON, but the tests only cover a syntactically valid document with a non-string known field. The invalid-JSON branch is a distinct error path and can regress independently.
5. Medium Free-text location is persisted into trusted runtime context (crates/ironclaw_turns/src/run_profile/runtime_context.rs:178-186, confidence 78) — anchor: crates/ironclaw_turns/src/run_profile/runtime_context.rs:178
   location is intentionally free text, then rendered every turn into the trusted runtime-context prompt line after character sanitization. The sanitizer removes control characters but still allows ordinary instruction text, so a saved location such as an instruction-like sentence becomes durable trusted context rather than quoted/user-data context.
6. Medium Profile file is parsed on every turn with no size cap (crates/ironclaw_host_runtime/src/user_profile_source.rs:81-98, confidence 72) — anchor: crates/ironclaw_host_runtime/src/user_profile_source.rs:81
   resolve_user_profile reads context/profile.json and feeds the full byte buffer into serde_json::from_slice on the loop-start path. profile_set caps the values it writes, but existing files or other memory writes can still leave a very large profile document, making every turn spend CPU/heap parsing it before prompt construction.

Notes

• Filtered: performance latency note was already called out as a follow-up in code/PR text.
• Filtered: naming and duplicate-shape notes were lower-signal than the behavior/security blockers.

[henrypark133]

Code Review (multi-agent)

Intent: Add a per-user always-injected agent-context profile for timezone, locale, and location, with typed read/write support and runtime prompt injection.
Stats: 4 findings selected from 8 raw reviewer findings across 4 files. Reviewers run: security, bugs, performance, tests, conventions, local-patterns, maintainability, approach. Reviewers failed: none. Body-only: 0.

Findings

1. Medium The profile size cap still runs after the full read (crates/ironclaw_host_runtime/src/user_profile_source.rs:87-104, confidence 84) — anchor: crates/ironclaw_host_runtime/src/user_profile_source.rs:87
   The follow-up size guard now rejects oversized profile documents before JSON parsing, but resolve_user_profile still calls backend.read_document(...) first and only checks bytes.len() afterward. A manually enlarged context/profile.json is therefore still fully allocated on every loop start before the 64 KiB cap can degrade to no-profile.
2. Medium profile_set does not cover the partial /memory grant branch (crates/ironclaw_host_runtime/src/first_party_tools/profile_set.rs:89-89, confidence 72) — anchor: crates/ironclaw_host_runtime/src/first_party_tools/profile_set.rs:89
   The new caller-level profile_set test covers the absence of a /memory grant, but the guard has a separate branch for mounts that include /memory with read/list/write and no delete. Because profile_set currently routes through ensure_memory_mount(..., true), that partial-grant behavior can change without a caller-level regression catching it.
3. Medium Blank location values are not tested through profile_set (crates/ironclaw_host_runtime/src/first_party_tools/profile_set.rs:51-55, confidence 76) — anchor: crates/ironclaw_host_runtime/src/first_party_tools/profile_set.rs:51
   validated_fields trims location and rejects empty results, but the profile_set tests cover length boundaries rather than empty or whitespace-only location input. That leaves a user-visible malformed-input edge unexercised at the capability boundary.
4. Low Document the new builtin.profile_set capability (crates/ironclaw_host_runtime/src/first_party_tools/mod.rs:175-178, confidence 84) — anchor: AGENTS.md:78
   This adds a new model-visible first-party capability and changes the host-runtime surface, but the branch does not appear to update the relevant capability docs/specs. The repo rule requires behavior changes to update relevant docs/specs in the same branch.

Notes

• I did not repost the production EmptyUserProfileSource concern as a new blocker: it was already raised in the prior review, the author acknowledged it as valid but pre-existing/shared with identity context, and it is tracked in #5013.
• I filtered the memory_write/profile_set approach objection because the PR explicitly argues for a closed typed profile surface and has already redirected raw memory guidance toward profile_set for this narrow field set.
• I filtered the low-severity naming/navigation notes as not worth another forced-review cycle.