P7b: extension-runtime finalize — Lane A package inventory + DEL-5/DEL-2/DEL-8 (runtime PR 9/9)

[BenKurrek]

P7b — extension-runtime finalize (runtime PR 9/9)

Final PR of the extension-runtime train. Stacks on P7a (#6056, base
nea25/16-wire-and-legs). Consolidation-only: no new features or
abstractions — this retires vocabulary and moves package data to where it
belongs so the specificity gate can shrink toward empty.

What landed

MAN-11 / DEL-5 / DEL-2 / Lane B (earlier P7b commits)

• Delete the RuntimeCredentialAccountProviderId alias (MAN-11).
• Retire the ProductAdapter contract as a consolidation (DEL-5): delete the
  trait + WASM crate + dead impls, porting its four live test suites onto
  ChannelAdapter unweakened.
• Rename the *_v2 adapter crates to *_extension (DEL-2).
• Promote the SSO / credential-format / LLM-provider carve-outs (Lane B).
• Encode package self-containment as design law in the docs.

DEL-8 Lane A — package inventory migration (the bulk of this PR)

Every userland first-party package now lives as a self-contained module under
crates/ironclaw_first_party_extensions/src/packages/ (the scanner-exempt home
for concrete names), consumed by composition as an opaque PackageBundle:

Package	Module	Notes
telegram	packages/telegram.rs	channel-only
github	packages/github.rs	WASM tool + onboarding
gmail	packages/gmail.rs	gsuite executor
google-calendar/docs/drive/sheets/slides	packages/gsuite.rs	family (4 WASM + calendar)
notion	packages/notion.rs	MCP
web-access	packages/web_access.rs	no credentials
slack	packages/slack.rs	WASM + bespoke OAuth-setup

The bundle carries, as plain data, everything composition used to compute by
naming the package:

• onboarding copy (PackageOnboarding),
• oauth_setup — a bespoke OAuth-setup credential requirement whose scopes
  differ from the per-tool runtime scopes (PackageOAuthSetup, Slack's personal
  connect),
• trust_effects — the host authority grant (Option<Vec<EffectKind>>),
  carried as an independent assertion (defense in depth), not derived from the
  manifest.

Composition consumes them generically:

• AvailableExtensionCatalog iterates bundled_packages(),
• onboarding() / credential_requirements() read the bundle-carried overrides
  before their legacy per-id paths,
• reserved_host_bundled_extension_id derives migrated ids from the cheap
  bundled_package_ids(),
• builtin_first_party_trust_policy iterates the inventory and builds each
  AdminEntry::for_local_manifest from bundle data — byte-identical to the
  deleted explicit entries (same id / path / manifest-digest / effects). The
  digest is computed generically via host_api::sha256_digest_token.

This cleared every package-machinery name — github, gmail, google×5, notion,
web-access, slack — from available_extensions.rs and factory.rs. The
security-sensitive trust migration is guarded by per-package pins that lock
first-party grant + digest binding (..._grants_migrated_gmail_via_inventory,
the slack trust pin), and the Slack scope-minimization invariant
(slack_read_only_tools_do_not_request_chat_write) is preserved, re-sourced
from the bundle.

ALLOWLIST: ~145 → 102 at this PR's tip. (The finalize-takeover session below takes it 102 → 86; the earlier "113" outran the tree.)

Remaining DEL-8 debt (documented, non-blocking) — SUPERSEDED

Re-triaged and partly resolved in the finalize-takeover section below (lanes 1 & 2 done, notion cleared, Lane 3 deferred). The three buckets below are the accurate P6/P7a snapshot; read the lane table below for the current 102→86 disposition.

The specificity gate passes with a non-empty allowlist (it fails only on
stale/new-violation entries). The (then-)113 entries were not package
machinery — they are three documented-debt buckets (see the DEL-8 row in
docs/reborn/extension-runtime/checklist.md):

1. nearai_mcp — config-dependent runtime manifest assembly (patches
   [mcp].server from env/config); can't be a static bundle without inverting
   the llm_admin config layer.
2. Runtime-woven references — a concrete extension named in generic runtime
   code for channel-routing / outbound-delivery / one-time-migration reasons
   (host_api, product_adapters, product_workflow, reborn, traces,
   skills, and composition's Slack outbound hook + retired-slack_personal
   migrations). Deep Lane C; each site needs per-site degenericization or
   sign-off.
3. i18n frontend copy — vendor names in localized UI strings (SSO providers,
   code-host, a routing hint) across 11 locales; borderline between the SSO /
   code-host carve-out classes and debt.

Still open on this branch (follow-up commits)

• REL-4: retire/refresh the ProductAdapter contract docs
  (contracts/product-adapters.md, contracts/telegram-v2.md) post-DEL-5.
• Lane C degenericization + i18n classification (buckets 2–3 above).

Test evidence

• cargo test -p ironclaw_architecture --test reborn_extension_specificity — green.
• 1116 ironclaw_reborn_composition lib tests (incl. gsuite/slack catalog +
  the trust-policy pins); 143 ironclaw_first_party_extensions tests.
• cargo clippy -p ironclaw_first_party_extensions -p ironclaw_reborn_composition -p ironclaw_architecture --all-features --tests -- -D warnings — clean.
• Full workspace build (--features webui-v2-beta,test-support,libsql) — green.

---

P7b finalize (takeover session) — green the board + lanes 1/2/4 + honesty

Correction to the count above. The branch tip was 102 ALLOWLIST
entries at the start of this session (commit 6e53b1949 "DEL-8 checklist —
allowlist 102"), not the 113 stated earlier — that number outran the tree.
This session takes it 102 → 86 and re-characterizes every survivor as
lane-4 residue.

Task 0 — CI was RED; now green (verified by the aggregate)

Two checks had failed since P7a and were missed for two PRs by watching
sub-jobs instead of the aggregate. Root cause: cargo-deny failed on
error[yanked]: detected yanked crate for spin 0.9.8 (an upstream yank,
bans/licenses/sources were fine — not a dependency change here), and the
Code Style (fmt + clippy) aggregate failed only because it gates on the
deny result. Fix: cargo update -p spin → 0.9.9 (cargo-deny's own suggested
fix; lockfile-only). Verified on CI by aggregate name:
cargo-deny: SUCCESS, Code Style (fmt + clippy): SUCCESS.

Task A — the 102 entries, categorized into lanes

Lane	Mechanism	Entries	Disposition
1 · i18n github	permanent carve-out (localized copy)	11	✅ carved
1 · reborn-extension-surfaces skill	v3 doc rewrite (not an allowlist entry)	—	✅ rewritten
2 · trace redaction classifier	safety-denylist carve-out	4	✅ carved + pin test
bonus · notion false-positive	reword (English word, not the extension)	1	✅ cleared
3 · nearai_mcp	finish-the-slice into the inventory	13	⏸ DEFERRED (owner call — full plan below)
4 · everything else	inventory only	73	📋 tagged // lane-4: + inventoried below

Net: 102 → 86 (removed 11 + 4 + 1). The 86 survivors = 73 lane-4 + 13
deferred nearai_mcp.

Lanes 1 & 2 — fixed

Lane 1 · i18n github carve-out. github appears in exactly three
localized keys, uniform across all 11 locales: the NEAR AI SSO provider name
(onboarding.nearaiLocalSso, the key google is already carved under), GitHub
as a skill-install source (tools.description.builtin.skill_install), and the
user-facing display of the HTTP-tool capability hint
(tools.description.builtin.http/.save). One PATH_TERM_COLLISIONS entry
mirrors the existing google i18n carve. The model-facing source of that
HTTP hint stays tracked as lane-4 debt at host_runtime/first_party_tools/http.rs.

Lane 1 · skill v3 rewrite (REL-4). The reborn-extension-surfaces skill
taught the pre-deletion v2 shape ([product_adapter.inbound],
[[capability_provider.tools.capabilities]], ProviderId, runtime_credentials
blocks, dead files slack_host_beta/runtime_setup.rs, activate_for_channel_setup,
the available_extensions.rs asset registration). Rewritten to schema v3
([[tools]] / [channel] / [auth.<vendor>] / [mcp], VendorId), pointing at
the LIVE worked example (assets/slack/manifest.toml) and current trait homes.
Every cited path/symbol verified live against HEAD (14 paths + 2 migration
exemplars).

Lane 1 · migrations. No separate migration entry survives — the retired
slack_personal / channel-state forward migrations are already in
SANCTIONED_PATHS. The one migration-adjacent residue (factory.rs slack
fold_retired_slack_channel_state / migrate_retired_slack_personal_provider
call sites) is tagged lane-4 migration; it becomes a SANCTIONED_PATHS carve
if those calls move into a dedicated migration module.

Lane 2 · trace redaction classifier — safety-denylist carve.
ironclaw_reborn_traces::contribution keys the payload-redaction profile
(tool_payload_profile) and the external-write side-effect
(classify_tool_side_effect) off tool-name keywords. Those vendor keywords are a
genuine safety denylist and a superset of the bundled inventory — the
messaging profile also covers signal/discord, the issue-tracker profile
gitlab/linear, none of which are packages. Sourcing the set from the
scanner's inventory-derived terms (the mission's Lane-2 primary option) would
drop those keywords and stop redacting those payloads — provably not
byte-identical and a redaction weakening, which the Lane-2 rule forbids. So per
the rule's fallback this is carved as a safety denylist, with a new pin test
(tool_payload_redaction_profile_is_a_safety_denylist_not_inventory_routing)
that locks the vendor→profile map (incl. the non-inventory keywords) through the
production redaction caller.

Lane 3 — nearai_mcp — DEFERRED (owner call, complete plan attached)

Lane 3 (move the last catalog package into the inventory) is a genuine
multi-file refactor across the ironclaw_reborn_composition god-crate that
touches production auth-fallback, boot-time auto-activation, and trust
resolution, with ~5–10 min compile cycles per verification. Per the mission's
explicit "if lanes 1-3 prove larger than one session, ship the green slices and
hand off the remainder rather than rushing," it is deferred with a full,
execution-ready plan (see the handoff). It is not claimed done; DEL-8 stays
[ ]. The 13 nearai_mcp entries are tagged lane-4 nearai-slice.

The finish-the-slice plan (verified against the tree):

1. crates/ironclaw_first_party_extensions/src/packages/nearai_mcp.rs (ID = "nearai", include_str! the already-present assets/nearai-mcp/manifest.toml
   with its placeholder [mcp].server, the web_search schema/prompt assets,
   the onboarding copy currently inline at available_extensions.rs:162,
   oauth_setup: None, trust_effects: None — nearai has no production
   AdminEntry; confirm the first_party_requested → effects path). Add to
   PACKAGES.
2. available_extensions.rs: drop the use crate::llm_admin::nearai_mcp::…
   import, NEARAI_MCP_MANIFEST, nearai_mcp_package, nearai_mcp_assets,
   nearai_mcp_manifest_toml_for_{config,endpoint}. Change
   from_first_party_assets_with_nearai_mcp_config(&NearAiMcpBootstrapConfig) →
   a generic …_with_mcp_server_overrides(&[(ExtensionId, String)]) that runs
   the plain bundled_packages() loop and, for any bundle whose id matches an
   override, patches [mcp].server via a generic patch_mcp_server_url
   helper (no vendor name). NEARAI_EXTENSION_ID/HostManagedCredentialExtension
   use bare nearai (already TERM_COLLISIONS-carved) and stay.
3. Keep the config→URL derivation in llm_admin/nearai_mcp.rs (lane-4); factory.rs
   builds the override list from nearai_mcp_bootstrap_config (ExtensionId::new("nearai")
   is bare-nearai carved; the NearAiMcpBootstrapConfig type keeps factory on
   the lane-4 list) and calls the new generic signature. This clears the 3
   available_extensions.rs nearai entries; the config/auth/bootstrap machinery
   (input/lib/llm_admin/product_auth/runtime/factory) remains legitimate lane-4
   config-assembly residue.
4. Regression anchors that must stay green: first_party_manifest_v3_parity.rs
   (assert_hosted_mcp_projection("nearai-mcp", "nearai")) and
   local_dev_nearai_runtime_selection_falls_back_to_host_managed_account_for_sso_user.

Lane 4 — inventory (owner's next decision; do NOT casually "fix")

Every survivor is tagged in ALLOWLIST with a // lane-4: <category> group
marker. 73 lane-4 + 13 deferred nearai_mcp = 86. Load-bearing branches (the
ones that special-case a vendor in real generic logic) are the actionable set:

file:line	term(s)	kind	would route by
host_runtime/document_output.rs:51 (branch :72)	google, google-drive	branch — hardcoded DOCUMENT_OUTPUT_CAPABILITIES = ["google-drive.download_file"]	a manifest-declared "emits document/base64 payload" output effect (transitional gate, #4999)
host_runtime/first_party_tools/http.rs:35 (used :78)	github	branch — GITHUB_EXTENSION_PREFERENCE injected into every HTTP tool description	installed extensions' declared capabilities for the request's target host
product_adapter_registry/src/lib.rs	github, slack, telegram	branch — per-vendor registry projection	the resolved manifest surface/runtime kind
product_adapters/src/identity.rs	slack, telegram	branch — per-vendor identity map	manifest [channel].conversation_model + vendor
product_adapters/src/outbound.rs	github, google, notion, slack, telegram	branch — per-vendor outbound map	the channel adapter's declared egress/vendor
product_workflow/src/conversation_binding.rs / reborn_services.rs / workflow.rs	slack	branch	channel conversation_model
product_workflow/src/reborn_services/llm_config.rs	github, google	branch — LLM-provider vs extension	(LLM-vendor collision — candidate carve, not extension routing)
product_workflow/src/reborn_services/projects.rs	github	branch	manifest field
product_workflow/{Cargo.toml,src/lib.rs}	telegram	branch — dep + wiring	binding seam
reborn/src/loop_driver_host.rs	slack	branch	channel presentation
reborn/src/tool_disclosure.rs / tool_disclosure_port.rs	google, google-calendar, web-access	branch — per-capability disclosure map	declared tool effects / capability kind
reborn_composition/extension_host/available_extensions.rs:432	google	branch — gsuite search-alias list (gated by is_gsuite_extension_id)	manifest-declared search keywords
reborn_composition/extension_host/extension_lifecycle.rs:90,232	slack	branch — RETIRED_SLACK_USER_EXTENSION_ID const + removal branch	a manifest "retired/superseded" marker
reborn_composition/extension_host/gsuite.rs:54	google	branch — provider != GOOGLE_PROVIDER_ID	the capability's declared credential vendor
reborn_composition/projection/display_preview.rs:590,720	web-access	branch — capability_id == "web-access.{get_content,search}"	the declared effect/kind (content-fetch vs search)
reborn_composition/runtime/local_dev/extension_surface.rs:170	web_access	branch — is_web_access_exa_mcp egress special-case	the resolved-manifest egress host / network policy

Other lane-4 groups (tagged, not individually actionable here):

• doc-str (34) — incidental doc-comment / error-string / tool-description
  examples that name an extension but branch on nothing; the code routes by a
  manifest field (display_name/provider/effects). Sites: host_api/{capability,http,ids,surface}.rs,
  oauth/lib.rs, projects/lib.rs, skills/{selector,types}.rs,
  loop_support/capability_port.rs, filesystem/index.rs, outbound/delivered_gate_routes.rs,
  and composition comment/doc sites (trigger_poller, blocked_auth_resume,
  product_auth/{api/auth,api/auth_prompt,credentials/runtime_credentials,serve/mod},
  projection, projection/turn_events, root/communication_context, runtime,
  lib, factory, llm_admin/nearai_login_serve, outbound_delivery_capability_surface,
  extension_lifecycle github test-support doc).
• web-access-mod (4) — the web-access first-party-handler assembly module
  (web_access.rs) + its mod/re-export in lib.rs and register_* call in
  factory.rs; pending a generic first-party-handler seam keyed by manifest service.
• migration (1) — factory.rs slack fold/migrate call sites (see Lane 1 note).
• dev-dep (1) — Cargo.toml slack: the sanctioned DEL-7 dev-dependency on the
  concrete slack crate (test linkage; the scanner sees the crate name in the manifest).

Honesty restatement

• Lane A (restated accurately): composition's package catalog/registration
  names no extension — the prior Lane A migration cleared github/gmail/google×5/
  notion/web-access/slack/telegram from available_extensions.rs + factory.rs.
  Exception: available_extensions.rs still names nearai_mcp because its
  [mcp].server is config-patched at runtime; that is the deferred Lane 3 slice
  (the last catalog package). Everything else in the 86 is lane-4 branch/doc/
  assembly residue.
• DEL-8: stays [ ] — ALLOWLIST is 86 (all lane-4), enumerated above; not zero.
• REL-1: stays [ ].

Autonomous engineering calls (flagged per the owner-call protocol)

1. Lane 2 carve-out — executes the mission's stated Lane-2 conditional (carve
   when inventory-sourcing would weaken redaction). Generalized the fourth
   carve-domain doc from "credential-format detection" to "vendor-specific safety
   detection" (leak scanners + the trace classifier); the "documented and narrow"
   self-test still passes (terms unchanged).
2. Lane 1 i18n carve incl. the "prefer GitHub" hint — the mission classifies
   the localized hint as localized-user-copy; the model-facing source stays lane-4.
3. notion false-positive reword — an English word ("no notion of an absent
   property"), never extension debt.
4. Lane 3 deferred — session-sized, production-risk (auth/boot/trust) refactor;
   deferred with the plan above rather than rushed.

Test evidence (this session)

• cargo test -p ironclaw_architecture — 5 specificity/self-tests green after
  every slice (i18n carve, trace carve, notion clear, lane-4 regroup); the
  "documented and narrow" + shrink-only self-tests hold.
• cargo test -p ironclaw_reborn_traces — the new redaction-denylist pin passes.
• CI (pushed): cargo-deny + Code Style (fmt + clippy) aggregate both SUCCESS.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (2)

• staging
• reborn-integration

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 50f250d1-5744-474c-925e-510c5b414618

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Code Review

This pull request completes the migration of first-party extensions to a self-contained inventory system. It renames the legacy Slack and Telegram adapter crates to ironclaw_slack_extension and ironclaw_telegram_extension, respectively, and removes the now-obsolete ironclaw_wasm_product_adapters crate. The pull request also retires the ProductAdapter trait and its associated outbound delivery logic, consolidating coverage into the live ChannelAdapter contract and the DeliveryCoordinator. I have no feedback to provide as the changes are well-structured and consistent with the documented architectural migration plan.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[BenKurrek]

Superseded by #6090 — the Train B runtime rollup (P0–P7b squashed into one tree-identical commit on the docs bridge codex/nea25-generic-extension-runtime; tree byte-identical to nea25/17-finalize). This branch is untouched and remains the review record, so reopening is possible. Follow-up work (P6 owner-call fixes + finalization) continues on #6090.