feat(extension-runtime): Train B rollup — unified extension runtime P0–P7b

[BenKurrek]

What this is

A tree-identical, non-destructive squash of the 9-phase IronClaw runtime train
(Train B — branches nea25/09-generic-runtime … nea25/17-finalize) into a single
commit on the docs bridge codex/nea25-generic-extension-runtime. The rollup commit's
tree is byte-identical to nea25/17-finalize (tip f8cbc88): both sides have tree
hash 1b2a43c96871633ba04c797122eb80c3547cf7ab, and git diff nea25/17-finalize is
empty. No code is lost; every phase branch remains alive.

This exists so the remaining P6 owner-call fixes and finalization can land on one
branch instead of being cascaded through nine.

The model (design law: docs/reborn/extension-runtime/)

Every integration (Slack, Gmail, GitHub, Telegram, …) is an ordinary installable
extension package. A generic runtime installs, activates, dispatches, and removes
extensions using only their manifest plus two adapter seams (ToolAdapter,
ChannelAdapter) and one recipe-driven auth engine — no generic crate contains a
concrete product name, protocol type, route, or behavior branch. ~34k lines of
per-vendor Slack machinery deleted.

Phases (from implementation.md §13)

Phase	PR	Content
P0	#5993	Architecture gates (specificity scanner + dependency-direction gate + retired-taxonomy gate; allowlist enumerating today's violations) + acme-messenger fixture
P1	#5995	Manifest v3 (inline [channel], [auth.*], [mcp]) + VendorId rename + recipe types + resolved record/digest + v2 normalization + first-party manifest rewrite
P2	#5996	ToolAdapter/ChannelAdapter + ExtensionEntrypoint + loaders (native/wasm/mcp) + ExtensionHost, installation state machine, immutable active snapshot; tool dispatch cutover
P3	#6008	AuthEngine (oauth2_code + api_key) + per-vendor recipes + auth account state machine; delete provider multiplexing (grants storage reused)
P4	#6007	Generic ingress router + declarative verifier (hmac_sha256 / shared_secret_header); Slack + Telegram inbound through adapters
P5	#6012	DeliveryCoordinator (all outbound intents, sole delivery-state writer) + Slack/Telegram outbound; CommunicationPresentationPolicy; generic trace contributions
P6	#6025 (draft)	Extraction completion: config/connect UI + frontend replacement + CLI/config cleanup; delete composition/src/slack/** + old adapter crates; H.3–H.6 migrations
P7a	#6056	Wire state enums (installation + auth account) + per-vendor accounts-list wire shape (list-first for the multi-account follow-up) + deferred legs
P7b	#6065	Finalize: Lane A first-party package inventory as opaque bundles; DEL-2/DEL-5/DEL-8 consolidation; specificity allowlist reduction; VendorId alias deleted; REL docs

Sibling-merge note: the train DAG has a sibling merge (P3 nea25/12-auth-engine was
merged into the P6 line), so the tip's tree already contains both P3 (auth engine,
crates/ironclaw_auth/src/engine/) and P4 (ingress router,
crates/ironclaw_extension_host/src/ingress/router.rs). This squash flattens that DAG
into one diff — both are present and verified in the rollup tree.

Review record & supersession

This PR supersedes and squashes #5993, #5995, #5996, #6008, #6007, #6012, #6056,
#6065. Those 8 phase PRs are commented and closed, but their branches are untouched
— they remain the review record, including their PR bodies' flagged owner calls
(P5/#6012 flags 16; P6/#6025 flags 8). Closing is fully reversible: the branches
are intact and the PRs can be reopened.

P6 (#6025) is deliberately left open — it is still a draft, and its owner-call fixes
land on this branch next (the reason this rollup exists).

Because the diff is ~445 files (+57.7k / −62.6k), a squashed PR is not
unit-reviewable; the phase branches and their PR bodies are the review record.

Base

Head nea25/runtime-rollup, base codex/nea25-generic-extension-runtime — the same
base as P0/#5993 (the docs bridge = Train A tip + the design docs), so this PR's diff is
exactly Train B. It retargets onto main only after Train A merges.

Verification

• Tree-identical (correctness gate): rollup tree 1b2a43c9… == nea25/17-finalize
  tree 1b2a43c9…; git diff nea25/17-finalize is empty.
• One commit on codex/nea25-generic-extension-runtime (git rev-list --count = 1).
• P3 + P4 both present in the tree (auth engine + ingress router).
• CI: verified via the top-level "Code Style (fmt + clippy)" aggregate on this
  branch; the tree is byte-identical to already-green nea25/17-finalize, so the
  aggregate reproduces green.
• Backup ref backup/nea25-17-pre-rollup records the pre-rollup tip (f8cbc88).

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 73c6dfdf-9c78-4805-844e-d1f9f2335521

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Code Review

This pull request implements a significant architectural refactor of the extension system, transitioning to a unified manifest v3 format and introducing the ironclaw_extension_host crate to manage extension lifecycles, active snapshots, and ingress routing. Key changes include replacing the ProductAdapter trait with a more robust adapter system, centralizing auth logic into a recipe-driven engine, and adding new architectural gates for specificity and manifest reparsing. The reviewer correctly identified an improvement opportunity regarding the usage of the rand crate in the new keepalive sweep logic, recommending the use of rand::thread_rng() and gen_range for better practice.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

The RngExt trait and random_range method are deprecated in recent versions of the rand crate. It's recommended to use the Rng trait and the gen_range method instead. Using rand::thread_rng() is also more explicit than rand::rng().

Suggested change

	use rand::RngExt as _;
	let max_nanos = max.as_nanos().min(u64::MAX as u128);
	let nanos = rand::rng().random_range(0..=max_nanos);
	let nanos = u64::try_from(nanos).unwrap_or(u64::MAX);
	Duration::from_nanos(nanos)
	use rand::Rng;
	let max_nanos = max.as_nanos().min(u64::MAX as u128);
	let nanos = rand::thread_rng().gen_range(0..=max_nanos);
	let nanos = u64::try_from(nanos).unwrap_or(u64::MAX);
	Duration::from_nanos(nanos)

[ilblackdragon]

Closing this because it still updates legacy top-level src/ runtime/extension paths as part of the extension-runtime rollup. Product work has moved to the Reborn workspace under crates/, so this PR is outdated as an implementation path.

The Reborn extension-runtime direction is already tracked broadly in #1741.