fix hosted HTTP response saving

[serrrfirat]

Summary

• Wire the scoped filesystem into hosted Reborn HTTP egress so builtin.http.save can persist sanitized response bodies.
• Preserve the existing network-policy, mount-authorization, and response-limit pipeline.
• Strengthen the whole-turn regression to assert the downloaded bytes actually exist in /workspace.

Change Type

• Bug fix
• New feature
• Refactor
• Documentation
• CI/Infrastructure
• Security
• Dependencies

Linked Issue

None. Reproduced from an exported hosted single-tenant run.

Validation

• cargo fmt --all -- --check
• cargo clippy --all --benches --tests --examples --all-features -- -D warnings — Not run workspace-wide; scoped all-target/all-feature clippy passed for ironclaw_reborn_composition.
• cargo build — Not run separately; targeted integration and clippy builds completed.
• Relevant tests pass: focused saved-body regression after rebasing onto current main; complete 30-test reborn_integration_tool_call suite before rebase.
• cargo test --features integration — Not applicable: no database schema or backend-specific persistence behavior changed.
• Manual testing — Not applicable: the supplied run artifact was historical; deterministic caller-path coverage reproduces the failure.
• Agent review workflow — Not run; PR remains draft.

A broad cargo test -p ironclaw_reborn_composition run compiled and started 535 tests, but was stopped after unrelated OAuth/extension lifecycle tests exceeded their 60-second warnings. It is not counted as passing evidence.

Test Strategy

User behavior:

Given a hosted single-tenant user invokes builtin.http.save, when the mediated HTTP request succeeds, the sanitized response body is written to the requested scoped /workspace path instead of returning response body store is unavailable.

Risk areas:

• Model behavior
• Browser
• Side effect
• Persistence
• Security or permissions
• External provider
• Cross-component behavior

Tests added or updated:

• Unit or contract: Not applicable: this defect is production composition wiring, not isolated logic.
• Reborn integration: Updated runs_http_save_tool_call_through_real_egress_and_persists_body.
• Recorded fixture: Not applicable: model tool selection and arguments are not changing.
• Browser E2E: Not applicable: no browser surface changes.
• Backend or runtime: The Reborn integration uses the real host egress pipeline with a hermetic wire transport and real scoped filesystem.
• Live canary: Not applicable: deterministic behavior does not depend on a live provider.

What the tests prove:

The test drives a whole scripted turn through the real capability and host egress path, then reads the actual workspace file and verifies the response bytes. Before the fix, the file was absent; after the fix, it contains the expected response body.

Commands run:

• cargo test -p ironclaw_reborn_integration_tests --test reborn_integration_tool_call runs_http_save_tool_call_through_real_egress_and_persists_body
• cargo test -p ironclaw_reborn_integration_tests --test reborn_integration_tool_call
• cargo clippy -p ironclaw_reborn_composition --all-targets --all-features -- -D warnings
• cargo fmt --all -- --check
• git diff --check

Security Impact

Restores the declared scoped-filesystem write path for builtin.http.save. The change does not grant new authority or bypass approval, network policy, mount resolution, sanitization, or response-size enforcement.

Reborn Trust-Boundary Checklist

• Public policy/evidence/trust-bearing types: N/A; no public types changed.
• Untrusted content enters prompts only through an envelope: N/A; no prompt handling changed.
• Hashes declare purpose: N/A; no hashing changed.
• New/changed status, policy, runtime, or error variants: N/A; no variants changed.
• Security/durability serde(default) fields: N/A; no serialization changed.
• Queues/maps/buffers/counters: N/A; no collection or accounting changes.
• Driver/operator-visible errors retain stable class semantics.
• The host-owned scoped filesystem remains behind the existing body-store port.

Database Impact

None. No migrations, schemas, queries, or PostgreSQL/libSQL-specific behavior changed.

Blast Radius

Hosted and production-shaped Reborn runtime composition for builtin.http.save, including hosted-single-tenant and hosted-single-tenant-volume. Inline builtin.http, network policy, secrets, approvals, and other filesystem capabilities are unchanged.

Rollback Plan

Revert commit 2e1ffa279. This restores the prior fail-closed behavior where saved-body HTTP requests return the body-store-unavailable error and write no file.

Review Follow-Through

Reviewer judgment requested on whether a production-profile-specific composition test is desirable beyond the whole-turn real-egress regression. No known compatibility or migration risk.

---

Review track: C (runtime wiring)

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[railway-app]

🚅 Deployed to the ironclaw-pr-6959 environment in ironclaw-ci-preview

Service	Status	Web	Updated (UTC)
ironclaw	✅ Success (View Logs)	Web	Jul 31, 2026 at 2:24 pm

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e380d799-6abd-4fcc-a770-3208f554776a

📥 Commits

Reviewing files that changed from the base of the PR and between 516b961 and 33a5608.

📒 Files selected for processing (1)

• crates/ironclaw_reborn_composition/src/factory/production_backend_assembly.rs

---

📝 Walkthrough

Summary by CodeRabbit

• New Features

  • HTTP egress responses are now persisted to the scoped filesystem, including response bodies saved as files for later access.
  • Saved response content is available in a standard response.json file.

• Bug Fixes

  • Improved HTTP request handling to retain response data during real egress operations.
  • Added validation that HTTP responses are successfully saved and can be retrieved after requests complete.

Walkthrough

HTTP egress assembly now passes a scoped filesystem as its body store. The integration harness creates this filesystem. The HTTP save test uses the real egress pipeline and verifies the persisted response body.

Changes

HTTP egress body-store integration

Layer / File(s)	Summary
Wire scoped filesystem into HTTP egress crates/ironclaw_reborn_composition/src/factory/production_backend_assembly.rs, tests/integration/support/harness/assembly.rs	Test and production builds select the egress and pass the scoped filesystem to try_with_host_http_egress_with_body_store.
Validate persisted response tests/integration/tool_call.rs	The HTTP save test switches to with_real_egress_pipeline() and verifies the response body in response.json.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• nearai/ironclaw#5591: Modifies HTTP egress integration tests and filesystem-backed response persistence.
• nearai/ironclaw#6203: Wires filesystem-backed storage into HTTP egress body persistence.
• nearai/ironclaw#6279: Refactors production backend assembly and HTTP egress wiring.

Suggested reviewers: benkurrek

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the hosted HTTP response-saving bug fix, although it does not use the preferred Conventional Commits format.
Description check	✅ Passed	The description covers the change, validation, test strategy, security, trust boundaries, database impact, blast radius, rollback, and review follow-up.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ironloopai]

🔎 Review · PR #6959

🟢 Completed · Review submitted

Submitted review →

Reviewed the complete trusted base-to-head comparison across all three changed files. The hosted production assembly now supplies its existing scoped filesystem through the established HTTP body-store port, preserving authorization, sanitization, network-policy, and response-limit stages. The integration harness mirrors this wiring, and the regression verifies the persisted response bytes through the real egress pipeline. No actionable issues found.

_{Automatic · PR opened · attempt 1 of 3 · completed in 1m 35s}

Run details

• Repository: nearai/ironclaw
• Base: main at a88bcb2
• Head: codex/fix-hosted-http-save at 2e1ffa2
• Created: Jul 31, 2026, 12:55 PM UTC
• Updated: Jul 31, 2026, 12:56 PM UTC
• Run: 2fabf84a-97b9-4662-b8f1-086c69dd7b4e
• Latest attempt: 1 · Completed · dcae36aa-3ace-4af4-a86c-5a3647bdd39d

[ironloopai]

🔍 Review complete · PR #6959

✅ No actionable findings

Reviewed the complete trusted base-to-head comparison across all three changed files. The hosted production assembly now supplies its existing scoped filesystem through the established HTTP body-store port, preserving authorization, sanitization, network-policy, and response-limit stages. The integration harness mirrors this wiring, and the regression verifies the persisted response bytes through the real egress pipeline. No actionable issues found.

Validation and technical details

• Verified trusted comparison refs: base a88bcb2 and head 2e1ffa2.
• Inspected the complete diff and surrounding production assembly, host-runtime builder, body-store authorization/write implementation, egress pipeline, mount resolver, integration harness, and workspace read-back assertion.
• Confirmed the modified files in the checkout match refs/ironloop/head despite the checkout HEAD pointing at a different commit.
• git diff --check refs/ironloop/base..refs/ironloop/head completed without errors.
• Focused cargo test could not run because cargo is unavailable in the review environment (cargo: command not found).
• Base: main
• Head: codex/fix-hosted-http-save at 2e1ffa2
• Run: 2fabf84a-97b9-4662-b8f1-086c69dd7b4e

[github-actions]

Coverage ratchet

Ratchet mode: ENFORCING

RATCHET PASS: global
  observed: 85.73% (323144 / 376937 lines)
  floor:    85.11% (tolerance 0.5pp -> effective floor 84.61%)
  denominator: 376937 lines now vs 375097 at floor capture (+1840 lines, +0.49%) — not a material change

RATCHET PASS: ironclaw_runner
  observed: 86% (15127 / 17590 lines)
  floor:    85.55% (tolerance 0.5pp -> effective floor 85.05%)
  floor_covered_lines: 14658 (tolerance 20 lines -> effective floor 14638)
  denominator: 17590 lines now vs 17133 at floor capture (+457 lines, +2.67%) — not a material change

RATCHET PASS: ironclaw_processes
  observed: 88.79% (5891 / 6635 lines)
  floor:    88.07% (tolerance 0.5pp -> effective floor 87.57%)
  floor_covered_lines: 5839 (tolerance 20 lines -> effective floor 5819)
  denominator: 6635 lines now vs 6630 at floor capture (+5 lines, +0.08%) — not a material change

RATCHET PASS: ironclaw_turns
  observed: 86.54% (9863 / 11397 lines)
  floor:    85.11% (tolerance 0.5pp -> effective floor 84.61%)
  floor_covered_lines: 9515 (tolerance 20 lines -> effective floor 9495)
  denominator: 11397 lines now vs 11179 at floor capture (+218 lines, +1.95%) — not a material change

RATCHET PASS: ironclaw_authorization
  observed: 86.59% (723 / 835 lines)
  floor:    62.51% (tolerance 0.5pp -> effective floor 62.01%)
  floor_covered_lines: 612 (tolerance 20 lines -> effective floor 592)
  denominator: 835 lines now vs 979 at floor capture (-144 lines, -14.71%) — material change (>5%)

RATCHET PASS: ironclaw_approvals
  observed: 91.05% (1820 / 1999 lines)
  floor:    85.86% (tolerance 0.5pp -> effective floor 85.36%)
  floor_covered_lines: 1822 (tolerance 20 lines -> effective floor 1802)
  denominator: 1999 lines now vs 2122 at floor capture (-123 lines, -5.8%) — material change (>5%)

RATCHET PASS: ironclaw_secrets
  observed: 85.77% (2887 / 3366 lines)
  floor:    84.01% (tolerance 0.5pp -> effective floor 83.51%)
  floor_covered_lines: 2795 (tolerance 20 lines -> effective floor 2775)
  denominator: 3366 lines now vs 3327 at floor capture (+39 lines, +1.17%) — not a material change

RATCHET PASS: ironclaw_filesystem
  observed: 76.27% (5852 / 7673 lines)
  floor:    75.93% (tolerance 0.5pp -> effective floor 75.43%)
  floor_covered_lines: 5826 (tolerance 20 lines -> effective floor 5806)
  denominator: 7673 lines now vs 7673 at floor capture (+0 lines, +0%) — not a material change

RATCHET PASS: ironclaw_llm
  observed: 79.96% (22644 / 28318 lines)
  floor:    79.92% (tolerance 0.5pp -> effective floor 79.42%)
  floor_covered_lines: 22566 (tolerance 20 lines -> effective floor 22546)
  denominator: 28318 lines now vs 28235 at floor capture (+83 lines, +0.29%) — not a material change

RATCHET PASS: ironclaw_triggers
  observed: 94.88% (3092 / 3259 lines)
  floor:    86.04% (tolerance 0.5pp -> effective floor 85.54%)
  floor_covered_lines: 2804 (tolerance 20 lines -> effective floor 2784)
  denominator: 3259 lines now vs 3259 at floor capture (+0 lines, +0%) — not a material change

RATCHET PASS: ironclaw_product
  observed: 87.49% (22827 / 26090 lines)
  floor:    86.94% (tolerance 0.5pp -> effective floor 86.44%)
  floor_covered_lines: 21367 (tolerance 20 lines -> effective floor 21347)
  denominator: 26090 lines now vs 24576 at floor capture (+1514 lines, +6.16%) — material change (>5%)

RATCHET PASS: ironclaw_outbound
  observed: 94.68% (4271 / 4511 lines)
  floor:    93.49% (tolerance 0.5pp -> effective floor 92.99%)
  floor_covered_lines: 4105 (tolerance 20 lines -> effective floor 4085)
  denominator: 4511 lines now vs 4391 at floor capture (+120 lines, +2.73%) — not a material change

RATCHET PASS: ironclaw_extension_host
  observed: 83.82% (22271 / 26569 lines)
  floor:    83.82% (tolerance 0.5pp -> effective floor 83.32%)
  floor_covered_lines: 22271 (tolerance 20 lines -> effective floor 22251)
  denominator: 26569 lines now vs 26569 at floor capture (+0 lines, +0%) — not a material change

RATCHET PASS: ironclaw_events
  observed: 81.04% (1252 / 1545 lines)
  floor:    81.04% (tolerance 0.5pp -> effective floor 80.54%)
  floor_covered_lines: 1252 (tolerance 20 lines -> effective floor 1232)
  denominator: 1545 lines now vs 1545 at floor capture (+0 lines, +0%) — not a material change

RATCHET PASS: ironclaw_safety
  observed: 92.75% (4468 / 4817 lines)
  floor:    92.44% (tolerance 0.5pp -> effective floor 91.94%)
  floor_covered_lines: 3973 (tolerance 20 lines -> effective floor 3953)
  denominator: 4817 lines now vs 4298 at floor capture (+519 lines, +12.08%) — material change (>5%)

RATCHET PASS: ironclaw_host_runtime
  observed: 88.38% (21083 / 23855 lines)
  floor:    88.23% (tolerance 0.5pp -> effective floor 87.73%)
  floor_covered_lines: 20538 (tolerance 20 lines -> effective floor 20518)
  denominator: 23855 lines now vs 23277 at floor capture (+578 lines, +2.48%) — not a material change

Reborn integration-tier coverage

Line coverage (Reborn crates): 85.73% — 323144 / 376937 lines

Per-crate breakdown (60 crates, lowest-covered first)

Crate	Line %	Covered / Total
ironclaw_host_ingress	42.5%	17 / 40
ironclaw_memory	53.48%	630 / 1178
ironclaw_projects	72.36%	233 / 322
ironclaw_trust	73.71%	670 / 909
ironclaw_capabilities	73.92%	2854 / 3861
ironclaw_extractors	75.88%	538 / 709
ironclaw_reborn_cli	76.1%	11084 / 14566
ironclaw_observability	76.19%	32 / 42
ironclaw_filesystem	76.27%	5852 / 7673
ironclaw_wasm	78.84%	704 / 893
ironclaw_llm	79.96%	22644 / 28318
ironclaw_auth	80.01%	6033 / 7540
ironclaw_events	81.04%	1252 / 1545
ironclaw_memory_native	81.48%	2952 / 3623
ironclaw_first_party_extensions	82.57%	6784 / 8216
ironclaw_libsql_runtime	83.3%	384 / 461
ironclaw_host_api	83.42%	9718 / 11649
ironclaw_extension_host	83.82%	22271 / 26569
ironclaw_operator	84.47%	5309 / 6285
ironclaw_hooks	84.58%	9906 / 11712
ironclaw_network	84.92%	890 / 1048
ironclaw_reborn_event_store	84.93%	1206 / 1420
ironclaw_reborn_config	85.29%	2110 / 2474
ironclaw_reborn_composition	85.51%	21781 / 25473
ironclaw_secrets	85.77%	2887 / 3366
ironclaw_runner	86%	15127 / 17590
ironclaw_common	86.03%	1779 / 2068
ironclaw_skills	86.41%	4827 / 5586
ironclaw_turns	86.54%	9863 / 11397
ironclaw_authorization	86.59%	723 / 835
ironclaw_webui	86.93%	11821 / 13598
ironclaw_wasm_limiter	87.06%	74 / 85
ironclaw_product	87.49%	22827 / 26090
ironclaw_reborn_traces	87.61%	11720 / 13377
ironclaw_extensions	87.84%	4870 / 5544
ironclaw_scripts	87.87%	420 / 478
ironclaw_event_projections	88.06%	1372 / 1558
ironclaw_threads	88.14%	5189 / 5887
ironclaw_host_runtime	88.38%	21083 / 23855
ironclaw_telegram_extension	88.52%	586 / 662
ironclaw_process_sandbox	88.64%	281 / 317
ironclaw_processes	88.79%	5891 / 6635
ironclaw_reborn_openai_compat	89.4%	3644 / 4076
ironclaw_telegram_v2_adapter	89.43%	1573 / 1759
ironclaw_loop_host	90.47%	18045 / 19946
ironclaw_resources	90.76%	4084 / 4500
ironclaw_approvals	91.05%	1820 / 1999
ironclaw_reborn_identity	91.3%	451 / 494
ironclaw_mcp	91.91%	1318 / 1434
ironclaw_conversations	92.08%	2383 / 2588
ironclaw_event_streams	92.5%	1048 / 1133
ironclaw_safety	92.75%	4468 / 4817
ironclaw_agent_loop	93.52%	10428 / 11151
ironclaw_slack_extension	93.94%	3689 / 3927
ironclaw_first_party_extension_ports	94.66%	3758 / 3970
ironclaw_outbound	94.68%	4271 / 4511
ironclaw_triggers	94.88%	3092 / 3259
ironclaw_prompt_envelope	97.46%	192 / 197
ironclaw_runtime_policy	97.6%	855 / 876
ironclaw_attachments	98.23%	831 / 846

This table itself is informational and never gates the PR on its own — not the percentage, not the per-crate holes, not the 0-coverage callout. A separate coverage ratchet (dry-run until enforce=true; see tests/integration/coverage-floor.toml) can fail the build on specific configured floors.

Exemptions (18 entry/entries excluded from the accounting above)

Module / Crate	Reason	Issue
crate: ironclaw_embeddings	v1-only: consumed only by root ironclaw (src/app.rs, src/tools/builtin/memory.rs, src/workspace/mod.rs, src/config/{mod,embeddings}.rs); no crates/* dependents. Covered by "Tests (Legacy)".	#5657
crate: ironclaw_gateway	v1-only: consumed only by root ironclaw (src/channels/web/platform/static_files.rs, src/channels/web/handlers/frontend.rs); no crates/* dependents. Covered by "Tests (Legacy)".	#5657
crate: ironclaw_tui	v1-only: consumed only by root ironclaw (src/main.rs, src/channels/tui.rs); no crates/* dependents. Crate's own doc comment confirms it bridges INTO v1, not Reborn. Covered by "Tests (Legacy)".	#5657
crates/ironclaw_attachments/src/lib.rs	Declarative crate facade: module declarations, constants, and re-exports only; executable attachment modules remain covered.	#6524
crates/ironclaw_extension_host/src/ingress/mod.rs	Declarative ingress module facade and documentation only; executable router modules remain covered.	#6524
crates/ironclaw_host_api/src/lib.rs	Declarative crate facade: module declarations and re-exports only; executable host API modules remain covered.	#6524
crates/ironclaw_host_api/src/product_adapter/mod.rs	Declarative product-adapter facade: module declarations and re-exports only; executable adapter modules remain covered.	#6524
crates/ironclaw_llm/src/rig_adapter/tests/finish_reason_tests.rs	Test-only module stored under src/ for private adapter access; cargo-llvm-cov omits test harness source from production LCOV while the exercised rig_adapter.rs production lines remain coverage-gated.	#6284
crates/ironclaw_outbound/src/error.rs	Declarative error vocabulary only; variants have no LLVM-instrumentable production statements.	#6524
crates/ironclaw_outbound/src/lib.rs	Declarative crate facade: module declarations and re-exports only; executable outbound modules remain covered.	#6524
crates/ironclaw_product/src/lib.rs	Declaration-only public facade with no executable Rust statements; rustc emits no LCOV source record. Executable product behavior remains covered in the owned implementation modules.	#6524
crates/ironclaw_product/src/lib.rs	Declarative crate facade: module declarations and re-exports only; executable product modules remain covered.	#6524
crates/ironclaw_product/src/scoped_fs/mod.rs	Declarative scoped-filesystem facade and documentation only; executable scoped filesystem modules remain covered.	#6524
crates/ironclaw_reborn_composition/src/support/fs/mod.rs	Declarative composition support facade: module declarations and re-exports only; executable filesystem adapters remain covered.	#6524
crates/ironclaw_slack_extension/src/lib.rs	Declarative Slack crate facade: module declarations and re-exports only; executable Slack modules remain covered.	#6524
crates/ironclaw_telegram_extension/src/lib.rs	Declarative Telegram crate facade: module declarations and re-exports only; executable Telegram modules remain covered.	#6524
crates/ironclaw_threads/src/lib.rs	Declaration-only public facade with no executable Rust statements; rustc emits no LCOV source record. Executable thread behavior remains covered in the owned implementation modules.	#6524
crates/ironclaw_webui/src/webui_v2/mod.rs	Declaration-only WebUI v2 facade with no executable Rust statements; rustc emits no LCOV source record. Executable route behavior remains covered in the owned implementation modules.	#6524