refactor(contracts): invert extension_host's product-facing ports onto product_contracts (WS2.1)

[BenKurrek]

Wave 2, slot 1 — CHECKLIST WS2 row 1. ironclaw_extension_host now implements ironclaw_product_contracts port definitions instead of ironclaw_product ones. Behavior-free: definitions move, every implementation stays with its owner (PROPOSAL §6.1.4).

This is the ordering-constrained half of §12.1c — port inversions land before the layer flip. The products → loops move for extension_host is a later WS2 slice and is deliberately not here.

---

Port inventory — each product dependency → the contracts port that replaced it → where the impl lives

Eleven port declarations moved across ten new modules (ironclaw_product_contracts 7 → 17). Nine are implemented by ironclaw_extension_host — those are the set the new architecture test pins as INVERTED_PORTS. The other two (AdminUserService, RebornOperatorToolCatalog) extension_host only consumes; their implementations are in ironclaw_reborn_composition, so they moved for the same reason — a port whose implementation sits outside product does not belong inside it.

Was (ironclaw_product)	Now (ironclaw_product_contracts::)	Implementation stayed in
delivery_coordinator::{ChannelDeliveryResolver, ResolvedChannelDelivery, DeliveryReplyContextSource}	delivery	extension_host (channel_delivery.rs, channel_dm_provisioning.rs); NoReplyContext + DeliveryCoordinator stay in product
extension_account_setup::{AccountConnectionStatusSource, AccountConnectionStatusError, ChannelConnectionNoticePolicy, ExtensionAccountSetupDescriptor, ExtensionAccountSetupError}	account_setup	extension_host::channel_pairing; ExtensionAccountSetupRegistry (mutable state) stays in product
reborn_services::ChannelConfigProductService	channel_config	extension_host::channel_config
reborn_services::views::{RebornViewProvider, RebornViewDescriptor, RebornViewQuery, RebornViewPage}	views	extension_host::admin_configuration + product's own providers; ProductView + UnavailableRebornViewProvider stay in product
command_admission::CommandActorRoleResolver + command_dispatch::ProductCommandContext	command	extension_host::channel_command_roles; DirectConversationCommandAdmission stays in product
action::{ProductActionId, ActionFingerprintKey, SourceBindingKey, ProductCommandName, AuthRequestRef, LinkedThreadActionId}	action	n/a (DTOs; the ProductInboundAction ledger record + saga stay in product)
run_delivery::{ApprovalPromptContextSource, BlockedAuthPromptSource} + auth_prompt::BlockedAuthPromptRequest	prompt_source	extension_host::run_delivery_ports; auth_prompt_view_for_blocked_auth (the renderer) stays in product
lifecycle::{LifecycleProductService, LifecycleProductContext, LifecycleProductSurfaceContext}	lifecycle_service	extension_host::lifecycle_product_service; UnsupportedLifecycleProductService stays in product
reborn_services::admin_users::{AdminUserService, AdminUserRecord/Role/Status/Error/SecretMeta, AdminCreateUserFields, AdminCreatedUser, ADMIN_USER_LIST_*}	admin_users	ironclaw_reborn_composition; RejectingAdminUserService + the RebornAdmin* wire DTOs stay in product
reborn_services::{RebornOperatorToolCatalog, RebornOperatorToolInfo}	operator_tools	ironclaw_reborn_composition

Alongside, the product re-export facade dissolved for extension_host: symbols it reached through ironclaw_product that already lived in ironclaw_host_api / ironclaw_extension_contracts / ironclaw_product_contracts now import from their owner — the sweep WS1.4's location-scan module doc explicitly deferred to "WS2/WS6, which repoint those crates for their own reasons". Every other crate got only the moved names repointed, so webui / openai_compat / operator keep their own flips intact.

Measured effect: extension_host's ironclaw_product:: production usage 146 → 62 distinct symbols across 46 → 35 files.

---

Row corrections (re-verified against this PR's base a50ad0638)

1. The wave milestone's "extension_host → product edge dies" is not reachable in this row — structurally, not as a shortfall

All 62 survivors are owned by later WS2 rows, and the mapping is exact:

Survivor class	Files	Owning WS2 row
Product's concrete assembly constructed inline (DefaultProductSurface, DefaultInboundTurnService, RebornFilesystemIdempotencyLedger, StaticProductInstallationResolver, DirectConversationCommandAdmission::new, ProductConversationBindingService::new, DeliveryCoordinator, RunDeliveryServices/Settings/Observer)	channel_host.rs (26 symbols)	not yet assigned — see the owner call below
extension_manager split inventory (admin_configuration*, operator_config_capability, skill_auto_activate_capability, webui_extension_credentials, available_extensions, product_lifecycle, extension_lifecycle_*)	9 files	"Split ironclaw_extension_manager out of extension_host"
product::adapter_registry::{PRODUCT_ADAPTER_HOST_API_ID, product_adapter_sections, register_product_adapter_host_api_contract}	channel_lifecycle.rs, available_extensions.rs, host_api_contracts.rs	§6.9.1's shed of adapter_registry manifest parsing → extension_contracts/extension_registry
Named strays (projection::LiveProjectionPublisher, TriggeredRunDeliveryDriver)	skill_learning.rs, channel_triggered_delivery.rs	"Relocate extension_host strays"
ProductSurfaceFailure (19 files)	see finding 3	blocked — no row owns it yet

§12.1c's own wording is the correct reading ("port inversions land before the layer flip"); PLAN's per-row milestone compressed a wave-level outcome into one row. CHECKLIST WS2 row 1 is amended with this.

2. extension_host carries no LAYER_MATRIX_EXCEPTIONS entry, and never did — the count stays 13

The brief expected "any exception entries it carries fall (the count on main is 13)". Every one of the 13 was re-read at this base: none names extension_host, product, or product_contracts. The mechanism explains why — both crates declare layer = "products", and layer_allows_dependency permits products → products, so this edge is legal by the matrix and invisible to it. That is exactly why it needed a purpose-built gate (below).

3. Six ports could not move, all for one mechanical reason — and ProductSurfaceFailure is the linchpin

product_contracts' enforced allowlist is ironclaw_host_api + ironclaw_extension_contracts and nothing else internal. A port whose signature names a type from ironclaw_auth, ironclaw_threads, ironclaw_turns, or ironclaw_conversations therefore cannot be declared there:

Port	Blocking type
AuthChallengeProvider	returns Result<_, ironclaw_auth::AuthProductError>; carries AuthProviderId, CredentialAccountLabel, OAuthAuthorizationUrl
ChannelConnectionService	returns ChannelAuthAccountState { ironclaw_auth::AuthFlowStatus, CredentialAccountStatus }
ExtensionCredentialSetupService	request/response are ironclaw_auth credential-account projections
ConversationBindingService	errors with ProductSurfaceFailure
ProductActorUserResolver	errors with ProductSurfaceFailure; resolves to ResolvedProductActorUser { ironclaw_conversations::ExternalActorBindingEpoch }
ProductConversationSubjectRouteResolver	errors with ProductSurfaceFailure

The durable finding. ProductSurfaceFailure documents itself as "the internal error type used within the workflow crate", yet ironclaw_extension_host uses it as its own lifecycle error vocabulary across 19 production files, constructing InvalidBindingRequest / Transient / ProviderInstanceNotConfigured directly. It cannot follow the ports into contracts because two variants carry ironclaw_turns::TurnError (crates/ironclaw_product/src/error.rs:10,90,112). Until it is narrowed off ironclaw_turns or replaced by an extension-host-owned error, it blocks half the residue and is the largest single remaining term in the extension_host → product edge. Recommend a dedicated WS2 slice before the layer flip.

4. ProductCommandAdmissionService is a §6.1.3-vs-§6.9.1 conflict — recorded, not decided

§6.1.3 assigns "the ProductCommandAdmissionService shape" to product_contracts; its admit takes &ProductCommand, and §6.9.1 keeps the command grammar with product's frozen inventory. Neither this row nor WS1.4 had standing to choose. Left in ironclaw_product; recorded in ironclaw_product_contracts/CLAUDE.md.

5. Docs-truth correction (families/contracts.md)

The entry and PROPOSAL §6.1.3 both list ironclaw_common among product_contracts' dependencies. The crate has never held that edge, and the enforced allowlist (product_contracts_allowed) is the two crates it does hold. Amended in place with the date and the evidence.

Follow-up recorded from review (deliberately not in a move-shaped PR)

Three signatures this PR relocated verbatim are stringly-typed and should not stay that way. Retyping any of them changes the contract for its implementors, and PLAN's operating principle 2 keeps semantic changes out of move PRs — so each is recorded here with a named home: the same slice that has to narrow ProductSurfaceFailure off ironclaw_turns is already reopening these signatures.

• prompt_source::BlockedAuthPromptRequest.gate_ref: &str → &TurnGateRef. The inconsistency is visible in one file: the sibling ApprovalPromptContextSource::approval_prompt_context already takes &TurnGateRef.
• lifecycle_service::LifecycleProductService::installed_activation_errors → HashMap<ExtensionId, String>. The doc says "keyed by extension id"; the host implementation already holds typed ExtensionId and stringifies to satisfy the signature.
• delivery::ResolvedChannelDelivery.{extension_id, installation_id}: String → distinct newtypes, so an identity mixup fails to compile.

A fourth, also verbatim and also recorded rather than fixed: LifecycleProductService::import_extension_bundle's default says "unavailable" but returns InvalidRequest/400 — different code, different meaning, and 400 blames the caller for an unwired capability. Changing it changes an HTTP status on a live WebUI route. The doc comment now describes what the code does and names the discrepancy, and the test comment says it pins today's behavior, so the flip cannot happen silently.

Owner call needed (skipped, not stalled)

crates/ironclaw_extension_host/src/channel_host.rs is composition-shaped assembly living in extension_host, and no WS2 row owns it. It constructs DefaultProductSurface, DefaultInboundTurnService, RebornFilesystemIdempotencyLedger, StaticProductInstallationResolver, DirectConversationCommandAdmission, and ProductConversationBindingService — product's concrete types, which by construction cannot be inverted into contracts. It alone is 26 of the 62 surviving symbols. Either it moves to composition, or the assembly inverts behind a factory port, or the layer flip cannot happen. §6.8.2's shed list does not name it. This needs the owner before the WS2 sequence reaches the flip.

---

New enforcement — crates/ironclaw_architecture/tests/reborn_extension_host_port_inversion.rs

The layer matrix cannot see this edge (finding 2), so the row gets its own gate. Three tests:

1. extension_host_implements_only_the_frozen_residue_of_product_defined_traits — discovers every trait declared in ironclaw_product, scans extension_host's production source (#[cfg(test)] blocks and *_tests.rs stripped, same shape as reborn_registration_pipeline_boundary.rs) for impl … for, and requires the intersection to equal the six-entry residue exactly. A new one fails ("define the port in product_contracts instead of adding a row here"); a stale one fails too, so the row is deleted in the change that removes the edge. Plus a <= 6 shrink-only baseline.
2. inverted_ports_are_declared_in_contracts_and_implemented_below_product — the nine moved ports are declared in product_contracts, not re-declared in product, and still implemented in extension_host. Makes a revert loud.
3. impl_scanner_reads_the_trait_out_of_real_impl_shapes — self-test over plain / generic / path-qualified / inherent / commented-out / #[cfg(test)] impl shapes, so the scan cannot go quietly vacuous.

Zero-match check: the scanner asserts it walked >20 files and that both crates yield a non-empty trait set, so a broken path fails loudly rather than passing empty.

Enumerating gates touched (all update-never-relax)

Gate	Change
docs/plans/composition-pubuse.snapshot	126 → 127. ChannelConnectionNoticePolicy + ExtensionAccountSetupDescriptor are re-sourced from product_contracts::account_setup and ChannelConnectionRequirement from package_lifecycle, so one four-name pub use splits into three. Same public name set — nothing added or removed.
reborn_extension_specificity.rs allowlist (128/130)	untouched — no vendor term left or entered a listed file; the staleness half passes.
reborn_struct_test_support_ratchet.rs (79 paths / 276 members)	untouched — the move carried no #[cfg(test)] struct members.
reborn_cross_crate_include_scan.rs (62 escaping / 19 cross-crate)	untouched — swept every file I moved code out of for include_str!/include_bytes!; none carried one.
reborn_service_method_freeze_ratchet.rs	untouched — ProductSurface still 3 methods; reborn_services.rs grows no local surface trait.
reborn_product_contract_location_scan.rs	auto-enrolled — its one-import-path half discovers every trait product_contracts declares, so the nine new ports inherit the no-re-export rule with no edit. ironclaw_product re-exports none of them.
LAYER_MATRIX_EXCEPTIONS	13, unchanged (finding 2).
classify-test-scope.sh / reborn-crate-test-buckets.sh	no edit needed — all four touched crates already have arms/buckets; this diff lights product-workflow + extension-operator.

New dependency: secrecy = "0.10" on product_contracts, with a manifest comment stating why (AdminUserService::put_secret takes the material, AdminCreatedUser carries the one-time token — both SecretString, so the port cannot be implemented or called with a self-Debug-printing String). It is a value wrapper, not on the contracts framework/driver/runtime-client denylist.

Un-masking

Full unfiltered --list inventory of all four touched crates on origin/main@a50ad0638 vs this branch, compared name by name:

• 1976 → 1977 tests. Zero removed. One added.
• The two typed-token tests moved with their code into product_contracts::action under their exact original names (typed_tokens_reject_empty_oversized_and_control_values, product_action_id_round_trips_display_and_uuid) — no content edited, which is why they do not show as a rename in the diff.
• The one addition is action::tests::action_fingerprint_key_carries_every_dedup_component: ActionFingerprintKey moved into a new module with no direct test of its own, so it got one rather than landing bare.
• Execution: 1977 passed / 0 failed / 0 ignored across 48 test binaries.

Verification

• cargo fmt; cargo clippy -p ironclaw_product_contracts -p ironclaw_product -p ironclaw_extension_host -p ironclaw_reborn_composition -p ironclaw_webui -p ironclaw_architecture --all-targets --all-features -- -D warnings → clean.
• cargo test -p ironclaw_architecture → 130 passed / 0 failed (all 25 gate files, including the new one).
• cargo check --workspace --all-targets --all-features → 0 errors, 0 warnings.
• cargo metadata --locked clean; git status clean after every cargo run; the Cargo.lock delta is the single secrecy line.
• All 10 exact-test selectors in scripts/reborn-e2e-rust.sh executed under bash with < /dev/null; each matched exactly one test.
• critical_mutation_gate.py --selection-only → true, so the full run was executed locally (cargo-mutants 27.1.0, the CI-pinned version). Both selected entries PASS: ironclaw_extension_host/src/channel_outbound_targets.rs (delivery routing registration) 1 caught / 0 survived, and ironclaw_product/src/run_delivery/observer.rs (delivery deduplication) 1 caught / 1 unviable / 0 survived. Neither function body changed — only import paths above them.
• Workspace clippy in the CI Code Style shape (cargo clippy --all --benches --tests --examples --all-features -- -D warnings) → clean, so the lanes I did not lint per-crate are covered too.

Changed-coverage — CI ran it, and every hole is now a test

The move-shaped diff made the gate read relocated bodies as added production lines, exactly as predicted. CI's first run failed it; here is the whole list and what each became. Ten tests, one exemption.

Five relocated port modules had no LCOV record at all (delivery, channel_config, operator_tools, prompt_source, views) — pure declarations emit no source record, so the gate reported them absent. Each now carries a contract test rather than a waiver, pinning what these ports actually owe:

Property	Why it is a contract, not a line-count exercise
object safety (all 7 traits)	every consumer holds them as Arc<dyn _>; a signature change that breaks dyn-safety now fails at the contract, not at the far-away wiring site
argument order and pass-through (reply_context)	extension id / installation id / conversation fingerprint are three bare strings — nothing but this test stops a transposition becoming a silent mis-delivery. This is review's identity-mixup concern, pinned without changing the types
absence without error	an unresolved channel, an empty channel-config field set, an empty tool catalog and a missing approval context are all normal outcomes; a port that could only express them as failures would be wrong
caller scoping	the operator catalog's caller parameter is the #5459 disclosure control. Two callers, one shared tool and one private tool each, asserting both directions of isolation — a double that ignored caller fails the test (verified by mutation). Scope, stated plainly: this pins that the port hands the implementation the caller and that its shape admits a per-caller answer; it cannot pin that the production catalog filters, which is composition's implementation and composition's test
next_cursor omission	serializing null would make every unpaginated view look paginated to the browser

Two genuinely untested fail-closed error paths in extension_host, both on seams this move touched. AccountConnectionStatusSource::connected now proves it fails closed on a pairing-backend outage (activation must not proceed on an unknown connection state) and sanitized — the test asserts the driver, host and port do not appear in the product-facing error. The lifecycle output-serialization mapping moved out of an inline closure into a named lifecycle_output_decode_error so it is reachable from a test: the failure is defensive, but what it maps to is live — the model gets OutputDecode and never the serde error, which can quote projection contents.

A dead branch arm. validate_typed_token guards c == '\0' || c.is_control() and only the second arm ran. NUL has its own arm because an embedded NUL truncates at a C boundary rather than merely looking odd.

Diff shape. The remaining reports were an artifact of relocating types inline: a fully-qualified ironclaw_product_contracts::<mod>::<Item> in a signature turns an untouched line into a changed one. Seventeen files now import the symbol like every other — smaller diff, prevailing style restored, and the lines leave the gate's denominator because a use line is uninstrumentable by construction.

Exemptions: eleven lines, every one a place a test cannot reach. Nine are type positions — a struct field, a function parameter, a struct-literal field's enum path — where deleting ironclaw_product's re-export rewrote the line but LLVM emits no coverage region for it, so it can never be covered. Each entry names the exact construct; all nine were re-read against the source before the entry was written. The tenth is factory/test_support.rs:330, whose two integration callers are cited by file:line — the merged lcov does not attribute them back to the composition bucket build. The eleventh is a tracing::debug! message literal, and it is worth reading the entry: the event body demonstrably does execute — the DEBUG-subscriber test asserts the rendered log contains that exact message and passes — but tracing bakes the message into the callsite's static Metadata, so LLVM attributes the line's region to a static initializer and never counts it. The bucket's own tracefile shows lines 213/214/219/220 at 1 hit each with 217 at 0, which is what distinguishes "artifact" from "dead path". Every tracing::debug! in the workspace has this shape; they only escape the gate because their lines are not in a diff. All eleven are filed under the same #6963 lane-attribution lane as the four WS1 entries.

Verified, not hoped: the gate was replayed locally against CI's own merged lcov (reborn-integration-coverage-merged from run 30689416105) with these entries in place — changed line coverage 100.00% (147/147), changed branch coverage 100.00% (10/10).

What was not exempted is the point. CI's second run left one uncovered line: lifecycle_output_decode_error's tracing::debug! body, which never runs because tracing short-circuits on the null dispatcher with no subscriber installed. That is coverable, so it is covered — the test now installs a DEBUG-level subscriber over a shared writer (the pattern ironclaw_turns/tests/agent_loop_host_contract.rs established) and asserts both halves of the guard: the model gets OutputDecode and never the serde error, and the serde detail is not discarded — it reaches the debug log, which is where an operator diagnoses it. Without the subscriber a test cannot tell "logged it" from "dropped it", which is exactly why a waiver would have been the wrong answer. tracing-subscriber joins extension_host's dev-dependencies for it, with a manifest comment; the Cargo.lock delta is one line and the crate was already in the workspace.

Every one of these was verified red-then-green rather than assumed — each new double was mutated to drop the argument under test and the suite watched to fail. Result: ironclaw_product_contracts 73 → 94 tests, and a per-module llvm-cov replay of the crate-bucket lane's exact invocation shows zero uncovered added production lines across all ten relocated modules.

🤖 Generated with Claude Code

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[railway-app]

🚅 Deployed to the ironclaw-pr-6998 environment in ironclaw-ci-preview

Service	Status	Web	Updated (UTC)
ironclaw	🕒 Building (View Logs)	Web	Aug 1, 2026 at 3:19 pm

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 5084f027-1e54-4f6a-b6dd-8599834cdf27

📥 Commits

Reviewing files that changed from the base of the PR and between ffc4b86 and b36c972.

📒 Files selected for processing (2)

• crates/ironclaw_product_contracts/src/lifecycle_service.rs
• docs/reborn/target-architecture/CHECKLIST.md

---

📝 Walkthrough

Summary by CodeRabbit

• New Features

  • Added shared contracts for account setup, administration, lifecycle services, channel delivery, commands, prompts, operator tools, views, and action identity.
  • Added channel configuration management, caller-scoped operator tools, paginated views, and account connection status handling.

• Bug Fixes

  • Improved protection of detailed lifecycle decoding errors while retaining diagnostic logging.

• Tests

  • Expanded validation for contract behavior, serialization, security, input handling, and architecture boundaries.

Walkthrough

Changes

The PR moves product-side ports and DTOs into ironclaw_product_contracts. It updates product, extension-host, composition, WebUI, tests, documentation, and architecture enforcement. It also adds contract validation and lifecycle error-redaction coverage.

Product contract extraction and migration

Layer / File(s)	Summary
Contract definitions and validation crates/ironclaw_product_contracts/src/*, crates/ironclaw_product_contracts/Cargo.toml	Adds action, account setup, admin user, command, delivery, lifecycle, operator tool, prompt, and view contracts with focused tests.
Product boundary reduction crates/ironclaw_product/src/*	Removes relocated declarations and narrows legacy public re-exports.
Extension-host and composition wiring crates/ironclaw_extension_host/*, crates/ironclaw_reborn_composition/*	Updates implementations, trait objects, field types, and public re-exports to use contract modules.
Consumer and documentation updates crates/ironclaw_webui/*, tests/*, docs/*, crates/AGENTS.md	Updates imports, fixtures, coverage exemptions, architecture records, and crate guidance.
Architecture enforcement crates/ironclaw_architecture/tests/reborn_extension_host_port_inversion.rs	Scans production Rust code and checks contract placement, implementation coverage, parser behavior, and residue shrinkage.
Lifecycle error handling crates/ironclaw_extension_host/src/extension_lifecycle_capabilities.rs, crates/ironclaw_extension_host/Cargo.toml	Maps serialization failures to OutputDecode, logs details at debug level, and tests error redaction.
Pairing status validation crates/ironclaw_extension_host/src/channel_pairing.rs, crates/ironclaw_extension_host/src/channel_pairing/tests.rs	Uses the account-setup status contract and adds fail-closed tests for unavailable installations and unpaired callers.

Estimated code review effort: 4 (Complex) | ~60 minutes

Possibly related issues

• Refactor reborn composition into owned crates with CI-enforced boundaries #4470 — Covers CI-enforced crate ownership and dependency boundaries advanced by this migration.
• Reborn: production/scoped capability lifecycle admin parity #3288 — Covers typed lifecycle and configuration contracts related to this extraction.

Possibly related PRs

• nearai/ironclaw#6980 — Established the product-contract boundary expanded by this PR.
• nearai/ironclaw#6977 — Refactored extension-host consumers toward dedicated contract crates.
• nearai/ironclaw#6889 — Added the changed-coverage framework used by this PR’s coverage exemptions.

Suggested reviewers: ilblackdragon

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title follows Conventional Commits style and clearly describes the port inversion from product to product_contracts.
Description check	✅ Passed	The description provides a detailed summary, scope, rationale, follow-ups, architecture details, and extensive validation evidence for the refactor.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ironloopai]

🔎 Review · PR #6998

🟢 Completed · Review submitted

1 actionable findings →

The contract inversion preserves the moved DTOs, trait signatures, serialization shapes, authority context, secret wrappers, implementations, and consumer wiring across the complete trusted comparison. One non-blocking weakness remains in the new architecture ratchet: its hand-written impl parser can miss valid generic implementations.

_{Automatic · PR opened · attempt 1 of 3 · completed in 2m 39s}

Run details

• Repository: nearai/ironclaw
• Base: main at a50ad06
• Head: ws2/extension-host-ports at f4819bb
• Created: Aug 1, 2026, 5:13 AM UTC
• Updated: Aug 1, 2026, 5:15 AM UTC
• Run: 35395aa6-f3bf-4bf7-9a3d-6a4b99b13d14
• Latest attempt: 1 · Completed · 0cf25d09-6ffa-4436-9ec5-2cfd2fd85b21

[ironloopai]

🔍 Review complete · PR #6998

💬 1 finding

The contract inversion preserves the moved DTOs, trait signatures, serialization shapes, authority context, secret wrappers, implementations, and consumer wiring across the complete trusted comparison. One non-blocking weakness remains in the new architecture ratchet: its hand-written impl parser can miss valid generic implementations.

Findings

1. 🟡 Low · Make the impl scanner handle nested generic bounds — crates/ironclaw_architecture/tests/reborn_extension_host_port_inversion.rs:229-234
   Details are attached to the relevant diff.

Validation and technical details

• Reviewed the complete refs/ironloop/base (a50ad06) to refs/ironloop/head (f4819bb) comparison across all 130 changed files.
• Compared relocated contract definitions directly against their base versions and traced updated consumers in product, extension_host, composition, WebUI, and integration tests.
• git diff --check refs/ironloop/base..refs/ironloop/head completed without errors; the worktree was clean and the checkout merge tree had no delta from the trusted head.
• Attempted targeted tests for product_contracts, product, extension_host, and architecture, but this review environment does not provide cargo (cargo: command not found), so runtime validation was limited to static inspection.
• Base: main
• Head: ws2/extension-host-ports at f4819bb
• Run: 35395aa6-f3bf-4bf7-9a3d-6a4b99b13d14

[ironloopai]

🟡 Low · Make the impl scanner handle nested generic bounds

implemented_trait_names removes the impl's generic parameter list by taking the first >. For valid declarations containing nested generics, such as impl<T: Iterator<Item = X>> NewProductPort for Host<T>, that delimiter closes Iterator, leaving > NewProductPort; the identifier check then rejects it. Consequently, extension_host could introduce a new product-defined trait implementation without tripping the shrink-only gate. Parse balanced angle brackets (or use a Rust syntax parser) and add this shape to the scanner self-test.

[BenKurrek]

Verified and fixed in 0619f2b — the finding is correct.

I reproduced it in the scanner self-test before changing anything: impl<T: Iterator<Item = X>> NestedBound for Host<T> closes the parameter list at Iterator's >, leaves > NestedBound, fails is_rust_identifier, and the impl is dropped — so a new product-defined port could have entered extension_host with the shrink-only gate enforcing nothing for it.

balanced_angle_close now counts nesting rather than taking the first >. One extra case your example does not cover but the same walk hits: a -> return arrow inside a bound (impl<F: Fn(&str) -> bool> ArrowBound for Guard<F>) also puts a > in the list, so a > preceded by - is skipped. Both shapes are in impl_scanner_reads_the_trait_out_of_real_impl_shapes, and it fails without the fix.

Re-verified after widening the scan: the residue is still exactly the six frozen entries, so the wider walk surfaced no previously hidden implementation — the hole was latent, not live.

[coderabbitai]

Actionable comments posted: 12

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/ironclaw_architecture/tests/reborn_extension_host_port_inversion.rs`:
- Around line 132-157: Update rust_files to propagate read_dir failures and
individual directory-entry errors instead of returning or using flatten, and
update traits_implemented_by to propagate file-read errors instead of
continuing. Ensure the surrounding scan/test flow fails loudly on any filesystem
error rather than producing an incomplete result.
- Around line 139-144: Update the path exclusion logic in the inversion scan to
skip test_support directories and fixtures, including test_support.rs and
test_support/lifecycle.rs. Alternatively, extend strip_cfg_test_blocks() to
remove items guarded by #[cfg(feature = "test-support")], ensuring test-only
trait implementations cannot satisfy ports during the scan.
- Around line 163-217: Update implemented_trait_names and strip_cfg_test_blocks
so cfg(test) block detection uses source with comments and string literals
removed before scanning braces. Preserve the existing cfg(test) item removal
behavior, then continue extracting implemented traits from the cleaned result so
braces inside comments or strings cannot retain test-only impl edges.

In `@crates/ironclaw_product_contracts/src/delivery.rs`:
- Around line 25-51: Replace the raw String and &str extension_id and
installation_id values in ResolvedChannelDelivery,
ChannelDeliveryResolver::resolve_channel_delivery, and
DeliveryReplyContextSource::reply_context with distinct domain identifier
newtypes owned by the appropriate contracts module. Update the associated
fields, trait parameters, and implementations/callers to use the matching
newtypes while preserving existing behavior and preventing
extension/installation identity interchangeability.

In `@crates/ironclaw_product_contracts/src/lifecycle_service.rs`:
- Around line 54-67: The default
LifecycleProductService::import_extension_bundle implementation should represent
unsupported capability rather than invalid input. Replace its InvalidRequest/400
construction with ProductSurfaceError::unavailable(false), and add a
caller-level regression covering the absent-wiring path to verify the
unavailable contract is returned.
- Around line 80-85: Update installed_activation_errors and its associated
product port to return HashMap<ExtensionId, String> instead of String-keyed
maps. Propagate the typed ExtensionId key through the host implementation,
lookups, and tests, while retaining activation_error as the String wire/response
value.

In `@crates/ironclaw_product_contracts/src/prompt_source.rs`:
- Around line 25-35: The relocated contracts use raw string identifiers instead
of domain newtypes. In crates/ironclaw_product_contracts/src/prompt_source.rs
lines 25-35, update BlockedAuthPromptRequest::gate_ref to use TurnGateRef; in
crates/ironclaw_product_contracts/src/lifecycle_service.rs lines 80-85, change
the return type to HashMap<ExtensionId, String>, importing or reusing
ExtensionId as needed.

In `@crates/ironclaw_product/CLAUDE.md`:
- Around line 40-49: The hand-written contract inventories must be reconciled
with the authoritative architecture test and source modules. In
crates/ironclaw_product/CLAUDE.md lines 40-49, replace the eleven-port
relocation list and nine-port claim with the shrink-only enumeration from
reborn_extension_host_port_inversion.rs, including the correct treatment of
AdminUserService and RebornOperatorToolCatalog. In
crates/ironclaw_product_contracts/CLAUDE.md lines 19-39, change “sixteen
modules” to match src/lib.rs’s seventeen modules and update the line 120-126
enumeration to include its two missing ports.

In `@crates/ironclaw_product/src/action.rs`:
- Around line 7-11: Move the ProductCommandContext::from_envelope constructor
and envelope-admission coverage into crates/ironclaw_product_contracts, or add
equivalent contract-owned tests there. Cover preservation and validation of
requested_command and the envelope timestamp at this trust boundary; update the
related imports in crates/ironclaw_product/src/action.rs (anchor) and
crates/ironclaw_product/src/command_dispatch.rs (sibling) only as needed, with
no direct change required if the tests are relocated without affecting those
files.

In `@crates/ironclaw_product/src/delivery_coordinator.rs`:
- Around line 39-41: Remove executable ChannelAdapter and RestrictedEgress
handles from the contracts-side ResolvedChannelDelivery; keep that DTO limited
to neutral channel identifiers and move the resolved delivery-handle type or
equivalent resolution into the product crate. Update ChannelDeliveryResolver and
IronclawProductDeliveryCoordinator::drive_prepared() to cross the contracts seam
using identifiers, while retaining product-side adapter delivery and egress
enforcement.

In `@docs/reborn/target-architecture/CHECKLIST.md`:
- Around line 73-77: The checklist’s WS2.1 port-count wording is inconsistent:
it says “plus four more” and “nine ports total” while listing five additional
port entries. Update the paragraph to either use the correct total for
individually named ports or explicitly call them port families and document the
grouping, ensuring the count matches the listed symbols and architecture tests.

In `@docs/reborn/target-architecture/families/contracts.md`:
- Line 148: Update the dependency list in the contracts architecture
documentation to remove ironclaw_common, leaving only ironclaw_host_api and
ironclaw_extension_contracts as permitted dependencies. Check CLAUDE.md and
AGENTS.md for any stale documentation-reference checks, then run mint dev and
mint broken-links from the docs directory.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d49f8167-8840-4ad7-90f5-51a6dd688cbd

📥 Commits

Reviewing files that changed from the base of the PR and between a50ad06 and f4819bb.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock, !**/Cargo.lock

📒 Files selected for processing (129)

• crates/AGENTS.md
• crates/ironclaw_architecture/tests/reborn_extension_host_port_inversion.rs
• crates/ironclaw_extension_host/src/admin_configuration.rs
• crates/ironclaw_extension_host/src/available_extension_import.rs
• crates/ironclaw_extension_host/src/available_extensions.rs
• crates/ironclaw_extension_host/src/channel_command_roles.rs
• crates/ironclaw_extension_host/src/channel_config.rs
• crates/ironclaw_extension_host/src/channel_connection.rs
• crates/ironclaw_extension_host/src/channel_delivery.rs
• crates/ironclaw_extension_host/src/channel_dm_provisioning.rs
• crates/ironclaw_extension_host/src/channel_host.rs
• crates/ironclaw_extension_host/src/channel_host/e2e_auth_challenge.rs
• crates/ironclaw_extension_host/src/channel_host/e2e_tests.rs
• crates/ironclaw_extension_host/src/channel_lifecycle.rs
• crates/ironclaw_extension_host/src/channel_outbound_targets.rs
• crates/ironclaw_extension_host/src/channel_pairing.rs
• crates/ironclaw_extension_host/src/channel_pairing/tests.rs
• crates/ironclaw_extension_host/src/channel_subject_routes.rs
• crates/ironclaw_extension_host/src/extension_credential_requirements.rs
• crates/ironclaw_extension_host/src/extension_ingress.rs
• crates/ironclaw_extension_host/src/extension_lifecycle_capabilities.rs
• crates/ironclaw_extension_host/src/extension_lifecycle_command.rs
• crates/ironclaw_extension_host/src/generic_host.rs
• crates/ironclaw_extension_host/src/hosted_mcp_manifest.rs
• crates/ironclaw_extension_host/src/hosted_mcp_preparation.rs
• crates/ironclaw_extension_host/src/inbound_batches.rs
• crates/ironclaw_extension_host/src/ingress/router.rs
• crates/ironclaw_extension_host/src/install_policy.rs
• crates/ironclaw_extension_host/src/ironhub/model.rs
• crates/ironclaw_extension_host/src/ironhub/service.rs
• crates/ironclaw_extension_host/src/lifecycle.rs
• crates/ironclaw_extension_host/src/lifecycle_product_service.rs
• crates/ironclaw_extension_host/src/lifecycle_restore.rs
• crates/ironclaw_extension_host/src/operator_config_capability.rs
• crates/ironclaw_extension_host/src/product_lifecycle.rs
• crates/ironclaw_extension_host/src/provider_identity.rs
• crates/ironclaw_extension_host/src/run_delivery_ports.rs
• crates/ironclaw_extension_host/src/test_support.rs
• crates/ironclaw_extension_host/src/test_support/lifecycle.rs
• crates/ironclaw_extension_host/src/webui_extension_credentials.rs
• crates/ironclaw_extension_host/tests/ingress_router_contract.rs
• crates/ironclaw_product/CLAUDE.md
• crates/ironclaw_product/src/action.rs
• crates/ironclaw_product/src/auth_continuation.rs
• crates/ironclaw_product/src/auth_prompt.rs
• crates/ironclaw_product/src/command_admission.rs
• crates/ironclaw_product/src/command_dispatch.rs
• crates/ironclaw_product/src/communication_context.rs
• crates/ironclaw_product/src/delivery_coordinator.rs
• crates/ironclaw_product/src/extension_account_setup.rs
• crates/ironclaw_product/src/fakes.rs
• crates/ironclaw_product/src/filesystem_ledger.rs
• crates/ironclaw_product/src/filesystem_ledger/path.rs
• crates/ironclaw_product/src/in_memory_ledger.rs
• crates/ironclaw_product/src/inbound_turn/tests.rs
• crates/ironclaw_product/src/ledger.rs
• crates/ironclaw_product/src/lib.rs
• crates/ironclaw_product/src/lifecycle.rs
• crates/ironclaw_product/src/policy.rs
• crates/ironclaw_product/src/projection/turn_events.rs
• crates/ironclaw_product/src/reborn_services.rs
• crates/ironclaw_product/src/reborn_services/admin_configuration.rs
• crates/ironclaw_product/src/reborn_services/admin_users.rs
• crates/ironclaw_product/src/reborn_services/extensions.rs
• crates/ironclaw_product/src/reborn_services/lifecycle_setup.rs
• crates/ironclaw_product/src/reborn_services/llm_config.rs
• crates/ironclaw_product/src/reborn_services/log_views.rs
• crates/ironclaw_product/src/reborn_services/operator_command_views.rs
• crates/ironclaw_product/src/reborn_services/operator_config_views.rs
• crates/ironclaw_product/src/reborn_services/outbound_delivery_capability_surface.rs
• crates/ironclaw_product/src/reborn_services/outbound_views.rs
• crates/ironclaw_product/src/reborn_services/run_artifact.rs
• crates/ironclaw_product/src/reborn_services/thread_artifact.rs
• crates/ironclaw_product/src/reborn_services/trace_credits.rs
• crates/ironclaw_product/src/reborn_services/views.rs
• crates/ironclaw_product/src/run_delivery.rs
• crates/ironclaw_product/src/run_delivery/observer.rs
• crates/ironclaw_product/src/run_delivery/triggered.rs
• crates/ironclaw_product/src/workflow.rs
• crates/ironclaw_product/tests/durable_ledger_support/mod.rs
• crates/ironclaw_product/tests/durable_scoped_ledger_contract.rs
• crates/ironclaw_product/tests/extension_account_setup_contract.rs
• crates/ironclaw_product/tests/outbound_delivery_contract.rs
• crates/ironclaw_product/tests/product_command_surface_contract.rs
• crates/ironclaw_product/tests/product_surface_contract.rs
• crates/ironclaw_product/tests/prompt_projection_contract.rs
• crates/ironclaw_product/tests/reborn_services_contract.rs
• crates/ironclaw_product/tests/run_delivery_contract.rs
• crates/ironclaw_product_contracts/CLAUDE.md
• crates/ironclaw_product_contracts/Cargo.toml
• crates/ironclaw_product_contracts/src/account_setup.rs
• crates/ironclaw_product_contracts/src/action.rs
• crates/ironclaw_product_contracts/src/admin_users.rs
• crates/ironclaw_product_contracts/src/channel_config.rs
• crates/ironclaw_product_contracts/src/command.rs
• crates/ironclaw_product_contracts/src/delivery.rs
• crates/ironclaw_product_contracts/src/lib.rs
• crates/ironclaw_product_contracts/src/lifecycle_service.rs
• crates/ironclaw_product_contracts/src/operator_tools.rs
• crates/ironclaw_product_contracts/src/prompt_source.rs
• crates/ironclaw_product_contracts/src/views.rs
• crates/ironclaw_reborn_composition/src/admin_token.rs
• crates/ironclaw_reborn_composition/src/admin_user_directory.rs
• crates/ironclaw_reborn_composition/src/deployment.rs
• crates/ironclaw_reborn_composition/src/extension_host_assembly.rs
• crates/ironclaw_reborn_composition/src/factory.rs
• crates/ironclaw_reborn_composition/src/factory/production_backend_assembly.rs
• crates/ironclaw_reborn_composition/src/factory/production_build_assembly.rs
• crates/ironclaw_reborn_composition/src/factory/test_support.rs
• crates/ironclaw_reborn_composition/src/factory/tests.rs
• crates/ironclaw_reborn_composition/src/input.rs
• crates/ironclaw_reborn_composition/src/lib.rs
• crates/ironclaw_reborn_composition/src/operator_tool_catalog.rs
• crates/ironclaw_reborn_composition/src/product_surface/tests.rs
• crates/ironclaw_reborn_composition/src/runtime.rs
• crates/ironclaw_reborn_composition/src/runtime/tests/core.rs
• crates/ironclaw_reborn_composition/tests/production_runtime_automations.rs
• crates/ironclaw_reborn_composition/tests/webui_v2_serve.rs
• crates/ironclaw_webui/src/webui_v2/handlers.rs
• crates/ironclaw_webui/tests/support/product_surface.rs
• crates/ironclaw_webui/tests/webui_v2_handlers_contract.rs
• docs/plans/composition-pubuse.snapshot
• docs/reborn/target-architecture/CHECKLIST.md
• docs/reborn/target-architecture/families/contracts.md
• tests/e2e/scenarios/test_admin_api.py
• tests/integration/extension_delivery.rs
• tests/integration/hosted_mcp_registration.rs
• tests/integration/support/product_surface.rs
• tests/integration/webui_v2_product_api.rs

[coderabbitai]

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Was this default body carried over verbatim, and what does the taxonomy offer?
rg -n -B4 -A12 'fn import_extension_bundle' crates/ --glob '*.rs'
rg -n 'Unavailable' crates/ironclaw_product_contracts/src/surface.rs | head -20

Repository: nearai/ironclaw

Length of output: 5643

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== lifecycle_service.rs =="
sed -n '1,90p' crates/ironclaw_product_contracts/src/lifecycle_service.rs

echo "== surface.rs relevant product surface error code definitions =="
sed -n '240,445p' crates/ironclaw_product_contracts/src/surface.rs

echo "== error construction helper usages around InvalidRequest/Unavailable =="
rg -n -B3 -A6 'ProductSurfaceError::from_status|ProductSurfaceErrorCode::InvalidRequest|ProductSurfaceErrorCode::Unavailable' crates/ironclaw_product/src crates/ironclaw_product_contracts/src --glob '*.rs' | head -120

echo "== product surface impl in ironclaw_product =="
rg -n -B8 -A12 'unavailable default|Unimplemented|ImportExtension|import_extension_bundle' crates/ironclaw_product/src crates/ironclaw_product/tests/reborn_services_contract.rs --glob '*.rs'

echo "== implementation of extension management result mapping =="
sed -n '458,490p' crates/ironclaw_extension_host/src/lifecycle_product_service.rs
rg -n -B20 -A40 'fn lifecycle_product_surface_error|ProductSurfaceFailure::InvalidBindingRequest|ServiceUnavailable' crates/ironclaw_product/src --glob '*.rs' | head -180

Repository: nearai/ironclaw

Length of output: 41481

---

Make the default bundle import response match “unavailable”.

LifecycleProductService::import_extension_bundle says the default is unavailable, but it returns ProductSurfaceErrorCode::InvalidRequest/400. That violates the product error contract mapping: 400 is used for malformed bindings, not omitted capability support. Change this method to return ProductSurfaceError::unavailable(false) and add a caller-level regression for the absent-wiring path.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/ironclaw_product_contracts/src/lifecycle_service.rs` around lines 54 -
67, The default LifecycleProductService::import_extension_bundle implementation
should represent unsupported capability rather than invalid input. Replace its
InvalidRequest/400 construction with ProductSurfaceError::unavailable(false),
and add a caller-level regression covering the absent-wiring path to verify the
unavailable contract is returned.

[BenKurrek]

Confirmed as a real defect, recorded rather than fixed here (f60f896).

Both the wording and the InvalidRequest/400 body arrived verbatim from ironclaw_product::lifecycle — the move did not introduce the mismatch and does not get to resolve it, because changing the code changes an HTTP status on a live WebUI route ("Install Tool"). What I did instead: the doc comment now describes what the code actually does, names the discrepancy and why 400 is the wrong meaning (an unwired capability is not the caller's fault), and points at the test; the test carries a comment saying it pins today's behavior, not the desired one, with the invariant that survives either way — a service without bundle support must refuse, never succeed. So the flip cannot happen silently and the next person to touch it has the whole argument in front of them.

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== lifecycle service outline =="
ast-grep outline crates/ironclaw_product_contracts/src/lifecycle_service.rs --items all

echo "== relevant implementation and tests =="
rg -n -B6 -A22 'import_extension_bundle|today.s behavior|unwired capability|InvalidRequest|unavailable' \
  crates/ironclaw_product_contracts/src/lifecycle_service.rs \
  crates/ironclaw_product/tests \
  crates/ironclaw_reborn_composition \
  --glob '*.rs' || true

echo "== follow-up references in the changed documentation and source =="
rg -n -i -C2 'bundle import|install tool|unwired capability|invalid request|unavailable' \
  crates/ironclaw_product_contracts \
  crates/ironclaw_product \
  docs \
  --glob '*.rs' --glob '*.md' | head -240

Length of output: 201237

---

@BenKurrek, verified.

crates/ironclaw_product_contracts/src/lifecycle_service.rs now documents the mismatch at Lines 54-63. The test at Lines 176-180 pins the current InvalidRequest result and verifies that the default refuses the operation.

The behavior remains InvalidRequest/400. ProductSurfaceError::unavailable(false) remains Unavailable/503 in crates/ironclaw_product_contracts/src/surface.rs Lines 373-380.

The added test is a contract-level test. It is not the caller-level WebUI absent-wiring test from the original request. That is acceptable for this move-only PR, but the follow-up must change the error contract and test the “Install Tool” route.

The finding remains open. I will not create a follow-up issue unless you explicitly request it.

_{You are interacting with an AI system.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/ironclaw_product_contracts/src/lifecycle_service.rs`:
- Around line 170-177: Change the lifecycle service contract so
installed_activation_errors returns HashMap<ExtensionId, String> instead of
HashMap<String, String>, updating the trait and
ExtensionHostLifecycleProductService implementation plus any affected callers,
imports, and tests. Preserve the existing empty/default behavior while using
ExtensionId as the map key throughout.
- Around line 161-168: Update the default import_extension_bundle implementation
to return ProductSurfaceError::unavailable(false) when bundle import is
unsupported, and change
bundle_import_defaults_to_an_invalid_request_rather_than_silently_succeeding to
expect ProductSurfaceErrorCode::Unavailable. Also update
ExtensionHostLifecycleProductService::import_extension_bundle so its
absent-extension-management branch returns the same unavailable error instead of
InvalidBindingRequest.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 67d48a27-1176-42d1-8324-05a9be4503cf

📥 Commits

Reviewing files that changed from the base of the PR and between f4819bb and 0619f2b.

📒 Files selected for processing (6)

• crates/ironclaw_architecture/tests/reborn_extension_host_port_inversion.rs
• crates/ironclaw_product_contracts/src/account_setup.rs
• crates/ironclaw_product_contracts/src/action.rs
• crates/ironclaw_product_contracts/src/admin_users.rs
• crates/ironclaw_product_contracts/src/command.rs
• crates/ironclaw_product_contracts/src/lifecycle_service.rs

[coderabbitai]

📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win

installed_activation_errors still keys the map with String, not ExtensionId.

A prior review on this same file (lines 80-85) flagged that installed_activation_errors returns HashMap<String, String> while the doc comment says it is "keyed by extension id" — the port should return HashMap<ExtensionId, String> instead. That comment has no "Addressed" reply.

The downstream implementor ExtensionHostLifecycleProductService::installed_activation_errors (crates/ironclaw_extension_host/src/lifecycle_product_service.rs) still returns Result<std::collections::HashMap<String, String>, ProductSurfaceError>, confirming the signature is unchanged. This new test only checks is_empty(), so it does not lock in the wrong type, but the underlying contract still needs the typed key fixed to comply with the repository's strong-typing rule for domain identifiers.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/ironclaw_product_contracts/src/lifecycle_service.rs` around lines 170
- 177, Change the lifecycle service contract so installed_activation_errors
returns HashMap<ExtensionId, String> instead of HashMap<String, String>,
updating the trait and ExtensionHostLifecycleProductService implementation plus
any affected callers, imports, and tests. Preserve the existing empty/default
behavior while using ExtensionId as the map key throughout.

[BenKurrek]

Correct on the facts, and the disposition is unchanged from the sibling thread — but it now has a named owner instead of a PR-body sentence. a6ee90c.

Verified. LifecycleProductService::installed_activation_errors returns HashMap<String, String> while its own doc says "keyed by extension id", and ExtensionHostLifecycleProductService::installed_activation_errors (crates/ironclaw_extension_host/src/lifecycle_product_service.rs:492-503) still returns the same. Your read that the new test does not lock the wrong type in — it asserts is_empty() only — is also right.

Why not here. Same reason as the sibling: this signature is on origin/main unchanged (crates/ironclaw_product/src/lifecycle.rs:87-91), and WS2.1 relocated it verbatim. Retyping the key changes the contract for every implementor and every caller of the map, which is a semantic change in a move PR.

What changed. The follow-up now sits on a CHECKLIST WS2 row rather than in prose, with the observation that makes it cheap when it lands:

product_contracts::lifecycle_service::LifecycleProductService::installed_activation_errors → HashMap<ExtensionId, String>. The doc says "keyed by extension id"; ExtensionHostLifecycleProductService already holds typed ExtensionId and stringifies only to satisfy the signature.

and the method's doc comment now carries a ✎ note saying the same thing and pointing at the row, so the next reader of the port sees the debt without leaving the file. It is grouped with the other three stringly-typed signatures (BlockedAuthPromptRequest.gate_ref, ResolvedChannelDelivery.{extension_id,installation_id}) because they all re-open for their implementors in the same slice.

Verification as on the sibling thread: 225 tests passed / 0 failed across ironclaw_architecture + ironclaw_product_contracts, fmt and clippy clean.

[coderabbitai]

@BenKurrek, acknowledged. The finding remains valid, but the deferment is appropriate for this move-only extraction.

The CHECKLIST row and in-file note provide a concrete owner and migration target. This preserves the WS2.1 scope while recording the required HashMap<ExtensionId, String> contract change.

Would you like me to open a GitHub follow-up issue for the grouped typed-signature migration?

---

✏️ Learnings added

Learnt from: BenKurrek
Repo: nearai/ironclaw PR: 6998
File: crates/ironclaw_product_contracts/src/lifecycle_service.rs:192-199
Timestamp: 2026-08-01T14:20:17.234Z
Learning: For move-only WS2.1 contract extraction in nearai/ironclaw PR `#6998`, defer the semantic migration of `ironclaw_product_contracts::lifecycle_service::LifecycleProductService::installed_activation_errors` from `HashMap<String, String>` to `HashMap<ExtensionId, String>` to a named follow-up. The signature was relocated unchanged from `origin/main`; the migration must update implementors and callers together. `ExtensionHostLifecycleProductService` already has typed `ExtensionId` values and stringifies them only because of the current contract.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

---

🧠 Learnings used

Learnt from: henrypark133
Repo: nearai/ironclaw PR: 4953
File: crates/ironclaw_reborn_composition/src/slack_delivery.rs:2520-2520
Timestamp: 2026-06-17T04:13:18.772Z
Learning: When suppressing Clippy with `#[allow(clippy::too_many_arguments)]`, require an “architecture exemption” comment immediately above the attribute that explains why the many-arguments signature is justified (e.g., what bundled concepts the function needs) and provides a concrete rationale for the exemption. Avoid silent `#[allow(...)]` for this lint.

---

Learnt from: BenKurrek
Repo: nearai/ironclaw PR: 6873
File: docs/superpowers/plans/2026-07-29-pr1-role-gated-command-admission.md:621-624
Timestamp: 2026-07-29T18:55:20.993Z
Learning: When reviewing Rust changes in the IronClaw repo, follow the documented two-lane Clippy feature-matrix checks from `.claude/rules/review-discipline.md`: run Clippy with the default feature set first (i.e., *without* `--all-features`), because an all-features-only build can hide feature-gated dead code. Then run a second Clippy lane with `--all-features` to exercise all feature combinations. Use `cargo clippy --workspace --all-targets ... -D warnings` for each lane as appropriate; treat a single workspace-wide `cargo clippy --workspace --all-targets --all-features -- -D warnings` run as supplemental coverage, not a replacement for the required default-feature lane + `--all-features` lane.

---

Learnt from: BenKurrek
Repo: nearai/ironclaw PR: 6364
File: crates/ironclaw_product_adapters/src/lib.rs:0-0
Timestamp: 2026-07-29T20:58:08.708Z
Learning: When reviewing Rust code, ensure consumers import `WorkspaceFile` directly from `ironclaw_host_api` (i.e., `ironclaw_host_api::WorkspaceFile`). `WorkspaceFile` is owned by `ironclaw_host_api::attachment` and is re-exported from `ironclaw_host_api`; do not introduce or rely on imports from the retired `ironclaw_product_adapters` crate (and do not treat it as an active consumer or re-export facade). Verify that no `use ...::WorkspaceFile` (or similar) references `ironclaw_product_adapters`, and that any `pub use`/facade changes don’t reintroduce that dependency.

---

Learnt from: BenKurrek
Repo: nearai/ironclaw PR: 6967
File: crates/ironclaw_product/src/approval_interaction/gate_ref.rs:0-0
Timestamp: 2026-07-31T18:47:58.224Z
Learning: For canonical contract migrations in Rust code under crates/, update imports on lines already modified by the PR to reference the canonical contract owner (for example, `ironclaw_host_api::turn`). Do not change untouched consumer import lines solely as part of the migration; defer those updates to separate consumer migration PRs to keep scope focused.

---

Learnt from: BenKurrek
Repo: nearai/ironclaw PR: 6967
File: tools/ironclaw_stress/src/user_turn.rs:1680-1680
Timestamp: 2026-07-31T18:48:30.383Z
Learning: In Rust code using the turn vocabulary, validate `ironclaw_host_api::turn::TurnGateRef` only for non-empty content, maximum length, and absence of control characters; it does not require a prefix. Apply the `gate:` prefix requirement only to the separate `LoopGateRef` reference family. Do not apply `LoopGateRef` validation rules to `TurnGateRef` usages, including `tools/ironclaw_stress/src/user_turn.rs`.

---

Learnt from: BenKurrek
Repo: nearai/ironclaw PR: 6998
File: crates/ironclaw_product_contracts/src/prompt_source.rs:25-35
Timestamp: 2026-08-01T05:36:38.623Z
Learning: For explicitly move-only contract-extraction PRs in the ironclaw_product_contracts crate, preserve existing public Rust signatures. Do not require semantic type improvements in the same PR when they would require coordinated caller migrations across crates. Record any deferred signature changes as a named follow-up that reopens the affected contracts.

---

Learnt from: BenKurrek
Repo: nearai/ironclaw PR: 6998
File: crates/ironclaw_product/src/delivery_coordinator.rs:39-41
Timestamp: 2026-08-01T05:37:19.485Z
Learning: In the Rust Reborn architecture, `ironclaw_product_contracts` may reference `ironclaw_extension_contracts::channel_adapter::ChannelAdapter` and `ironclaw_extension_contracts::tool_adapter::RestrictedEgress` in contract DTOs such as `delivery::ResolvedChannelDelivery`, following the explicit §6.1.3 one-way dependency for channel-facing contract reuse. Do not implement these ports or delivery execution in the contracts crate. Keep `ChannelAdapter::deliver` implemented in `crates/ironclaw_product/src/delivery_coordinator.rs`.

_{You are interacting with an AI system.}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

crates/ironclaw_product_contracts/CLAUDE.md (1)

120-148: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Update the architecture-test inventory.

This section introduces reborn_extension_host_port_inversion.rs as an enforcement test for the nine inversions and six-entry residue. The earlier section still states that only three architecture tests hold the line and does not list this test.

Update the count and list, or explicitly scope the earlier statement to the three listed tests. As per coding guidelines, documentation promising guarantees must match code and tests.

Proposed documentation fix

-Three architecture tests hold the line, all runnable with
+Four architecture tests hold the line, all runnable with
...
+- `reborn_extension_host_port_inversion.rs` — the extension-host port-inversion rule and shrink-only residue.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/ironclaw_product_contracts/CLAUDE.md` around lines 120 - 148, Update
the earlier architecture-test documentation to include
reborn_extension_host_port_inversion.rs and revise its count, or explicitly
scope the existing “three architecture tests” statement to only the three tests
it lists. Keep the documentation consistent with the enforcement tests described
in this section.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@crates/ironclaw_product_contracts/CLAUDE.md`:
- Around line 120-148: Update the earlier architecture-test documentation to
include reborn_extension_host_port_inversion.rs and revise its count, or
explicitly scope the existing “three architecture tests” statement to only the
three tests it lists. Keep the documentation consistent with the enforcement
tests described in this section.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 4f34b45b-9144-4d01-86e7-97240d985722

📥 Commits

Reviewing files that changed from the base of the PR and between f60f896 and a4ce832.

📒 Files selected for processing (1)

• crates/ironclaw_product_contracts/CLAUDE.md

[github-actions]

Coverage ratchet

Ratchet mode: ENFORCING

RATCHET PASS: global
  observed: 85.94% (323818 / 376802 lines)
  floor:    85.11% (tolerance 0.5pp -> effective floor 84.61%)
  denominator: 376802 lines now vs 375097 at floor capture (+1705 lines, +0.45%) — not a material change

RATCHET PASS: ironclaw_runner
  observed: 85.93% (14917 / 17359 lines)
  floor:    85.55% (tolerance 0.5pp -> effective floor 85.05%)
  floor_covered_lines: 14658 (tolerance 20 lines -> effective floor 14638)
  denominator: 17359 lines now vs 17133 at floor capture (+226 lines, +1.32%) — not a material change

RATCHET PASS: ironclaw_processes
  observed: 88.76% (5889 / 6635 lines)
  floor:    88.07% (tolerance 0.5pp -> effective floor 87.57%)
  floor_covered_lines: 5839 (tolerance 20 lines -> effective floor 5819)
  denominator: 6635 lines now vs 6630 at floor capture (+5 lines, +0.08%) — not a material change

RATCHET PASS: ironclaw_turns
  observed: 88.46% (3709 / 4193 lines)
  floor:    85.11% (tolerance 0.5pp -> effective floor 84.61%)

RATCHET PASS: ironclaw_authorization
  observed: 86.59% (723 / 835 lines)
  floor:    62.51% (tolerance 0.5pp -> effective floor 62.01%)
  floor_covered_lines: 612 (tolerance 20 lines -> effective floor 592)
  denominator: 835 lines now vs 979 at floor capture (-144 lines, -14.71%) — material change (>5%)

RATCHET PASS: ironclaw_approvals
  observed: 91.05% (1820 / 1999 lines)
  floor:    85.86% (tolerance 0.5pp -> effective floor 85.36%)
  floor_covered_lines: 1822 (tolerance 20 lines -> effective floor 1802)
  denominator: 1999 lines now vs 2122 at floor capture (-123 lines, -5.8%) — material change (>5%)

RATCHET PASS: ironclaw_secrets
  observed: 85.81% (2896 / 3375 lines)
  floor:    84.01% (tolerance 0.5pp -> effective floor 83.51%)
  floor_covered_lines: 2795 (tolerance 20 lines -> effective floor 2775)
  denominator: 3375 lines now vs 3327 at floor capture (+48 lines, +1.44%) — not a material change

RATCHET PASS: ironclaw_filesystem
  observed: 76.83% (5895 / 7673 lines)
  floor:    75.93% (tolerance 0.5pp -> effective floor 75.43%)
  floor_covered_lines: 5826 (tolerance 20 lines -> effective floor 5806)
  denominator: 7673 lines now vs 7673 at floor capture (+0 lines, +0%) — not a material change

RATCHET PASS: ironclaw_llm
  observed: 79.22% (20885 / 26364 lines)
  floor:    79.22% (tolerance 0.5pp -> effective floor 78.72%)
  floor_covered_lines: 20885 (tolerance 20 lines -> effective floor 20865)
  denominator: 26364 lines now vs 26364 at floor capture (+0 lines, +0%) — not a material change

RATCHET PASS: ironclaw_triggers
  observed: 94.68% (3134 / 3310 lines)
  floor:    86.04% (tolerance 0.5pp -> effective floor 85.54%)
  floor_covered_lines: 2804 (tolerance 20 lines -> effective floor 2784)
  denominator: 3310 lines now vs 3259 at floor capture (+51 lines, +1.56%) — not a material change

RATCHET PASS: ironclaw_product
  observed: 87.37% (22715 / 26000 lines)
  floor:    86.94% (tolerance 0.5pp -> effective floor 86.44%)
  floor_covered_lines: 21367 (tolerance 20 lines -> effective floor 21347)
  denominator: 26000 lines now vs 24576 at floor capture (+1424 lines, +5.79%) — material change (>5%)

RATCHET PASS: ironclaw_outbound
  observed: 94.68% (4271 / 4511 lines)
  floor:    93.49% (tolerance 0.5pp -> effective floor 92.99%)
  floor_covered_lines: 4105 (tolerance 20 lines -> effective floor 4085)
  denominator: 4511 lines now vs 4391 at floor capture (+120 lines, +2.73%) — not a material change

RATCHET PASS: ironclaw_extension_host
  observed: 85.03% (24382 / 28673 lines)
  floor:    83.82% (tolerance 0.5pp -> effective floor 83.32%)
  floor_covered_lines: 22271 (tolerance 20 lines -> effective floor 22251)
  denominator: 28673 lines now vs 26569 at floor capture (+2104 lines, +7.92%) — material change (>5%)

RATCHET PASS: ironclaw_events
  observed: 80.55% (1197 / 1486 lines)
  floor:    80.55% (tolerance 0.5pp -> effective floor 80.05%)
  floor_covered_lines: 1197 (tolerance 20 lines -> effective floor 1177)
  denominator: 1486 lines now vs 1486 at floor capture (+0 lines, +0%) — not a material change

RATCHET PASS: ironclaw_safety
  observed: 92.75% (4468 / 4817 lines)
  floor:    92.44% (tolerance 0.5pp -> effective floor 91.94%)
  floor_covered_lines: 3973 (tolerance 20 lines -> effective floor 3953)
  denominator: 4817 lines now vs 4298 at floor capture (+519 lines, +12.08%) — material change (>5%)

RATCHET PASS: ironclaw_host_runtime
  observed: 88.41% (21338 / 24135 lines)
  floor:    88.23% (tolerance 0.5pp -> effective floor 87.73%)
  floor_covered_lines: 20538 (tolerance 20 lines -> effective floor 20518)
  denominator: 24135 lines now vs 23277 at floor capture (+858 lines, +3.69%) — not a material change

Reborn integration-tier coverage

Line coverage (Reborn crates): 85.94% — 323818 / 376802 lines

Per-crate breakdown (63 crates, lowest-covered first)

Crate	Line %	Covered / Total
ironclaw_host_ingress	42.5%	17 / 40
ironclaw_memory	53.48%	630 / 1178
ironclaw_projects	72.36%	233 / 322
ironclaw_capabilities	74.59%	2876 / 3856
ironclaw_trust	75.79%	748 / 987
ironclaw_extractors	75.88%	538 / 709
ironclaw_reborn_cli	76.1%	11084 / 14566
ironclaw_observability	76.19%	32 / 42
ironclaw_filesystem	76.83%	5895 / 7673
ironclaw_wasm	78.84%	704 / 893
ironclaw_llm	79.22%	20885 / 26364
ironclaw_events	80.55%	1197 / 1486
ironclaw_loop_contracts	82.4%	5637 / 6841
ironclaw_first_party_extensions	82.57%	6784 / 8216
ironclaw_product_contracts	82.84%	2573 / 3106
ironclaw_memory_native	82.85%	2850 / 3440
ironclaw_libsql_runtime	83.3%	384 / 461
ironclaw_auth	83.95%	6699 / 7980
ironclaw_operator	84.47%	5309 / 6285
ironclaw_hooks	84.57%	9896 / 11702
ironclaw_event_projections	84.81%	854 / 1007
ironclaw_reborn_event_store	84.93%	1206 / 1420
ironclaw_extension_host	85.03%	24382 / 28673
ironclaw_reborn_config	85.29%	2110 / 2474
ironclaw_network	85.31%	894 / 1048
ironclaw_reborn_composition	85.51%	21791 / 25483
ironclaw_extension_contracts	85.64%	2546 / 2973
ironclaw_secrets	85.81%	2896 / 3375
ironclaw_runner	85.93%	14917 / 17359
ironclaw_host_api	86.05%	6367 / 7399
ironclaw_authorization	86.59%	723 / 835
ironclaw_webui	86.95%	11937 / 13729
ironclaw_wasm_limiter	87.06%	74 / 85
ironclaw_common	87.07%	1152 / 1323
ironclaw_product	87.37%	22715 / 26000
ironclaw_reborn_traces	87.61%	11720 / 13377
ironclaw_scripts	87.87%	420 / 478
ironclaw_threads	88.14%	5189 / 5887
ironclaw_host_runtime	88.41%	21338 / 24135
ironclaw_turns	88.46%	3709 / 4193
ironclaw_telegram_extension	88.55%	588 / 664
ironclaw_skills	88.61%	2785 / 3143
ironclaw_process_sandbox	88.64%	281 / 317
ironclaw_processes	88.76%	5889 / 6635
ironclaw_reborn_openai_compat	89.4%	3644 / 4076
ironclaw_telegram_v2_adapter	89.47%	1580 / 1766
ironclaw_extensions	89.55%	6249 / 6978
ironclaw_loop_host	90.47%	18043 / 19944
ironclaw_resources	90.76%	4084 / 4500
ironclaw_approvals	91.05%	1820 / 1999
ironclaw_reborn_identity	91.3%	451 / 494
ironclaw_mcp	92%	1426 / 1550
ironclaw_conversations	92.08%	2383 / 2588
ironclaw_event_streams	92.5%	1048 / 1133
ironclaw_safety	92.75%	4468 / 4817
ironclaw_agent_loop	93.52%	10430 / 11153
ironclaw_slack_extension	93.95%	3697 / 3935
ironclaw_first_party_extension_ports	94.66%	3758 / 3970
ironclaw_outbound	94.68%	4271 / 4511
ironclaw_triggers	94.68%	3134 / 3310
ironclaw_prompt_envelope	97.46%	192 / 197
ironclaw_runtime_policy	97.6%	855 / 876
ironclaw_attachments	98.23%	831 / 846

This table itself is informational and never gates the PR on its own — not the percentage, not the per-crate holes, not the 0-coverage callout. A separate coverage ratchet (dry-run until enforce=true; see tests/integration/coverage-floor.toml) can fail the build on specific configured floors.

Exemptions (18 entry/entries excluded from the accounting above)

Module / Crate	Reason	Issue
crate: ironclaw_gateway	v1-only: consumed only by root ironclaw (src/channels/web/platform/static_files.rs, src/channels/web/handlers/frontend.rs); no crates/* dependents. Covered by "Tests (Legacy)".	#5657
crate: ironclaw_tui	v1-only: consumed only by root ironclaw (src/main.rs, src/channels/tui.rs); no crates/* dependents. Crate's own doc comment confirms it bridges INTO v1, not Reborn. Covered by "Tests (Legacy)".	#5657
crates/ironclaw_attachments/src/lib.rs	Declarative crate facade: module declarations, constants, and re-exports only; executable attachment modules remain covered.	#6524
crates/ironclaw_extension_host/src/ingress/mod.rs	Declarative ingress module facade and documentation only; executable router modules remain covered.	#6524
crates/ironclaw_host_api/src/lib.rs	Declarative crate facade: module declarations and re-exports only; executable host API modules remain covered.	#6524
crates/ironclaw_host_api/src/product_adapter/mod.rs	Declarative product-adapter facade: module declarations and re-exports only; executable adapter modules remain covered.	#6524
crates/ironclaw_llm/src/rig_adapter/tests/finish_reason_tests.rs	Test-only module stored under src/ for private adapter access; cargo-llvm-cov omits test harness source from production LCOV while the exercised rig_adapter.rs production lines remain coverage-gated.	#6284
crates/ironclaw_loop_contracts/src/lib.rs	Declaration-only public facade with no executable Rust statements; rustc emits no LCOV source record. Executable loop-contract behavior remains covered in the owned implementation modules.	#6524
crates/ironclaw_outbound/src/error.rs	Declarative error vocabulary only; variants have no LLVM-instrumentable production statements.	#6524
crates/ironclaw_outbound/src/lib.rs	Declarative crate facade: module declarations and re-exports only; executable outbound modules remain covered.	#6524
crates/ironclaw_product/src/lib.rs	Declaration-only public facade with no executable Rust statements; rustc emits no LCOV source record. Executable product behavior remains covered in the owned implementation modules.	#6524
crates/ironclaw_product/src/lib.rs	Declarative crate facade: module declarations and re-exports only; executable product modules remain covered.	#6524
crates/ironclaw_product/src/scoped_fs/mod.rs	Declarative scoped-filesystem facade and documentation only; executable scoped filesystem modules remain covered.	#6524
crates/ironclaw_reborn_composition/src/support/fs/mod.rs	Declarative composition support facade: module declarations and re-exports only; executable filesystem adapters remain covered.	#6524
crates/ironclaw_slack_extension/src/lib.rs	Declarative Slack crate facade: module declarations and re-exports only; executable Slack modules remain covered.	#6524
crates/ironclaw_telegram_extension/src/lib.rs	Declarative Telegram crate facade: module declarations and re-exports only; executable Telegram modules remain covered.	#6524
crates/ironclaw_threads/src/lib.rs	Declaration-only public facade with no executable Rust statements; rustc emits no LCOV source record. Executable thread behavior remains covered in the owned implementation modules.	#6524
crates/ironclaw_webui/src/webui_v2/mod.rs	Declaration-only WebUI v2 facade with no executable Rust statements; rustc emits no LCOV source record. Executable route behavior remains covered in the owned implementation modules.	#6524

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/ironclaw_product_contracts/src/operator_tools.rs`:
- Around line 59-68: Extend the test around
`the_catalog_is_caller_scoped_and_may_legitimately_be_empty` with an
implementation-backed catalog containing one tenant-shared tool and distinct
private tools for two callers. Invoke `list_operator_tools` for both `UserId`
values and assert each result includes the shared tool and only that caller’s
private tool, verifying private installations are isolated through the real
catalog implementation rather than `EmptyCatalog`.

In `@crates/ironclaw_product_contracts/src/views.rs`:
- Around line 77-85: Update OneRowView::query to use the caller and parameters
instead of ignoring them, returning both alongside the echoed cursor in the test
payload. Extend the corresponding test assertions to verify caller identity and
parameters in addition to cursor behavior, covering both referenced query paths.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 6a2cb5c3-f19d-43f5-a312-c9c501589d3c

📥 Commits

Reviewing files that changed from the base of the PR and between a4ce832 and 5144422.

📒 Files selected for processing (25)

• crates/ironclaw_extension_host/src/channel_host.rs
• crates/ironclaw_extension_host/src/channel_pairing/tests.rs
• crates/ironclaw_extension_host/src/extension_lifecycle_capabilities.rs
• crates/ironclaw_extension_host/src/extension_lifecycle_command.rs
• crates/ironclaw_extension_host/src/hosted_mcp_preparation.rs
• crates/ironclaw_extension_host/src/run_delivery_ports.rs
• crates/ironclaw_extension_host/src/test_support/lifecycle.rs
• crates/ironclaw_product_contracts/src/action.rs
• crates/ironclaw_product_contracts/src/channel_config.rs
• crates/ironclaw_product_contracts/src/delivery.rs
• crates/ironclaw_product_contracts/src/operator_tools.rs
• crates/ironclaw_product_contracts/src/prompt_source.rs
• crates/ironclaw_product_contracts/src/views.rs
• crates/ironclaw_reborn_composition/src/deployment.rs
• crates/ironclaw_reborn_composition/src/extension_host_assembly.rs
• crates/ironclaw_reborn_composition/src/factory.rs
• crates/ironclaw_reborn_composition/src/factory/production_backend_assembly.rs
• crates/ironclaw_reborn_composition/src/factory/production_build_assembly.rs
• crates/ironclaw_reborn_composition/src/factory/test_support.rs
• crates/ironclaw_reborn_composition/src/factory/tests.rs
• crates/ironclaw_reborn_composition/src/input.rs
• crates/ironclaw_reborn_composition/src/runtime.rs
• crates/ironclaw_reborn_composition/tests/production_runtime_automations.rs
• crates/ironclaw_webui/src/webui_v2/handlers.rs
• tests/integration/changed-coverage-exemptions.toml

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/reborn/target-architecture/CHECKLIST.md`:
- Around line 79-84: Split the combined ProductSurfaceFailure checklist entry
into separate items: one covering the six port relocations and residue baseline,
one for BlockedAuthPromptRequest.gate_ref, one for installed_activation_errors,
one for ResolvedChannelDelivery identity newtypes, and one for
import_extension_bundle’s default behavior and test. Mark only the six port
relocations as dependent on removing ironclaw_turns::TurnError; give each
independent change its own owner and caller-level tests.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 2c418c86-5e19-44a7-83e7-1710540e3d1c

📥 Commits

Reviewing files that changed from the base of the PR and between fe40cb2 and a6ee90c.

📒 Files selected for processing (2)

• crates/ironclaw_product_contracts/src/lifecycle_service.rs
• docs/reborn/target-architecture/CHECKLIST.md

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/reborn/target-architecture/CHECKLIST.md`:
- Line 79: Define the contract-facing error in an allowed crate, limited to
ironclaw_host_api or ironclaw_extension_contracts, and update affected ports to
use it without depending on ironclaw_product or ironclaw_extension_host. In
ironclaw_product, map that neutral error into ProductSurfaceFailure while
preserving existing product behavior; then revise this checklist entry and the
reborn_extension_host_port_inversion.rs residue test plan to track the new
boundary.
- Around line 80-83: Update the checklist section heading to “four independent
WS2.1 follow-ups” and revise its introductory text to state that the list
contains three type corrections and one behavior change, rather than four
unchanged relocations. Remove or qualify the claim that all four items were
relocated unchanged so it applies only to the three type-correction items, while
preserving the independence and dependency statements.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 525719bc-5aef-40d7-8079-777c2c286138

📥 Commits

Reviewing files that changed from the base of the PR and between a6ee90c and ffc4b86.

📒 Files selected for processing (2)

• crates/ironclaw_product_contracts/src/lifecycle_service.rs
• docs/reborn/target-architecture/CHECKLIST.md

[coderabbitai]

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Correct the follow-up classification.

The heading says “four verbatim-relocated signatures,” but the list contains three type corrections and one behavior change. The statement that each item was relocated unchanged also does not apply to the behavior change.

Rename this section to “four independent WS2.1 follow-ups” and state the three-to-one split.

Proposed wording

-- [ ] **The four verbatim-relocated signatures WS2.1 deferred
+- [ ] **The four independent WS2.1 follow-ups

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/reborn/target-architecture/CHECKLIST.md` around lines 80 - 83, Update
the checklist section heading to “four independent WS2.1 follow-ups” and revise
its introductory text to state that the list contains three type corrections and
one behavior change, rather than four unchanged relocations. Remove or qualify
the claim that all four items were relocated unchanged so it applies only to the
three type-correction items, while preserving the independence and dependency
statements.

[BenKurrek]

Taken on the classification, with one correction to the premise. b36c972.

Where you are right: the row mixed two kinds of fix under one heading. Three are type changes; the fourth flips a live HTTP status. "Signatures" covered the first three and not the fourth, whose defect is in a default body, not a signature.

Where the premise needs adjusting: "verbatim-relocated" is accurate for all four, including the behavior change. I checked before writing it — import_extension_bundle's default is byte-identical on origin/main at crates/ironclaw_product/src/lifecycle.rs:64-74:

Err(ProductSurfaceError::from_status(
    ProductSurfaceErrorCode::InvalidRequest,
    400,
    false,
))

WS2.1 moved it unchanged. So "relocated verbatim" is their shared provenance — which is exactly why all four are follow-ups of this PR rather than pre-existing debt someone else owns — while the fix differs. Dropping the word entirely would lose the reason they belong on a WS2.1 row at all.

Retitled to keep both facts:

The four WS2.1 follow-ups — three typed-signature corrections and one status-code flip — independent of the linchpin row above, and of each other. … Re-titled the same day: the first three are type changes, the fourth is a behavior change, and "signatures" covered only the first three. All four were relocated verbatim by WS2.1 under PLAN operating principle 2 (no semantic change in a move PR) — that is their shared provenance, not a shared fix. The first three need a typed replacement plus a caller-level test at the seam named; the fourth changes a live HTTP status and is sized separately below.

which is your "state the three-to-one split", in the title and in the body, without asserting something about the fourth that is not true.

Verification as on the sibling thread: fmt clean, clippy clean, 94 tests passed / 0 failed.

[coderabbitai]

Rate Limit Exceeded

@BenKurrek have exceeded the limit for the number of chat messages per hour. Please wait 30 minutes and 14 seconds before sending another message.