docs(target-architecture): reconcile the decision record with post-Wave-2 main

[BenKurrek]

Wave 2's port-inversion half is fully merged — #6998 (WS2.1), #7002 (WS5 transports), #7018 (the consolidated WS2.2 + WS2.4 + WS5 stack) and #6996 (the #6963 gate closeout). This audits docs/reborn/target-architecture/ against merged main at 3be5f056e and closes every place the decision record no longer matches what shipped.

Standing rule this serves: docs/reborn/target-architecture/ is the single source of truth. A correction that lives only in a PR body, a review thread, or a GitHub issue is not recorded.

Docs-only. 13 .md files, no code, no tests. House style throughout: dated ✎ amendments, prior text quoted verbatim wherever a clause is corrected, nothing rewritten silently.

---

Per-gap disposition

#	Doc → claim	Why stale	Amendment
1	PROPOSAL §8.1 reading rule 1 — "each layer may use itself and below … the matrix, not the picture, is what CI checks"	True, and it is the whole of Wave 2's blind spot stated as a permission. layer_allows_dependency is reflexive at every layer (:4294, products at :4307-4310) and the exception register is only consulted inside the if !layer_allows_dependency(...) branch (:196) — so no LAYER_MATRIX_EXCEPTION can ever exist for a same-layer edge. 72 same-layer edges sit outside the matrix, 10 of them products → products. Every edge Wave 2 exists to kill is in that plane.	Amended — the mechanism quoted from source, the 72-edge census, and the operative conclusion: the exception register is not a progress metric for any intra-layer wave. Lists the four genuinely-unpoliced products → products edges so the next audit does not rediscover them.
2	PROPOSAL §8.2 — "the high-signal prohibitions CI pins"	Three of its claims are not pinned. (a) "product-API crates never bind sockets" — the rule's own trailing comment describes a WebChat v2 entry that is not there, so webui/src is uncovered, and it is the one crate that would fail (lib.rs:220/238); tracked in #6999. (b) The extension_host row's "✗ product (the restored invariant)" — there is no boundary_rules() entry for ironclaw_extension_host at all; what holds it is a shrink-only residue ratchet, a ratchet toward the invariant. (c) No row exists for extension_manager, which landed in WS2.4.	Amended — all three, with the load-bearing consequence named: the re-layer to loops is what finally lets the matrix enforce the extension_host row, a second independent reason §12.1c's ordering binds.
3	PROPOSAL §11.1 ("Keep — already enforced")	Names none of the eleven scans this program has itself built. §11.2 then double-counts five of them as still pending, so the two halves of §11 disagree. §11 also contains zero occurrences of "coverage" despite three live coverage gates behind the required check.	Amended — full inventory table (scan → what it pins → landing slice) with live baselines, plus the shape worth carrying: six of eleven exist because the matrix could not see the edge, and each is a ratchet, so "gate green" ≠ "rule holds" until residue is zero. Coverage gates named and pointed at their governance row.
4	PROPOSAL §11.2 items 2, 3, 4, 5, 7	Landed but listed as "Add". Item 4 (port-location rule) is fully landed as three scans — the single most misleading entry. Item 7 is stale in both directions: the scan exists and runs in warn mode, so "escaping paths fail" is also wrong.	Amended — one block, item by item, separating what landed from the genuine residue: item 2's owning-issue field still does not exist; item 3's line-count size ceiling was never built — and it is now the clause that would bite (product_contracts 13,362 lines, loop_contracts 13,950; the two crates §11 calls "thin").
5	PROPOSAL §8.3 — the exception table + "§11 adds a ratchet"	Register verified at 13, unchanged. But: ⚠ conversations → turns reads removes_in = "WS5" and WS5 has partly landed without it falling. The ratchet forbids growth, not lateness, and exception_tracking_defect only rejects placeholder text — nothing in CI notices a milestone passing. The ratchet also landed in WS0, not "adds".	Amended — Wave-2-removed-zero recorded as expected-not-shortfall, the live 13 enumerated, the milestone-staleness flagged with two cheap fixes assigned to whoever closes the WS5 product row.
6	PROPOSAL §2.2 — "20 LAYER_MATRIX_EXCEPTIONS (:3557-3702)"	The last place in the document reading 20. All three file:line citations in the sentence above it have drifted (:49→:126, :3497→:4010, :129→:197).	Amended — 13 at :4065-4157, pin at :4063, citations corrected, and why Wave 2 moved it by zero.
7	PROPOSAL §6.1.3 as-built inventory (Wave 1 audit block)	Both headline claims now false — "8 modules" → 24 + gated test_support, and "the product-side ports are deferred by design, not landed" → landed in WS2.1/WS2.2/WS5. §6.1.3 contradicts itself: three inline amendments above say the ports landed; this trailing block is the newest-looking dated note, so it is the one a reader trusts.	Superseded, not deleted — full 24-module list, what actually remains deferred (the frozen inventory + four ports at WS2_..._BASELINE = 4), and #7008 given a home (product_wire.rs 1,923→2,058 lines, large_file exemption owner).
8	PROPOSAL §6.8.2 — "OWNED_PREFIXES still names only crates/ironclaw_extension_host/src/hosted_mcp_ … must move with the pipeline"	Wrong three ways: the constant is OWNED_SCOPES, it names two scopes, and #6996 rewrote it to (crate, in-crate prefix) pairs resolved through the inventory — its own doc comment now says "these survive a family move". The WS7 risk this warns about is discharged. PLAN's item 2 is the mirror image (prefixes right, mechanism stale).	Corrected in both, with the smaller residual obligation stated: only the in-crate src/hosted_mcp_ half travels.
9	CHECKLIST WS5 webui row + §6.9.4 + webui/CLAUDE.md — "228 → 102 symbols", "eleven survivors"	100 / 9. The attachments widened slice in the same PR moved the two symbols the webui row named as belonging to it. The gate's own comment records the correction — "102 when the WS5 transport inversion landed; 100 after…" — and no doc picked it up.	Corrected at all four sites, with the durable lesson: when collapsing a stack, diff the numbers as well as the files.
10	CHECKLIST WS5 operator row + §6.1.3 + 2 operator guides — module llm_config	Does not exist. #7004 created it; the consolidation found main had already moved the same DTOs into the pre-existing operator_llm, deleted the duplicate and repointed 18 import sites. The dead name propagated to four places; product_contracts/CLAUDE.md — the file they all point at — had it right throughout.	Corrected at all four. Counts (5 ports / 27 DTOs) verified exact.
11	CHECKLIST WS2 coverage-gate note (WS2.1, for "every later Wave 2/3 slot")	The gate changed twice under it. Its three failure shapes are still real; its advice is not.	Amended with both: the pre-existing-uncovered exclusion (which automates its shape-(2) advice — reaching for an exemption first is now wrong), and ⚠ the gate no longer runs on an ordinary PR (#6952: pull_request ∉ FULL_EVENTS). With #6978, a stacked slice gets its coverage verdict for the first time in the merge queue.
12	CHECKLIST WS10 ratchet row — the coverage policy	Recorded in no document at all. line_percent = 90.0, branch_percent = 0.0 (changed-coverage-exemptions.toml:9-11), set by #7013, replacing 100/100 from #6889 — branch coverage was gated at a nonzero number for about two days in this program's history. 0.0 means ungated, not "0% required" (branch_pct < 0.0 is unsatisfiable). Also "15 packages" → 16; WS0's 85.54% is history (live global floor 85.11, effective 84.61).	Added — with the consequence for this program: WS1/WS2's habit of counting "lines and branch arms restored" no longer describes anything CI enforces on changed code.
13	CHECKLIST WS10 §11.2.2 row — "lowered to 15 by WS1.1"	The last place reading 15; the ceiling is 13.	Corrected, plus the owning-issue/milestone-check residue.
14	CHECKLIST WS2.4 row + §6.8.3 + §2.4 — manager "≈10.1k / 19 files", host "≈47.8k / 75"	Manager is 20 files / 12,315 lines; host 75 / 48,791. The figure went stale inside the PR that wrote it — true at the slice tip (4bb24accb: 19/10,527), then review commits added a 20th module and ~1.8k lines of tests. §2.4's 56,940/93 is now the pre-split high-water mark.	Re-measured at all three, naming the three in-repo figures that describe this crate in three different units (this row; coverage-floor.toml's 9,979 source / 5,440 instrumented; #7018's 9,671-line carve) — all honest, none quotable.
15	CHECKLIST WS2.4 row — no pointer to #7011	Five review findings in byte-for-byte moved files, correctly deferred to protect the behavior-free-move claim, with no docs pointer.	Added as disposition 6, all five summarized, plus the pattern: a byte-identical move PR should open one issue for what it declined to fix, and the row that moved the code should name it.
16	families/domains.md ×4	"No other crate in the family depends on a sibling" — falsified by attachments → threads, an edge Wave 2 itself created. Attachments' Depends-on omits that and product_contracts (the live [decision]). Conversations still "owns" the external ref pair (unified onto extension_contracts) and its deps omit the new edge. "Never depends on the turn coordinator crate directly" reads as an achieved invariant while conversations/CLAUDE.md mandates that edge.	Amended all four, incl. the ProjectScopedAttachmentReader carve-out and its #7010 tracker.
17	families/product.md ×4	Operator "never as a direct dependency on the boot-configuration crate" — false (ironclaw_reborn_config, 5 sites, and its new BoundaryRule does not forbid it); webui's Depends-on omits ironclaw_attachments, the edge WS5 deliberately created; "transports compile against contracts, not ironclaw_assistant" is true of vocabulary and cannot be made true of the manifest without the open §6.1.3-vs-§6.9.4 decision.	Amended, separating what WS5 closed (operator's product edge, residue zero) from what is still ahead of the code.
18	families/extensions.md — manager Owns line	Omits ironhub, the crate's second-largest module cluster (~3.1k lines / 8 files). PROPOSAL, CHECKLIST and the crate's own CLAUDE.md all record it.	Amended, and flags the two Owns entries the split could not reach.
19	crates/AGENTS.md ×3	ironclaw_operator has no row at all — the crate Wave 2 gave AGENTS.md, CLAUDE.md, a BoundaryRule and a purpose-built gate, 9.6k LOC, invisible on the routing map. Conversations row says "session thread contracts", the exact naming trap WS5 removed. The product_contracts row pins implementors "not by this prose" but omits ironclaw_operator and the gate that pins it.	Amended — operator row added, quoting WS5's own diagnosis that the absence was causal, not cosmetic.
20	README / PLAN / §9 / §13	No Wave 2 landed markers; extension_manager still tagged NEW with no signal it exists; PLAN's "the inventory moves as a unit, like it arrived" was refuted by the split (5 of 9 moved); package count 67 → 68.	Amended — landed markers with the slice→PR map, and PLAN's Wave 2 entry gains five carry-forward corrections.

Verified still accurate

Recorded because the audit is only worth what it checked.

• PROPOSAL §2.1's package arithmetic — 68 packages / 67 members, WS2.4's amendment exact. Independently re-derived from cargo metadata.
• The exception register at 13, edge for edge, and git log -G confirms no Wave 2 PR touched it.
• ironclaw_operator's product dep is gone from the manifest with residue zero — absent from Cargo.toml, 0 occurrences in src/, forbidden by its BoundaryRule, proven through cargo metadata. The first of §8.2's three named product edges to actually close.
• Five ports / twenty-seven DTOs (only the module name was wrong); 91 constants; 92 routes; openai_compat 23 → 3.
• The manager's seven-file product residue, and that it is DTOs/constants/port-residues and never a workflow call — verified against the gate, not by grep (raw rg says 9; two are doc comments the scanner strips).
• The host never depends on the manager, any dependency kind, dev-deps included.
• §6.1.3's allowed-deps (host_api + extension_contracts, no ironclaw_common) — the two-document reconciliation Wave 1 claimed is real.
• ProductOperationFailure's six variants; the AppEvent refutation; the whole §6.8.2 shed list still unshed (so CHECKLIST WS2's verify row is correctly unchecked); families/contracts.md fully current — it is where PROPOSAL §6.1.3 is stale.
• The orphan rule already has a docs home — briefed as a possible gap, it is not one. CHECKLIST WS5's webui row states it ("once a DTO's home is the contracts crate, an impl From<ironclaw_turns::X> for ThatDto has neither side in ironclaw_product and cannot be written there at all"), with the three kernel conversions that became free functions and the two extension traits named; the attachments row applies it to ProjectScopedAttachmentReader; and Split the product_wire DTO family in ironclaw_product_contracts (large_file exemption owner) #7008 records the cost any further product_wire carve pays. I added the §6.1.3 cross-reference so the contracts crate's own entry carries it, and the families/domains.md attachments carve-out now names it too — but the finding itself was correctly recorded when it was made.
• products → products invisibility was recorded, but only in a slice disposition (CHECKLIST WS2 row 1, disposition 4) — accurate where it sat, and absent from §8 and §11, which is where a reader planning a wave would look. That asymmetry is gap 1 above rather than a contradiction.
• No architecture test reads docs/reborn/target-architecture/, so this PR cannot break one. (Four tests do read docs: three docs/reborn/contracts/*.md and docs/plans/composition-pubuse.snapshot.)

Briefed premises this audit refuted

• The channel_config_product_service.rs:61-69 unreachability finding is discharged in code, not an unrecorded gap. The if let Ok(true) error-swallow was replaced with a total match that propagates non-NotInstalled failures, and field_status gained caller-level tests, both before refactor(contracts): consolidate the Wave 2 port-inversion stack (WS2.2, WS2.4, WS5) #7018 merged. Nothing to record.
• branch_percent = 0.0 is not a lowered floor, it is no floor — and branch coverage was never gated before ci: enforce WS11 coverage and critical mutation gates #6889 at all, so ci: restore the original 90% changed-line coverage floor #7013 restored the long-standing state rather than relaxing a settled one.

Findings a sibling agent is actively changing — deliberately not amended here

Audited against main only. Each of these is real and each belongs to a branch in flight, so amending it here would collide:

• ws2/decisions — the five open [decision] rows: channel_host.rs ownership (now the binding constraint on the re-layer, 26 of the surviving product symbols), hosted-MCP registration placement, the slack_user destructive boot migration, LlmConfigService's vendor vocabulary in contracts, and §6.1.3-vs-§6.9.4's frozen inventory. My §8.2/§11 amendments state the mechanism behind them and stop short of the calls.
• ws2/package-colocation — physical moves and renames. I did not touch the family tree layouts in families/*.md, §5's target tree, or WS6's rename list.
• ws2/strays-followups — CHECKLIST WS2's strays row and its four sub-items.

Expect a merge-down before this lands.

Out of scope for a docs-only PR — code-file defects found in passing

Reported, not fixed:

1. changed-coverage-exemptions.toml's WS2 header says "Thirteen lines across six files"; its entries list fifteen (1+2+5+2+1+4). Flagged in review on refactor(contracts): consolidate the Wave 2 port-inversion stack (WS2.2, WS2.4, WS5) #7018, not applied before merge.
2. No detection of an exemption that is never used. The loader is aggressively fail-closed about staleness (stale path aborts the gate before any coverage is read; expired review_after reds it) but an exemption the new pre-existing-uncovered exclusion has made redundant is silently inert. Wanted: report exemptions that matched nothing in a run where base coverage was applied.
3. .github/workflows/reborn-tests.yml:782-784 still says "While [global].enforce = false … this always exits 0 (dry-run soak period)" — the ratchet has been enforcing since the recapture.
4. FULL_PR_PATHS lists coverage-floor.toml but not changed-coverage-exemptions.toml, so a PR that only edits the exemption manifest does not run the gate that consumes it.
5. reborn_restructure_baselines.rs:10-12 says the exception count is "now 15" (13) and the specificity allowlist is 130 (129).
6. Observation, not a defect — classify-test-scope.sh treats any .md under crates/ as core code. Measured on this PR's own diff: crates/AGENTS.md → docs_only=false, has_core_code=true, so a documentation-only change runs the full Reborn matrix (a .md under docs/ correctly yields docs_only=true). This errs in the fail-safe direction — the exact opposite of the Path-keyed CI gates that survive #6946: six silent + two loud, all blocking the first family git mv #6963 class, where a gate scanned nothing and reported success — so it needs no fix on safety grounds. It is recorded because this program ships guidance edits constantly (PLAN operating principle 3 requires them to travel with the change) and every such PR pays a full-matrix run. If it is ever tightened, the tightening must not let a crate-guide edit unhook the lane that would catch a stale guide.

Verification

• Docs-only: git diff --name-only origin/main → 13 files, all .md; grep -v '\.md$' is empty.
• No silent rewrites: git diff --word-diff=porcelain removes 19 distinct tokens, every one either quoted back verbatim by the amendment that replaces it (eleven, session thread, llm_config, SseManager/AppEvent, "External actor/conversation refs, source/reply") or a punctuation shift from inserting an inline note.
• CARGO_INCREMENTAL=0 cargo test -p ironclaw_architecture → 187 passed, 0 failed (run after the edits; confirmed no suite reads this doc tree).
• Every amendment carries a file:line citation against merged main or a PR/issue pointer.

🤖 Generated with Claude Code

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[railway-app]

🚅 Deployed to the ironclaw-pr-7032 environment in ironclaw-ci-preview

Service	Status	Web	Updated (UTC)
ironclaw	✅ Success (View Logs)	Web	Aug 3, 2026 at 3:13 am

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

• Documentation
  • Updated architecture documentation to reflect current Wave 1 and Wave 2 progress, dependency relationships, ownership boundaries, and remaining work.
  • Clarified guidance for conversation references, operator integrations, streaming boundaries, attachment capabilities, and extension management.
  • Corrected inventories, coverage expectations, dependency counts, milestone sequencing, and validation status across the target architecture documentation.
  • Recorded newly established components, completed work, unresolved exceptions, and deferred follow-ups.

Walkthrough

The PR updates crate guidance and Reborn target-architecture documentation. It records Wave 2 ownership, dependency, milestone, inventory, exception, coverage, and enforcement findings.

Changes

Architecture documentation audit

Layer / File(s)	Summary
Crate guidance and boundary corrections crates/AGENTS.md, crates/ironclaw_conversations/AGENTS.md, crates/ironclaw_operator/*, crates/ironclaw_reborn_openai_compat/CLAUDE.md, crates/ironclaw_webui/CLAUDE.md	The guidance records operator ports, conversation reference ownership, streaming boundaries, and corrected WebUI residue.
Dependency and ownership records docs/reborn/target-architecture/families/domains.md, docs/reborn/target-architecture/families/extensions.md, docs/reborn/target-architecture/families/product.md, docs/reborn/target-architecture/PROPOSAL.md	The architecture records current crate dependencies, ownership boundaries, transport caveats, and extension-manager responsibilities.
Wave 2 status and architecture inventory docs/reborn/target-architecture/README.md, docs/reborn/target-architecture/PLAN.md, docs/reborn/target-architecture/CHECKLIST.md, docs/reborn/target-architecture/PROPOSAL.md	The documents record Wave 2 results, remaining blockers, split measurements, package counts, and exception status.
Architecture gates and coverage governance docs/reborn/target-architecture/CHECKLIST.md, docs/reborn/target-architecture/PLAN.md, docs/reborn/target-architecture/PROPOSAL.md	The documentation updates gate scopes, coverage rules, exception baselines, enforcement gaps, and scan inventories.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• nearai/ironclaw#7005: Related ownership and durable-reference architecture changes.
• nearai/ironclaw#7003: Related extension-manager split documented by this PR.
• nearai/ironclaw#6995: Related Wave 1/Wave 2 architecture audit updates.

Suggested reviewers: ilblackdragon

🚥 Pre-merge checks | ✅ 3 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description gives strong change and verification detail but omits most required template sections, including change type, validation, risk, rollback, and review follow-through.	Complete the required template sections, or explicitly mark them not applicable with reasons, including change type, validation, test strategy, security, database impact, blast radius, rollback, and review follow-through.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title uses Conventional Commits format and accurately summarizes the documentation reconciliation against post-Wave-2 main.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ironloopai]

🔎 Review · PR #7032

🔴 Failed

Execution result is invalid

The structured result could not be verified.

_{Automatic · PR opened · attempt 1 of 3 · failed after 1m 45s}

Failure details

• Repository: nearai/ironclaw
• Base: main at 3be5f05
• Head: docs/wave2-truth-audit at 3a8a220
• Created: Aug 3, 2026, 3:11 AM UTC
• Updated: Aug 3, 2026, 3:12 AM UTC
• Run: 460673fd-e353-4e60-b851-8f5edce136a6
• Latest attempt: 1 · Completed · 69bd2d17-1459-4e75-8ef2-578b2fbab860
• Failed during: Verification
• Retryable: No
• Failure: ca7cbe05-6f58-4fda-8ed7-72828b866f05

[coderabbitai]

Actionable comments posted: 12

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/AGENTS.md`:
- Line 127: Update the stale module reference in
crates/ironclaw_product/CLAUDE.md to use operator_llm::{LlmConfigService,
ActiveModelReader, ...} for the service implementation. Preserve llm_config only
where it refers to the public ProductSurface view or historical text.

In `@crates/ironclaw_conversations/AGENTS.md`:
- Around line 18-34: Update the conversation binding documentation to state that
the live external identity is (space_id, conversation_id, topic_id). Clarify
that thread_id refers to canonical ironclaw_host_api::ids::ThreadId, with the
sole compatibility exception being the stored_refs field spelling used for
rollback-safe storage.

In `@docs/reborn/target-architecture/CHECKLIST.md`:
- Around line 260-261: Update the recorded defects in the checklist amendment to
include follow-up issue IDs for the stranded-exemption failure mode, the WS2
entry-count mismatch, and the stale workflow comment. Replace the existing
review reference to `#7018` with the corresponding issue reference, and ensure
each unresolved defect has an explicit issue link before marking the audit
complete.
- Line 17: The WS7 checklist entry overclaims that every gate uses
crate-inventory discovery and positive/negative fixtures while later
acknowledging roughly 20 named-path gates still need repointing. Narrow that
guarantee to only the gates fixed by `#6946` and `#6996`, or remove the claim, while
preserving the accurate details about the remaining WS10 work.

In `@docs/reborn/target-architecture/families/domains.md`:
- Around line 63-64: Update the family-level exhaustive dependency summaries to
include ironclaw_attachments → ironclaw_threads and ironclaw_product_contracts
wherever the chartered same-family edges and contracts allowlist are listed.
Revise the stated edge count from three to four and ensure the attachments and
contracts crate-level “Depends on” records match these summaries.
- Around line 103-110: Update the “Identity and binding value types” ownership
entry in the target-architecture documentation to remove external actor and
conversation reference types from ironclaw_conversations ownership. Retain only
this crate’s ownership of the durable stored_refs on-disk grammar, while
identifying ironclaw_extension_contracts::external as the sole home for those
reference types.

In `@docs/reborn/target-architecture/families/product.md`:
- Line 75: Update the secret-access statement on line 54 to reflect that
ironclaw_operator currently has a direct ironclaw_secrets dependency, or
explicitly label the port-only access guarantee as target state. Keep the
dependency inventory and its existing distinction between current and intended
architecture consistent.
- Around line 42-44: Update the live dependency guidance in this document to use
the current crate identifiers ironclaw_process_sandbox and
ironclaw_reborn_openai_compat, including the amended architecture text and any
other non-historical references. Search the Markdown guidance for stale
ironclaw_sandbox and ironclaw_openai_compat matches, and explicitly mark any
retained historical or target-state names.

In `@docs/reborn/target-architecture/PROPOSAL.md`:
- Around line 797-801: Correct the quantitative claim in the Wave 2 truth-audit
amendment so the same-layer category counts and stated total agree: either
change “72” to the sum of the listed categories, or add the missing category
with its verified count. Update the surrounding claim consistently without
altering the edge examples or conclusions.
- Line 640: Clarify the dependency statement in the 6.9.4 ironclaw_webui entry
by marking the ironclaw_product → product_contracts change as a target or
conditional outcome, not an applied change. Keep the later statement that the
dependency does not flip in this row and that placement remains an open
§6.1.3-vs-§6.9.4 decision consistent throughout the entry.
- Line 1098: Run mint dev and mint broken-links from the docs directory, then
record both completed checks in the documentation change; if mint is
unavailable, explicitly note the missing dependency instead.

In `@docs/reborn/target-architecture/README.md`:
- Line 11: Rewrite the paragraph beginning “Three program-level facts” to
distinguish the recorded causes for each surviving product edge: concrete
assembly in channel_host.rs for extension_host, DTO/capability and port residue
for extension_manager, and frozen product constants for webui and openai_compat.
Preserve the ironclaw_operator removal and Wave 2 exception-count statements,
and state the corresponding owner decisions without attributing all four edges
to route handlers.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: aeae7778-b1d6-47f1-8d8b-92730ac7adcd

📥 Commits

Reviewing files that changed from the base of the PR and between 3be5f05 and 3a8a220.

📒 Files selected for processing (13)

• crates/AGENTS.md
• crates/ironclaw_conversations/AGENTS.md
• crates/ironclaw_operator/AGENTS.md
• crates/ironclaw_operator/CLAUDE.md
• crates/ironclaw_reborn_openai_compat/CLAUDE.md
• crates/ironclaw_webui/CLAUDE.md
• docs/reborn/target-architecture/CHECKLIST.md
• docs/reborn/target-architecture/PLAN.md
• docs/reborn/target-architecture/PROPOSAL.md
• docs/reborn/target-architecture/README.md
• docs/reborn/target-architecture/families/domains.md
• docs/reborn/target-architecture/families/extensions.md
• docs/reborn/target-architecture/families/product.md

[coderabbitai]

📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

rg -n --hidden \
  --glob '.claude/**' \
  --glob '**/AGENTS.md' \
  --glob '**/CLAUDE.md' \
  --glob 'crates/AGENTS.md' \
  --glob 'docs/reborn/contracts/**' \
  --glob '**/*.md' \
  -P '(?<![A-Za-z0-9_])(SessionThreadService|ThreadMessageRecord|llm_config|SseManager|AppEvent|OperatorPublicRouteMount|OperatorProtectedRouteMount)(?![A-Za-z0-9_])'

Repository: nearai/ironclaw

Length of output: 153

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path
import re

names = re.compile(
    r"(?<![A-Za-z0-9_])"
    r"(SessionThreadService|ThreadMessageRecord|llm_config|SseManager|AppEvent|"
    r"OperatorPublicRouteMount|OperatorProtectedRouteMount)"
    r"(?![A-Za-z0-9_])"
)

roots = [Path(".claude"), Path("docs/reborn/contracts")]
files = set()
for root in roots:
    if root.exists():
        files.update(p for p in root.rglob("*") if p.is_file())
files.update(Path(".").rglob("AGENTS.md"))
files.update(Path(".").rglob("CLAUDE.md"))
files.update(p for p in Path(".").rglob("*.md") if p.is_file())

matches = []
for path in sorted(files):
    text = path.read_text(encoding="utf-8", errors="replace")
    found = sorted(set(names.findall(text)))
    if found:
        matches.append((str(path), found))

print(f"scanned_files={len(files)}")
print(f"stale_reference_files={len(matches)}")
for path, found in matches:
    print(f"{path}: {', '.join(found)}")
PY

Repository: nearai/ironclaw

Length of output: 2410

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path
import re

pattern = re.compile(
    r"(?<![A-Za-z0-9_])"
    r"(SessionThreadService|ThreadMessageRecord|llm_config|SseManager|AppEvent|"
    r"OperatorPublicRouteMount|OperatorProtectedRouteMount)"
    r"(?![A-Za-z0-9_])"
)

files = set()
for root in (Path(".claude"), Path("docs/reborn/contracts")):
    if root.exists():
        files.update(p for p in root.rglob("*") if p.is_file())
files.update(Path(".").rglob("AGENTS.md"))
files.update(Path(".").rglob("CLAUDE.md"))
files.update(p for p in Path(".").rglob("*.md") if p.is_file())

for path in sorted(files):
    lines = path.read_text(encoding="utf-8", errors="replace").splitlines()
    for number, line in enumerate(lines, 1):
        if pattern.search(line):
            before = lines[number - 2].strip() if number > 1 else ""
            after = lines[number].strip() if number < len(lines) else ""
            print(f"{path}:{number}")
            print(f"  {before}")
            print(f"  {line.strip()}")
            print(f"  {after}")
PY

Repository: nearai/ironclaw

Length of output: 50373

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' 'Current Rust declarations and references:'
rg -n --glob '*.rs' \
  'trait (SessionThreadService|InboundConversationService)|struct (ThreadMessageRecord|ConversationMessageRecord)|\b(SessionThreadService|InboundConversationService|ThreadMessageRecord|ConversationMessageRecord)\b' crates | head -120

printf '%s\n' 'Relevant guidance and contract references:'
rg -n \
  'SessionThreadService|InboundConversationService|ThreadMessageRecord|ConversationMessageRecord|SseManager|EventStreamManager|AppEvent|OperatorPublicRouteMount|OperatorProtectedRouteMount|PublicRouteMount|ProtectedRouteMount|llm_config|operator_llm' \
  .claude/commands/trace.md \
  .claude/skills/ironclaw-reborn-orientation/SKILL.md \
  AGENTS.md \
  crates/AGENTS.md \
  crates/Architecture.md \
  crates/ironclaw_conversations/CLAUDE.md \
  crates/ironclaw_product/AGENTS.md \
  crates/ironclaw_product/CLAUDE.md \
  crates/ironclaw_reborn_openai_compat/CLAUDE.md \
  docs/reborn/contracts/openai-compatible-api.md \
  docs/reborn/contracts/storage-placement.md \
  docs/reborn/contracts/settings-config.md \
  2>/dev/null

Repository: nearai/ironclaw

Length of output: 21858

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

for spec in \
  'crates/ironclaw_product/CLAUDE.md:48:86' \
  'crates/ironclaw_product/CLAUDE.md:168:194' \
  'crates/ironclaw_operator/CLAUDE.md:28:72' \
  'docs/reborn/contracts/openai-compatible-api.md:104:120' \
  'docs/reborn/contracts/openai-compatible-api.md:246:260' \
  'docs/reborn/contracts/storage-placement.md:66:108' \
  'docs/reborn/contracts/settings-config.md:128:142'
do
  file=${spec%%:*}
  rest=${spec#*:}
  start=${rest%%:*}
  end=${rest##*:}
  printf '\n--- %s:%s-%s ---\n' "$file" "$start" "$end"
  sed -n "${start},${end}p" "$file"
done

printf '\n--- conversation service declarations ---\n'
rg -n --glob '*.rs' \
  'pub trait (InboundConversationService|SessionThreadService)|pub struct (ConversationMessageRecord|ThreadMessageRecord)' \
  crates/ironclaw_conversations crates/ironclaw_threads

Repository: nearai/ironclaw

Length of output: 11408

---

Replace the stale llm_config module reference. In crates/ironclaw_product/CLAUDE.md, use operator_llm::{LlmConfigService, ActiveModelReader, ...}. Keep llm_config when it denotes the public ProductSurface view or historical text.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/AGENTS.md` at line 127, Update the stale module reference in
crates/ironclaw_product/CLAUDE.md to use operator_llm::{LlmConfigService,
ActiveModelReader, ...} for the service implementation. Preserve llm_config only
where it refers to the public ProductSurface view or historical text.

Source: Path instructions

[coderabbitai]

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

State the live external identity separately from the storage spelling.

The guide documents the legacy stored_refs.thread_id field but does not state the live external binding identity. Add that identity as (space_id, conversation_id, topic_id). Reserve thread_id for canonical ironclaw_host_api::ids::ThreadId, except for the rollback-compatible stored_refs field spelling. This prevents callers from using the storage key as the runtime route identity.

Based on learnings: the stable external conversation binding identity is (space_id, conversation_id, topic_id), while thread_id has the documented compatibility-only exception.

Suggested clarification

   - Source/reply binding refs, participant checks, message acceptance refs, and
     idempotency semantics — plus the durable grammar for external refs
     (`stored_refs`): write the released spelling
     `{space_id, conversation_id, thread_id, message_id}`, read either, so the
     WS5 rename is invisible to storage in both directions and a rollback stays
     safe.
+  - Live external conversation identity is `(space_id, conversation_id,
+    topic_id)`. Use `thread_id` only for canonical `ThreadId` values and the
+    rollback-compatible `stored_refs` field spelling.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	- Adapter-safe conversation binding and inbound-turn service contracts.
	- External actor/conversation refs, source/reply binding refs, participant checks, message acceptance refs, and idempotency semantics.
	- Source/reply binding refs, participant checks, message acceptance refs, and
	idempotency semantics — plus the **durable grammar** for external refs
	(`stored_refs`): write the released spelling
	`{space_id, conversation_id, thread_id, message_id}`, read either, so the
	WS5 rename is invisible to storage in both directions and a rollback stays
	safe.
	> Corrected 2026-08-02 (Wave 2 docs-truth audit): this read "External
	> actor/conversation refs, source/reply binding refs, …". The ref **types**
	> are no longer owned here — WS5 unified them onto
	> `ironclaw_extension_contracts::external` after finding the two copies were
	> field-divergent *and* compared differently (this crate's derived `PartialEq`
	> included the per-event message id; the canonical type excludes the
	> reply-target hint by hand), so two refs for one route could be equal or
	> unequal depending on which copy the caller held. Declaring them again here
	> fails `reborn_conversations_threads_attachments.rs`. What this crate owns is
	> the record grammar, above.
	- Adapter-safe conversation binding and inbound-turn service contracts.
	- Source/reply binding refs, participant checks, message acceptance refs, and
	idempotency semantics — plus the **durable grammar** for external refs
	(`stored_refs`): write the released spelling
	`{space_id, conversation_id, thread_id, message_id}`, read either, so the
	WS5 rename is invisible to storage in both directions and a rollback stays
	safe.
	- Live external conversation identity is `(space_id, conversation_id,
	topic_id)`. Use `thread_id` only for canonical `ThreadId` values and the
	rollback-compatible `stored_refs` field spelling.
	> Corrected 2026-08-02 (Wave 2 docs-truth audit): this read "External
	> actor/conversation refs, source/reply binding refs, …". The ref **types**
	> are no longer owned here — WS5 unified them onto
	> `ironclaw_extension_contracts::external` after finding the two copies were
	> field-divergent *and* compared differently (this crate's derived `PartialEq`
	> included the per-event message id; the canonical type excludes the
	> reply-target hint by hand), so two refs for one route could be equal or
	> unequal depending on which copy the caller held. Declaring them again here
	> fails `reborn_conversations_threads_attachments.rs`. What this crate owns is
	> the record grammar, above.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/ironclaw_conversations/AGENTS.md` around lines 18 - 34, Update the
conversation binding documentation to state that the live external identity is
(space_id, conversation_id, topic_id). Clarify that thread_id refers to
canonical ironclaw_host_api::ids::ThreadId, with the sole compatibility
exception being the stored_refs field spelling used for rollback-safe storage.

Source: Learnings

[coderabbitai]

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Narrow the completed-gate claim.

Line 17 says every gate now uses crate-inventory discovery and positive and negative fixtures. Later text still lists about 20 named-path gates that require repointing. Scope this sentence to the gates fixed by #6946 and #6996, or remove the completion claim.

As per coding guidelines, documentation promising guardrail guarantees must match the enforcing code and tests.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/reborn/target-architecture/CHECKLIST.md` at line 17, The WS7 checklist
entry overclaims that every gate uses crate-inventory discovery and
positive/negative fixtures while later acknowledging roughly 20 named-path gates
still need repointing. Narrow that guarantee to only the gates fixed by `#6946`
and `#6996`, or remove the claim, while preserving the accurate details about the
remaining WS10 work.

Source: Coding guidelines

[coderabbitai]

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Link follow-up issues for the recorded defects.

This amendment records the stranded-exemption defect and stale workflow comment without follow-up issue references. It also points to a review on #7018 for the count mismatch, but that is not a follow-up issue. Add issue IDs for each unresolved defect before marking the audit complete.

As per coding guidelines, discovered problems need follow-up issues.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/reborn/target-architecture/CHECKLIST.md` around lines 260 - 261, Update
the recorded defects in the checklist amendment to include follow-up issue IDs
for the stranded-exemption failure mode, the WS2 entry-count mismatch, and the
stale workflow comment. Replace the existing review reference to `#7018` with the
corresponding issue reference, and ensure each unresolved defect has an explicit
issue link before marking the audit complete.

Source: Coding guidelines

[coderabbitai]

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Update every exhaustive dependency summary.

Line 63 records ironclaw_attachments → ironclaw_threads, but Line 57 still says there are only three chartered same-family edges and Line 61 still lists only three. Line 200 also adds ironclaw_product_contracts, which is absent from the contracts allowlist in Line 57. Update the family-level summaries so they match the crate-level dependency records.

Suggested documentation fix

- contracts/ — host_api, common, prompt_envelope · plus the three chartered same-family edges only: conversations→triggers, attachments→extractors, trace_commons→llm
+ contracts/ — host_api, common, prompt_envelope, product_contracts · plus the four chartered same-family edges only: conversations→triggers, attachments→extractors, attachments→threads, trace_commons→llm

Also applies to: 200-202

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/reborn/target-architecture/families/domains.md` around lines 63 - 64,
Update the family-level exhaustive dependency summaries to include
ironclaw_attachments → ironclaw_threads and ironclaw_product_contracts wherever
the chartered same-family edges and contracts allowlist are listed. Revise the
stated edge count from three to four and ensure the attachments and contracts
crate-level “Depends on” records match these summaries.

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Correct the secret-access guarantee.

Line 54 says ironclaw_operator reaches secret storage only through a port. Line 75 records a current direct ironclaw_secrets dependency. Mark Line 54 as target state or rewrite it to the current state. Otherwise the documentation claims a security boundary that the current manifest does not enforce.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/reborn/target-architecture/families/product.md` at line 75, Update the
secret-access statement on line 54 to reflect that ironclaw_operator currently
has a direct ironclaw_secrets dependency, or explicitly label the port-only
access guarantee as target state. Keep the dependency inventory and its existing
distinction between current and intended architecture consistent.

[coderabbitai]

🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win

Disambiguate the WebUI dependency status.

The entry first states that ironclaw_webui changes from ironclaw_product to product_contracts. The amendment later says the dependency does not flip in this row and leaves placement open. Mark the first statement as target-only or conditional. Otherwise, readers can treat an unresolved decision as landed.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/reborn/target-architecture/PROPOSAL.md` at line 640, Clarify the
dependency statement in the 6.9.4 ironclaw_webui entry by marking the
ironclaw_product → product_contracts change as a target or conditional outcome,
not an applied change. Keep the later statement that the dependency does not
flip in this row and that placement remains an open §6.1.3-vs-§6.9.4 decision
consistent throughout the entry.

[coderabbitai]

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Fix the same-layer edge count.

The listed categories total 71 edges, not 72. Add the omitted category or correct the total. Keep the quantitative claim consistent with the evidence.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/reborn/target-architecture/PROPOSAL.md` around lines 797 - 801, Correct
the quantitative claim in the Wave 2 truth-audit amendment so the same-layer
category counts and stated total agree: either change “72” to the sum of the
listed categories, or add the missing category with its verified count. Update
the surrounding claim consistently without altering the edge examples or
conclusions.

[coderabbitai]

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail
cd docs
mint dev
mint broken-links

Repository: nearai/ironclaw

Length of output: 195

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
cd docs
mint dev
mint broken-links

Repository: nearai/ironclaw

Length of output: 195

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
cd docs
mint dev
mint broken-links

Repository: nearai/ironclaw

Length of output: 195

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
cd docs
mint dev
mint broken-links

Repository: nearai/ironclaw

Length of output: 195

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
cd docs
mint dev
mint broken-links

Repository: nearai/ironclaw

Length of output: 195

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
cd docs
mint dev
mint broken-links

Repository: nearai/ironclaw

Length of output: 195

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
cd docs
mint dev
mint broken-links

Repository: nearai/ironclaw

Length of output: 195

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
cd docs
mint dev
mint broken-links

Repository: nearai/ironclaw

Length of output: 195

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
cd docs
mint dev
mint broken-links

Repository: nearai/ironclaw

Length of output: 195

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
cd docs
mint dev
mint broken-links

Repository: nearai/ironclaw

Length of output: 195

---

Run mint dev and mint broken-links from docs/.

This Markdown change is under docs/**/*, so the repo check for documented enforcement requires both results before merge. Include both completed checks here or note any missing mint dependency.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/reborn/target-architecture/PROPOSAL.md` at line 1098, Run mint dev and
mint broken-links from the docs directory, then record both completed checks in
the documentation change; if mint is unavailable, explicitly note the missing
dependency instead.

Source: Coding guidelines

[coderabbitai]

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Separate the four surviving product-edge causes.

Line 11 attributes all four edges to route handlers naming frozen product constants. The audit records different blockers: concrete assembly in channel_host.rs for extension_host, DTO/capability and port residue for extension_manager, and frozen constants for WebUI/OpenAI compatibility. Rewrite this paragraph with the per-crate causes and owner decisions.

As per coding guidelines, documentation claims must match the recorded architecture evidence.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/reborn/target-architecture/README.md` at line 11, Rewrite the paragraph
beginning “Three program-level facts” to distinguish the recorded causes for
each surviving product edge: concrete assembly in channel_host.rs for
extension_host, DTO/capability and port residue for extension_manager, and
frozen product constants for webui and openai_compat. Preserve the
ironclaw_operator removal and Wave 2 exception-count statements, and state the
corresponding owner decisions without attributing all four edges to route
handlers.

Source: Coding guidelines

[github-actions]

Coverage ratchet

Ratchet mode: ENFORCING

RATCHET PASS: global
  observed: 86.17% (328043 / 380706 lines)
  floor:    85.11% (tolerance 0.5pp -> effective floor 84.61%)
  denominator: 380706 lines now vs 375097 at floor capture (+5609 lines, +1.5%) — not a material change

RATCHET PASS: ironclaw_runner
  observed: 85.93% (14917 / 17359 lines)
  floor:    85.55% (tolerance 0.5pp -> effective floor 85.05%)
  floor_covered_lines: 14658 (tolerance 20 lines -> effective floor 14638)
  denominator: 17359 lines now vs 17133 at floor capture (+226 lines, +1.32%) — not a material change

RATCHET PASS: ironclaw_processes
  observed: 88.76% (5889 / 6635 lines)
  floor:    88.07% (tolerance 0.5pp -> effective floor 87.57%)
  floor_covered_lines: 5839 (tolerance 20 lines -> effective floor 5819)
  denominator: 6635 lines now vs 6630 at floor capture (+5 lines, +0.08%) — not a material change

RATCHET PASS: ironclaw_turns
  observed: 88.46% (3709 / 4193 lines)
  floor:    85.11% (tolerance 0.5pp -> effective floor 84.61%)

RATCHET PASS: ironclaw_authorization
  observed: 86.59% (723 / 835 lines)
  floor:    62.51% (tolerance 0.5pp -> effective floor 62.01%)
  floor_covered_lines: 612 (tolerance 20 lines -> effective floor 592)
  denominator: 835 lines now vs 979 at floor capture (-144 lines, -14.71%) — material change (>5%)

RATCHET PASS: ironclaw_approvals
  observed: 91.05% (1820 / 1999 lines)
  floor:    85.86% (tolerance 0.5pp -> effective floor 85.36%)
  floor_covered_lines: 1822 (tolerance 20 lines -> effective floor 1802)
  denominator: 1999 lines now vs 2122 at floor capture (-123 lines, -5.8%) — material change (>5%)

RATCHET PASS: ironclaw_secrets
  observed: 85.81% (2896 / 3375 lines)
  floor:    84.01% (tolerance 0.5pp -> effective floor 83.51%)
  floor_covered_lines: 2795 (tolerance 20 lines -> effective floor 2775)
  denominator: 3375 lines now vs 3327 at floor capture (+48 lines, +1.44%) — not a material change

RATCHET PASS: ironclaw_filesystem
  observed: 77.09% (5915 / 7673 lines)
  floor:    75.93% (tolerance 0.5pp -> effective floor 75.43%)
  floor_covered_lines: 5826 (tolerance 20 lines -> effective floor 5806)
  denominator: 7673 lines now vs 7673 at floor capture (+0 lines, +0%) — not a material change

RATCHET PASS: ironclaw_llm
  observed: 79.22% (20885 / 26364 lines)
  floor:    79.22% (tolerance 0.5pp -> effective floor 78.72%)
  floor_covered_lines: 20885 (tolerance 20 lines -> effective floor 20865)
  denominator: 26364 lines now vs 26364 at floor capture (+0 lines, +0%) — not a material change

RATCHET PASS: ironclaw_triggers
  observed: 94.68% (3134 / 3310 lines)
  floor:    86.04% (tolerance 0.5pp -> effective floor 85.54%)
  floor_covered_lines: 2804 (tolerance 20 lines -> effective floor 2784)
  denominator: 3310 lines now vs 3259 at floor capture (+51 lines, +1.56%) — not a material change

RATCHET PASS: ironclaw_product
  observed: 87.97% (22219 / 25258 lines)
  floor:    86.94% (tolerance 0.5pp -> effective floor 86.44%)
  floor_covered_lines: 21367 (tolerance 20 lines -> effective floor 21347)
  denominator: 25258 lines now vs 24576 at floor capture (+682 lines, +2.78%) — not a material change

RATCHET PASS: ironclaw_outbound
  observed: 94.68% (4271 / 4511 lines)
  floor:    93.49% (tolerance 0.5pp -> effective floor 92.99%)
  floor_covered_lines: 4105 (tolerance 20 lines -> effective floor 4085)
  denominator: 4511 lines now vs 4391 at floor capture (+120 lines, +2.73%) — not a material change

RATCHET PASS: ironclaw_extension_host
  observed: 85.82% (20590 / 23991 lines)
  floor:    84.83% (tolerance 0.5pp -> effective floor 84.33%)
  floor_covered_lines: 19907 (tolerance 20 lines -> effective floor 19887)
  denominator: 23991 lines now vs 23467 at floor capture (+524 lines, +2.23%) — not a material change

RATCHET PASS: ironclaw_extension_manager
  observed: 88.93% (6027 / 6777 lines)
  floor:    84.6% (tolerance 0.5pp -> effective floor 84.1%)
  floor_covered_lines: 4602 (tolerance 20 lines -> effective floor 4582)
  denominator: 6777 lines now vs 5440 at floor capture (+1337 lines, +24.58%) — material change (>5%)

RATCHET PASS: ironclaw_events
  observed: 80.55% (1197 / 1486 lines)
  floor:    80.55% (tolerance 0.5pp -> effective floor 80.05%)
  floor_covered_lines: 1197 (tolerance 20 lines -> effective floor 1177)
  denominator: 1486 lines now vs 1486 at floor capture (+0 lines, +0%) — not a material change

RATCHET PASS: ironclaw_safety
  observed: 92.75% (4468 / 4817 lines)
  floor:    92.44% (tolerance 0.5pp -> effective floor 91.94%)
  floor_covered_lines: 3973 (tolerance 20 lines -> effective floor 3953)
  denominator: 4817 lines now vs 4298 at floor capture (+519 lines, +12.08%) — material change (>5%)

RATCHET PASS: ironclaw_host_runtime
  observed: 88.41% (21338 / 24135 lines)
  floor:    88.23% (tolerance 0.5pp -> effective floor 87.73%)
  floor_covered_lines: 20538 (tolerance 20 lines -> effective floor 20518)
  denominator: 24135 lines now vs 23277 at floor capture (+858 lines, +3.69%) — not a material change

Reborn integration-tier coverage

Line coverage (Reborn crates): 86.17% — 328043 / 380706 lines

Per-crate breakdown (64 crates, lowest-covered first)

Crate	Line %	Covered / Total
ironclaw_host_ingress	42.5%	17 / 40
ironclaw_memory	53.48%	630 / 1178
ironclaw_projects	72.36%	233 / 322
ironclaw_capabilities	74.59%	2876 / 3856
ironclaw_trust	75.79%	748 / 987
ironclaw_extractors	75.88%	538 / 709
ironclaw_reborn_cli	76.1%	11084 / 14566
ironclaw_observability	76.19%	32 / 42
ironclaw_filesystem	77.09%	5915 / 7673
ironclaw_wasm	78.84%	704 / 893
ironclaw_llm	79.22%	20885 / 26364
ironclaw_events	80.55%	1197 / 1486
ironclaw_loop_contracts	82.4%	5637 / 6841
ironclaw_first_party_extensions	82.57%	6784 / 8216
ironclaw_memory_native	82.85%	2850 / 3440
ironclaw_libsql_runtime	83.3%	384 / 461
ironclaw_auth	83.95%	6699 / 7980
ironclaw_operator	84.54%	5303 / 6273
ironclaw_hooks	84.57%	9896 / 11702
ironclaw_event_projections	84.81%	854 / 1007
ironclaw_reborn_event_store	84.93%	1206 / 1420
ironclaw_reborn_config	85.29%	2110 / 2474
ironclaw_network	85.31%	894 / 1048
ironclaw_product_contracts	85.59%	4111 / 4803
ironclaw_secrets	85.81%	2896 / 3375
ironclaw_extension_contracts	85.81%	2558 / 2981
ironclaw_reborn_composition	85.82%	22051 / 25695
ironclaw_extension_host	85.82%	20590 / 23991
ironclaw_runner	85.93%	14917 / 17359
ironclaw_host_api	86.05%	6367 / 7399
ironclaw_authorization	86.59%	723 / 835
ironclaw_webui	86.95%	11937 / 13729
ironclaw_wasm_limiter	87.06%	74 / 85
ironclaw_common	87.07%	1152 / 1323
ironclaw_reborn_traces	87.61%	11720 / 13377
ironclaw_scripts	87.87%	420 / 478
ironclaw_product	87.97%	22219 / 25258
ironclaw_threads	88.14%	5189 / 5887
ironclaw_host_runtime	88.41%	21338 / 24135
ironclaw_turns	88.46%	3709 / 4193
ironclaw_telegram_extension	88.55%	588 / 664
ironclaw_skills	88.58%	2784 / 3143
ironclaw_process_sandbox	88.64%	281 / 317
ironclaw_processes	88.76%	5889 / 6635
ironclaw_extension_manager	88.93%	6027 / 6777
ironclaw_reborn_openai_compat	89.4%	3644 / 4076
ironclaw_telegram_v2_adapter	89.47%	1580 / 1766
ironclaw_extensions	89.55%	6249 / 6978
ironclaw_loop_host	90.47%	18043 / 19944
ironclaw_resources	90.76%	4084 / 4500
ironclaw_approvals	91.05%	1820 / 1999
ironclaw_reborn_identity	91.3%	451 / 494
ironclaw_mcp	92%	1426 / 1550
ironclaw_event_streams	92.5%	1048 / 1133
ironclaw_safety	92.75%	4468 / 4817
ironclaw_conversations	93.22%	2503 / 2685
ironclaw_agent_loop	93.52%	10430 / 11153
ironclaw_slack_extension	93.95%	3697 / 3935
ironclaw_first_party_extension_ports	94.66%	3758 / 3970
ironclaw_outbound	94.68%	4271 / 4511
ironclaw_triggers	94.68%	3134 / 3310
ironclaw_prompt_envelope	97.46%	192 / 197
ironclaw_runtime_policy	97.6%	855 / 876
ironclaw_attachments	98.49%	1374 / 1395

This table itself is informational and never gates the PR on its own — not the percentage, not the per-crate holes, not the 0-coverage callout. A separate coverage ratchet (dry-run until enforce=true; see tests/integration/coverage-floor.toml) can fail the build on specific configured floors.

Exemptions (18 entry/entries excluded from the accounting above)

Module / Crate	Reason	Issue
crate: ironclaw_gateway	v1-only: consumed only by root ironclaw (src/channels/web/platform/static_files.rs, src/channels/web/handlers/frontend.rs); no crates/* dependents. Covered by "Tests (Legacy)".	#5657
crate: ironclaw_tui	v1-only: consumed only by root ironclaw (src/main.rs, src/channels/tui.rs); no crates/* dependents. Crate's own doc comment confirms it bridges INTO v1, not Reborn. Covered by "Tests (Legacy)".	#5657
crates/ironclaw_attachments/src/lib.rs	Declarative crate facade: module declarations, constants, and re-exports only; executable attachment modules remain covered.	#6524
crates/ironclaw_extension_host/src/ingress/mod.rs	Declarative ingress module facade and documentation only; executable router modules remain covered.	#6524
crates/ironclaw_host_api/src/lib.rs	Declarative crate facade: module declarations and re-exports only; executable host API modules remain covered.	#6524
crates/ironclaw_host_api/src/product_adapter/mod.rs	Declarative product-adapter facade: module declarations and re-exports only; executable adapter modules remain covered.	#6524
crates/ironclaw_llm/src/rig_adapter/tests/finish_reason_tests.rs	Test-only module stored under src/ for private adapter access; cargo-llvm-cov omits test harness source from production LCOV while the exercised rig_adapter.rs production lines remain coverage-gated.	#6284
crates/ironclaw_loop_contracts/src/lib.rs	Declaration-only public facade with no executable Rust statements; rustc emits no LCOV source record. Executable loop-contract behavior remains covered in the owned implementation modules.	#6524
crates/ironclaw_outbound/src/error.rs	Declarative error vocabulary only; variants have no LLVM-instrumentable production statements.	#6524
crates/ironclaw_outbound/src/lib.rs	Declarative crate facade: module declarations and re-exports only; executable outbound modules remain covered.	#6524
crates/ironclaw_product/src/lib.rs	Declaration-only public facade with no executable Rust statements; rustc emits no LCOV source record. Executable product behavior remains covered in the owned implementation modules.	#6524
crates/ironclaw_product/src/lib.rs	Declarative crate facade: module declarations and re-exports only; executable product modules remain covered.	#6524
crates/ironclaw_product/src/scoped_fs/mod.rs	Declarative scoped-filesystem facade and documentation only; executable scoped filesystem modules remain covered.	#6524
crates/ironclaw_reborn_composition/src/support/fs/mod.rs	Declarative composition support facade: module declarations and re-exports only; executable filesystem adapters remain covered.	#6524
crates/ironclaw_slack_extension/src/lib.rs	Declarative Slack crate facade: module declarations and re-exports only; executable Slack modules remain covered.	#6524
crates/ironclaw_telegram_extension/src/lib.rs	Declarative Telegram crate facade: module declarations and re-exports only; executable Telegram modules remain covered.	#6524
crates/ironclaw_threads/src/lib.rs	Declaration-only public facade with no executable Rust statements; rustc emits no LCOV source record. Executable thread behavior remains covered in the owned implementation modules.	#6524
crates/ironclaw_webui/src/webui_v2/mod.rs	Declaration-only WebUI v2 facade with no executable Rust statements; rustc emits no LCOV source record. Executable route behavior remains covered in the owned implementation modules.	#6524