refactor(reborn): consolidate the five Wave 3 PRs and close the WS3/WS4 rows

.claude/commands/triage-prs.md

@@ -39,7 +39,7 @@ For each open PR, determine the primary module it touches by examining the `file
 | **Storage & Memory** | `crates/ironclaw_filesystem/`, `crates/ironclaw_memory*/`, `crates/ironclaw_libsql_runtime/`, `migrations/` |
 | **Security** | `crates/ironclaw_safety/`, `crates/ironclaw_secrets/`, `crates/ironclaw_trust/`, `crates/ironclaw_authorization/`, `crates/ironclaw_approvals/` |
 | **Config & Setup** | `crates/ironclaw_reborn_config/` |
-| **Sandbox & Processes** | `crates/ironclaw_process_sandbox/`, `crates/ironclaw_processes/`, `crates/ironclaw_scripts/`, `crates/ironclaw_wasm*/` |
+| **Sandbox & Processes** | `crates/ironclaw_sandbox/`, `crates/ironclaw_processes/`, `crates/ironclaw_wasm*/` |
 | **Hooks** | `crates/ironclaw_hooks/` |
 | **Events & Projections** | `crates/ironclaw_events/`, `crates/ironclaw_event_projections/`, `crates/ironclaw_event_streams/` |
 | **CI/CD & Docs** | `.github/`, `README.md`, `CLAUDE.md`, `*.md` (no src) |

.claude/rules/safety-and-sandbox.md

@@ -5,7 +5,7 @@ paths:
   - "crates/ironclaw_safety/**"
   - "crates/ironclaw_host_runtime/**"
   - "crates/ironclaw_processes/**"
-  - "crates/ironclaw_process_sandbox/**"
+  - "crates/ironclaw_sandbox/**"
   - "crates/ironclaw_wasm/**"
   - "crates/ironclaw_mcp/**"
   - "crates/ironclaw_webui/**"
@@ -112,7 +112,7 @@ and the owning host-runtime/process-sandbox crates.
   filesystem as containment for a subprocess.
 - **The only real containment for an OS process is the sandbox it runs in.** Any
   deployment that authenticates more than one user MUST route process spawns through
-  the sandboxed port (`TenantSandboxProcessPort`, backed by `ironclaw_process_sandbox`)
+  the sandboxed port (`TenantSandboxProcessPort`, backed by `ironclaw_sandbox`)
   whose mount is derived from the turn scope — never through the unsandboxed
   `HostProcessPort` (renamed from `LocalHostProcessPort`, §4.4 Bucket 2 — `Host`
   names the boundary: a process run directly on the host). `HostProcessPort` /

.githooks/pre-commit

@@ -8,7 +8,7 @@ set -euo pipefail
 STAGED=$(git diff --cached --name-only)
 
 NEEDS_CHECK=false
-if echo "$STAGED" | grep -qE '^wit/|^channels-src/|^tools-src/'; then
+if echo "$STAGED" | grep -qE '^crates/ironclaw_wasm/wit/|^channels-src/|^tools-src/'; then
     NEEDS_CHECK=true
 fi
 

.github/workflows/platform-and-compat.yml

@@ -113,11 +113,16 @@ jobs:
           # and every WASM ABI check silently skips — the WS10 failure mode
           # (#6963). `crates/ironclaw_wasm_product_adapters/` was also dropped:
           # that crate no longer exists, so the alternative had been matching
-          # nothing. scripts/ci/ws12_workflow_contracts.py pins this regex
+          # nothing. The bare `wit/` alternative went the same way when the WIT
+          # directory moved inside its owning crate (CHECKLIST WS4): the ABI
+          # files are `crates/ironclaw_wasm/wit/*.wit` now, already in scope via
+          # the `ironclaw_wasm` crate alternative, which unlike a repo-root
+          # prefix survives the WS7 family move too.
+          # scripts/ci/ws12_workflow_contracts.py pins this regex
           # against the real crate inventory and against a real first-party
           # extension manifest path, so a renamed, moved or deleted crate fails
           # loudly here instead of quietly falling out of scope.
-          if has_match '^(wit/|crates/([^/]+/)*ironclaw_common/|crates/([^/]+/)*ironclaw_wasm/|crates/([^/]+/)*packages/[^/]+/(manifest\.toml|wasm-src/)|registry/|scripts/build-wasm-extensions\.sh$|scripts/check-version-bumps\.sh$|\.github/workflows/(platform-and-compat|nightly-deep-ci)\.yml$)'; then
+          if has_match '^(crates/([^/]+/)*ironclaw_common/|crates/([^/]+/)*ironclaw_wasm/|crates/([^/]+/)*packages/[^/]+/(manifest\.toml|wasm-src/)|registry/|scripts/build-wasm-extensions\.sh$|scripts/check-version-bumps\.sh$|\.github/workflows/(platform-and-compat|nightly-deep-ci)\.yml$)'; then
             has_direct_wasm_abi_risk=true
           fi
           echo "has_direct_wasm_abi_risk=$has_direct_wasm_abi_risk" >> "$GITHUB_OUTPUT"

.github/workflows/reborn-tests.yml

@@ -122,6 +122,7 @@ jobs:
           fi
 
           python3 scripts/ci/test_reborn_pr_test_plan.py
+          python3 scripts/ci/test_pre_commit_staged_paths.py
           scripts/ci/discover-reborn-package-crates.sh \
             > "${RUNNER_TEMP}/reborn-canonical-packages.json"
           plan="$(

Cargo.toml

@@ -1,5 +1,5 @@
 [workspace]
-members = [".", "crates/ironclaw_common", "crates/ironclaw_observability", "crates/ironclaw_host_api", "crates/ironclaw_host_ingress", "crates/ironclaw_libsql_runtime", "crates/ironclaw_filesystem", "crates/ironclaw_attachments", "crates/ironclaw_extractors", "crates/ironclaw_memory", "crates/extensions/packages/memory-native", "crates/extensions/packages/mem0", "crates/ironclaw_events", "crates/ironclaw_event_projections", "crates/ironclaw_event_streams", "crates/ironclaw_reborn_event_store", "crates/ironclaw_extensions", "crates/ironclaw_extension_host", "crates/ironclaw_extension_manager", "crates/ironclaw_processes", "crates/ironclaw_scripts", "crates/ironclaw_process_sandbox", "crates/ironclaw_mcp", "crates/ironclaw_wasm", "crates/ironclaw_wasm_limiter", "crates/ironclaw_capabilities", "crates/ironclaw_secrets", "crates/ironclaw_network", "crates/ironclaw_host_runtime", "crates/ironclaw_runtime_policy", "crates/ironclaw_authorization", "crates/ironclaw_approvals", "crates/ironclaw_resources", "crates/ironclaw_auth", "crates/ironclaw_trust", "crates/ironclaw_turns", "crates/ironclaw_loop_contracts", "crates/ironclaw_extension_contracts", "crates/ironclaw_product_contracts", "crates/ironclaw_agent_loop", "crates/ironclaw_threads", "crates/ironclaw_prompt_envelope", "crates/ironclaw_hooks", "crates/ironclaw_loop_host", "crates/ironclaw_runner", "crates/ironclaw_reborn_config", "crates/ironclaw_operator", "crates/ironclaw_reborn_composition", "crates/ironclaw_reborn_identity", "crates/extensions/ironclaw_extension_support", "crates/ironclaw_first_party_extension_ports", "crates/ironclaw_reborn_cli", "crates/ironclaw_reborn_traces", "crates/ironclaw_webui", "crates/ironclaw_reborn_openai_compat", "crates/ironclaw_conversations", "crates/ironclaw_product", "crates/extensions/packages/telegram", "crates/extensions/packages/slack", "crates/ironclaw_outbound", "crates/ironclaw_triggers", "crates/ironclaw_projects", "crates/ironclaw_architecture", "crates/ironclaw_safety", "crates/ironclaw_skills", "crates/ironclaw_llm", "tools/ironclaw_stress"]
+members = [".", "crates/ironclaw_common", "crates/ironclaw_observability", "crates/ironclaw_host_api", "crates/ironclaw_host_ingress", "crates/ironclaw_libsql_runtime", "crates/ironclaw_filesystem", "crates/ironclaw_attachments", "crates/ironclaw_extractors", "crates/ironclaw_memory", "crates/extensions/packages/memory-native", "crates/extensions/packages/mem0", "crates/ironclaw_events", "crates/ironclaw_event_projections", "crates/ironclaw_event_streams", "crates/ironclaw_reborn_event_store", "crates/ironclaw_extensions", "crates/ironclaw_extension_host", "crates/ironclaw_extension_manager", "crates/ironclaw_processes", "crates/ironclaw_sandbox", "crates/ironclaw_mcp", "crates/ironclaw_wasm", "crates/ironclaw_wasm_limiter", "crates/ironclaw_capabilities", "crates/ironclaw_secrets", "crates/ironclaw_network", "crates/ironclaw_host_runtime", "crates/ironclaw_runtime_policy", "crates/ironclaw_authorization", "crates/ironclaw_approvals", "crates/ironclaw_resources", "crates/ironclaw_auth", "crates/ironclaw_trust", "crates/ironclaw_turns", "crates/ironclaw_loop_contracts", "crates/ironclaw_extension_contracts", "crates/ironclaw_product_contracts", "crates/ironclaw_agent_loop", "crates/ironclaw_threads", "crates/ironclaw_prompt_envelope", "crates/ironclaw_hooks", "crates/ironclaw_loop_host", "crates/ironclaw_runner", "crates/ironclaw_reborn_config", "crates/ironclaw_operator", "crates/ironclaw_reborn_composition", "crates/ironclaw_reborn_identity", "crates/extensions/ironclaw_extension_support", "crates/ironclaw_first_party_extension_ports", "crates/ironclaw_reborn_cli", "crates/ironclaw_reborn_traces", "crates/ironclaw_webui", "crates/ironclaw_reborn_openai_compat", "crates/ironclaw_conversations", "crates/ironclaw_product", "crates/extensions/packages/telegram", "crates/extensions/packages/slack", "crates/ironclaw_outbound", "crates/ironclaw_triggers", "crates/ironclaw_projects", "crates/ironclaw_architecture", "crates/ironclaw_safety", "crates/ironclaw_skills", "crates/ironclaw_llm", "tools/ironclaw_stress"]
 default-members = ["crates/ironclaw_reborn_cli"]
 exclude = [
     "crates/ironclaw_silk_decoder",

Dockerfile

@@ -38,7 +38,6 @@ COPY crates/ crates/
 COPY tools/ironclaw_stress/ tools/ironclaw_stress/
 COPY skills/ skills/
 COPY tests/ tests/
-COPY wit/ wit/
 COPY providers.json providers.json
 RUN mkdir -p src \
     && printf 'fn main() {}\n' > src/main.rs \
@@ -68,7 +67,6 @@ COPY tools/ironclaw_stress/ tools/ironclaw_stress/
 COPY migrations/ migrations/
 COPY skills/ skills/
 COPY tests/ tests/
-COPY wit/ wit/
 COPY providers.json providers.json
 RUN mkdir -p src \
     && printf 'fn main() {}\n' > src/main.rs \

FEATURE_PARITY.md

@@ -747,7 +747,7 @@ CLAUDE.md for the full mapping + gap catalog.
 | SSRF IPv6 transition bypass block | ✅ | ❌ | Block IPv4-mapped IPv6 bypasses |
 | Cron webhook SSRF guard | ✅ | ❌ | SSRF checks on webhook delivery |
 | Loopback-first | ✅ | 🚧 | HTTP binds 0.0.0.0 |
-| Docker sandbox | ✅ | ❌ | Orchestrator/worker containers; opt-in `sandbox.docker.gpus` passthrough; Reborn defines a typed `SandboxProcessPlan` contract (`ironclaw_process_sandbox`) with plan validation only — no production execution backend is wired for it yet |
+| Docker sandbox | ✅ | ❌ | Orchestrator/worker containers; opt-in `sandbox.docker.gpus` passthrough; Reborn defines a typed `SandboxProcessPlan` contract (`ironclaw_sandbox`) with plan validation only — no production execution backend is wired for it yet |
 | Podman support | ✅ | ❌ | `--container` accepts both Docker + Podman |
 | WASM sandbox | ❌ | ✅ | IronClaw innovation |
 | Sandbox env sanitization | ✅ | 🚧 | Shell tool scrubs env vars (secret detection); Reborn process sandbox rejects sensitive raw env values in plans and uses placeholders for brokered credentials, but production secure-capture and MITM transport wiring remain partial |

crates/AGENTS.md

@@ -110,12 +110,11 @@ Boundary rule: if you need an upstream crate in a low-level crate, stop and chec
 | `ironclaw_network` | `ironclaw_network/AGENTS.md`, `ironclaw_network/CLAUDE.md`, `docs/reborn/contracts/network.md` | Network policy boundary, URL targets, resolver, hardened transport, host/provider HTTP egress. | Runtime-lane behavior above boundary or manual credential injection. |
 | `ironclaw_host_runtime` | `ironclaw_host_runtime/AGENTS.md`, `ironclaw_host_runtime/CLAUDE.md` | Host-side Reborn service composition: production services, obligations, HTTP egress, redaction, secrets/network/resource mediation. | Product workflow, runtime-specific request shapes, duplicate network/secret logic. |
 | `ironclaw_processes` | `ironclaw_processes/AGENTS.md`, `ironclaw_processes/CLAUDE.md` | Process lifecycle, cancellation, stores, status/output helpers, `ProcessHost`, wrappers. | Authorization, approval policy, runtime lane internals beyond adapter contracts. |
-| `ironclaw_scripts` | `ironclaw_scripts/AGENTS.md`, `ironclaw_scripts/CLAUDE.md` | Script runtime lane over host-mediated filesystem/events/resources/dispatcher/HTTP, Docker/backend output parsing. | Manual credentials, direct provider HTTP, duplicated dispatcher/process/resource policy. |
 | `ironclaw_mcp` | `ironclaw_mcp/AGENTS.md`, `ironclaw_mcp/CLAUDE.md` | MCP runtime lane, execution request/result types, JSON-RPC exchange, client abstraction, HTTP adapter, resource accounting. | Direct outbound networking, ad-hoc credential injection, product workflow. |
-| `ironclaw_wasm` | `ironclaw_wasm/AGENTS.md`, `ironclaw_wasm/CLAUDE.md`, `docs/reborn/contracts/wasm.md`, `wit/tool.wit` | WASM runtime lane, component/WIT bindings, folded `wasm_sandbox_core` primitives, store, host adapters, runtime config. | Privileged host effects outside mediated APIs; copied secrets/network/resource logic; product/runtime-specific dependencies inside `wasm_sandbox_core`. |
+| `ironclaw_wasm` | `ironclaw_wasm/AGENTS.md`, `ironclaw_wasm/CLAUDE.md`, `docs/reborn/contracts/wasm.md`, `ironclaw_wasm/wit/tool.wit` | WASM runtime lane, component/WIT bindings, folded `wasm_sandbox_core` primitives, store, host adapters, runtime config. | Privileged host effects outside mediated APIs; copied secrets/network/resource logic; product/runtime-specific dependencies inside `wasm_sandbox_core`. |
 | `ironclaw_wasm_limiter` | `Cargo.toml`, `src/lib.rs` | Shared `wasmtime::ResourceLimiter` for WASM tool and hook runtimes. | Product adapter workflow, policy decisions, or runtime-specific side effects beyond limiter accounting. |
 | `ironclaw_extensions` | `ironclaw_extensions/AGENTS.md`, `ironclaw_extensions/CLAUDE.md` | Declarative extension manifests (`src/v2.rs` and `src/v3.rs`; v3 is the current schema), capability descriptors, side-effect-free in-memory registry, installation records. | Execution of any kind (WASM/MCP/process), secrets, trust decisions. |
-| `ironclaw_process_sandbox` | `ironclaw_process_sandbox/CLAUDE.md` | Typed `SandboxProcessPlan` contract and validation only: install/credentialed-run phase separation in plan types. No production execution backend is wired for this capability today. | Process lifecycle/stores (`ironclaw_processes`); raw Docker flags for extensions; adding an execution backend here. |
+| `ironclaw_sandbox` | `ironclaw_sandbox/AGENTS.md`, `ironclaw_sandbox/CLAUDE.md` | The sandboxed-process lane (WS3 merge of `ironclaw_process_sandbox` + `host_runtime::sandbox_process` + `ironclaw_scripts`): typed `SandboxProcessPlan` contract and validation, the Docker/broker/credential-firewall/CA machinery behind `ironclaw_host_api::process::SandboxCommandTransport`, and the script runtime lane. Sole declarer of `bollard`/`rcgen`/`libc`. No production execution backend is wired for `system.process_sandbox.run` today. | Process lifecycle/stores (`ironclaw_processes`); raw Docker flags for extensions; dispatcher composition; manual credentials; direct provider HTTP. |
 
 ### Turns, threads, loops
 

crates/README.md

@@ -49,7 +49,7 @@ A good rule of thumb: if a change adds new authority or persistence, put it in t
 | --- | --- | --- |
 | `ironclaw_capabilities` | `ironclaw_capabilities` | Caller-facing capability invocation host. Coordinates authorization, approvals, process transitions, and neutral runtime dispatch. |
 | `ironclaw_processes` | `ironclaw_processes` | Host-tracked background process lifecycle. Owns lifecycle mechanics, not capability policy. |
-| `ironclaw_scripts` | `ironclaw_scripts` | Script/CLI capability runner contracts. Executes declared commands through a host-selected backend. |
+| `ironclaw_sandbox` | `ironclaw_sandbox` | The sandboxed-process lane: `SandboxProcessPlan` validation, the Docker/broker/credential-firewall/CA machinery behind `SandboxCommandTransport`, and the script/CLI capability runner. |
 | `ironclaw_mcp` | `ironclaw_mcp` | Adapts manifest-declared MCP tools into IronClaw capabilities without granting ambient filesystem, secret, or network authority. |
 | `ironclaw_wasm` | `ironclaw_wasm` | Reborn WASM component runtime lane. Owns component-model/WIT runtime surface plus the folded domain-free `wasm_sandbox_core` primitives. |
 | `ironclaw_wasm_limiter` | `ironclaw_wasm_limiter` | Shared `wasmtime::ResourceLimiter` used by WASM tool and hook runtimes so memory/table/instance limits do not drift. |

crates/extensions/ironclaw_extension_support/AGENTS.md

@@ -37,9 +37,32 @@
 - Deterministic tool behavior behind narrow explicit request types.
 - Scoped handles granted by host runtime or composition.
 
+## The Executor/Adapter Seam
+
+Every tool here is an **executor**, never a capability handler. That means:
+
+- It takes a request type this crate defines (`GsuiteDispatchRequest`,
+  `WebAccessDispatchRequest`, `SkillUrlFetchContext`, …) carrying only
+  contracts-layer values the host hands it per invocation — `ResourceScope`,
+  `CapabilityId`, `Arc<dyn RuntimeHttpEgress>`, `Arc<dyn RootFilesystem>`.
+- It returns this crate's own error type (`…DispatchError`,
+  `SkillManagementCapabilityError`), which carries a
+  `RuntimeDispatchErrorKind` and optionally the `ResourceUsage` burned before
+  the failure. The caller maps it.
+- The `FirstPartyCapabilityHandler` impl, the `CapabilityManifest` that declares
+  the tool, and the registry insertion live **outside** — in
+  `ironclaw_host_runtime::first_party_tools` for the always-on builtins, or in
+  the binary's `FirstPartyHandlerRegistrar` for the binary-registered ones.
+
+`ironclaw_host_runtime` and `ironclaw_extensions` are on this crate's forbidden
+list (`reborn_dependency_boundaries.rs`), so this is enforced, not a
+convention. If an executor cannot be written without one of them, the seam is
+in the wrong place — move less, not the rule.
+
 ## Do Not Move In Here
 
 - Host runtime composition, authorization, approvals, resource accounting, or capability registry wiring.
+- Capability-handler implementations or the capability manifests that declare them.
 - Loop-facing skill context ports, turn-run adapters, or Reborn composition wiring.
 - Raw secrets, network clients, dispatcher handles, or ambient host authority.