Waves 0–4 batch: WS3/WS4 consolidation + lane governor port + conversations sever + WS10 inventory keying + enforcement gates

.claude/commands/triage-prs.md

@@ -39,7 +39,7 @@ For each open PR, determine the primary module it touches by examining the `file
 | **Storage & Memory** | `crates/ironclaw_filesystem/`, `crates/ironclaw_memory*/`, `crates/ironclaw_libsql_runtime/`, `migrations/` |
 | **Security** | `crates/ironclaw_safety/`, `crates/ironclaw_secrets/`, `crates/ironclaw_trust/`, `crates/ironclaw_authorization/`, `crates/ironclaw_approvals/` |
 | **Config & Setup** | `crates/ironclaw_reborn_config/` |
-| **Sandbox & Processes** | `crates/ironclaw_process_sandbox/`, `crates/ironclaw_processes/`, `crates/ironclaw_scripts/`, `crates/ironclaw_wasm*/` |
+| **Sandbox & Processes** | `crates/ironclaw_sandbox/`, `crates/ironclaw_processes/`, `crates/ironclaw_wasm*/` |
 | **Hooks** | `crates/ironclaw_hooks/` |
 | **Events & Projections** | `crates/ironclaw_events/`, `crates/ironclaw_event_projections/`, `crates/ironclaw_event_streams/` |
 | **CI/CD & Docs** | `.github/`, `README.md`, `CLAUDE.md`, `*.md` (no src) |

.claude/rules/safety-and-sandbox.md

@@ -5,7 +5,7 @@ paths:
   - "crates/ironclaw_safety/**"
   - "crates/ironclaw_host_runtime/**"
   - "crates/ironclaw_processes/**"
-  - "crates/ironclaw_process_sandbox/**"
+  - "crates/ironclaw_sandbox/**"
   - "crates/ironclaw_wasm/**"
   - "crates/ironclaw_mcp/**"
   - "crates/ironclaw_webui/**"
@@ -112,7 +112,7 @@ and the owning host-runtime/process-sandbox crates.
   filesystem as containment for a subprocess.
 - **The only real containment for an OS process is the sandbox it runs in.** Any
   deployment that authenticates more than one user MUST route process spawns through
-  the sandboxed port (`TenantSandboxProcessPort`, backed by `ironclaw_process_sandbox`)
+  the sandboxed port (`TenantSandboxProcessPort`, backed by `ironclaw_sandbox`)
   whose mount is derived from the turn scope — never through the unsandboxed
   `HostProcessPort` (renamed from `LocalHostProcessPort`, §4.4 Bucket 2 — `Host`
   names the boundary: a process run directly on the host). `HostProcessPort` /

.githooks/pre-commit

@@ -8,7 +8,7 @@ set -euo pipefail
 STAGED=$(git diff --cached --name-only)
 
 NEEDS_CHECK=false
-if echo "$STAGED" | grep -qE '^wit/|^channels-src/|^tools-src/'; then
+if echo "$STAGED" | grep -qE '^crates/ironclaw_wasm/wit/|^channels-src/|^tools-src/'; then
     NEEDS_CHECK=true
 fi
 

.github/workflows/code_style.yml

@@ -205,24 +205,46 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
         with:
           persist-credentials: false
+      # `working-directory:` is a YAML key, not a shell command — it cannot glob
+      # or resolve a path at runtime, so the family move (crates/<family>/
+      # ironclaw_webui, PROPOSAL §5) is resolved once here through the shared
+      # crate inventory (scripts/ci/crate-dir.sh -> scripts/ci/lib/crate_tree.py)
+      # rather than left as a literal every step below would need updating.
+      # `env` populated via $GITHUB_ENV is available to a later step's
+      # `working-directory:` (docs.github.com/actions: context availability for
+      # jobs.<job_id>.steps.working-directory includes `env`), so every
+      # subsequent step in THIS job can read it back through ${{ env.* }}.
+      - name: Resolve WebUI frontend directory
+        run: |
+          set -euo pipefail
+          webui_dir="$(bash scripts/ci/crate-dir.sh ironclaw_webui)"
+          echo "WEBUI_FRONTEND_DIR=${webui_dir}/frontend" >> "$GITHUB_ENV"
       - name: Enable pnpm
         run: corepack enable pnpm
       - name: Install Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v4
         with:
           node-version: "22"
           cache: "pnpm"
-          cache-dependency-path: crates/ironclaw_webui/frontend/pnpm-lock.yaml
+          # actions/setup-node hashes this list to build the cache key
+          # (verified against the pinned commit's bundled dist/setup/index.js:
+          # `hashFiles` walks one globber built from every newline-separated
+          # pattern and only throws when the COMBINED walk finds nothing), so
+          # the flat line stays live for today's tree and the nested line picks
+          # up the family move without either one needing to be conditional.
+          cache-dependency-path: |
+            crates/ironclaw_webui/frontend/pnpm-lock.yaml
+            crates/*/ironclaw_webui/frontend/pnpm-lock.yaml
       # `no-undef` over WebUI v2 JavaScript catches production modules that reference a
       # symbol they never imported. The VM-based component suites stub
       # every collaborator through a `vm` context, so that class of bug (e.g. an
       # htm `${Component}` used without an import) passes the unit tests and only
       # surfaces at runtime — this is the gate the eval harness cannot provide.
       - name: Install WebUI v2 frontend deps
-        working-directory: crates/ironclaw_webui/frontend
+        working-directory: ${{ env.WEBUI_FRONTEND_DIR }}
         run: pnpm install --frozen-lockfile
       - name: Lint WebUI v2 JS
-        working-directory: crates/ironclaw_webui/frontend
+        working-directory: ${{ env.WEBUI_FRONTEND_DIR }}
         run: pnpm lint
       # The full vitest suite (chat, extensions, telegram/slack panels, gate
       # routing, channels tab, configure modal — the vm-tsx harness) previously
@@ -231,14 +253,14 @@ jobs:
       # vm-tsx setup file is declared in vite.config.ts setupFiles; no extra
       # CI configuration beyond node + pnpm is needed.
       - name: WebUI v2 frontend tests (vitest)
-        working-directory: crates/ironclaw_webui/frontend
+        working-directory: ${{ env.WEBUI_FRONTEND_DIR }}
         run: pnpm test
       # The SPA build is embedded into the serve binary at compile time through
       # Cargo's OUT_DIR (see ironclaw_webui/build.rs), so a frontend that lints
       # and tests but does not build still breaks downstream binary builds.
       # Keep the build in the same job so the three gates travel together.
       - name: Build WebUI v2 frontend
-        working-directory: crates/ironclaw_webui/frontend
+        working-directory: ${{ env.WEBUI_FRONTEND_DIR }}
         run: pnpm build
 
   clippy:
@@ -270,14 +292,20 @@ jobs:
         with:
           node-version: "22"
           cache: "pnpm"
-          cache-dependency-path: crates/ironclaw_webui/frontend/pnpm-lock.yaml
+          # See the webui-v2-js-lint job above for why this is a depth-tolerant
+          # glob list rather than a single literal.
+          cache-dependency-path: |
+            crates/ironclaw_webui/frontend/pnpm-lock.yaml
+            crates/*/ironclaw_webui/frontend/pnpm-lock.yaml
       - name: Enable pnpm
         if: contains(matrix.flags, '--all-features')
         run: corepack enable pnpm
       - name: Install WebUI frontend dependencies
         if: contains(matrix.flags, '--all-features')
         run: |
-          cd crates/ironclaw_webui/frontend
+          set -euo pipefail
+          webui_dir="$(bash scripts/ci/crate-dir.sh ironclaw_webui)"
+          cd "${webui_dir}/frontend"
           pnpm install --frozen-lockfile
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
@@ -338,14 +366,20 @@ jobs:
         with:
           node-version: "22"
           cache: "pnpm"
-          cache-dependency-path: crates/ironclaw_webui/frontend/pnpm-lock.yaml
+          # See the webui-v2-js-lint job above for why this is a depth-tolerant
+          # glob list rather than a single literal.
+          cache-dependency-path: |
+            crates/ironclaw_webui/frontend/pnpm-lock.yaml
+            crates/*/ironclaw_webui/frontend/pnpm-lock.yaml
       - name: Enable pnpm
         if: contains(matrix.flags, '--all-features')
         run: corepack enable pnpm
       - name: Install WebUI frontend dependencies
         if: contains(matrix.flags, '--all-features')
         run: |
-          cd crates/ironclaw_webui/frontend
+          set -euo pipefail
+          webui_dir="$(bash scripts/ci/crate-dir.sh ironclaw_webui)"
+          cd "${webui_dir}/frontend"
           pnpm install --frozen-lockfile
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:

.github/workflows/coverage.yml

@@ -160,7 +160,16 @@ jobs:
         with:
           node-version: "22"
           cache: "pnpm"
-          cache-dependency-path: crates/ironclaw_webui/frontend/pnpm-lock.yaml
+          # actions/setup-node hashes this list to build the cache key
+          # (verified against the pinned commit's bundled dist/setup/index.js:
+          # `hashFiles` walks one globber built from every newline-separated
+          # pattern and only throws when the COMBINED walk finds nothing), so
+          # the flat line stays live for today's tree and the nested line picks
+          # up the family move (crates/<family>/ironclaw_webui, PROPOSAL §5)
+          # without either one needing to be conditional.
+          cache-dependency-path: |
+            crates/ironclaw_webui/frontend/pnpm-lock.yaml
+            crates/*/ironclaw_webui/frontend/pnpm-lock.yaml
 
       - name: Enable pnpm
         if: contains(matrix.flags, '--all-features')
@@ -169,7 +178,9 @@ jobs:
       - name: Install WebUI frontend dependencies
         if: contains(matrix.flags, '--all-features')
         run: |
-          cd crates/ironclaw_webui/frontend
+          set -euo pipefail
+          webui_dir="$(bash scripts/ci/crate-dir.sh ironclaw_webui)"
+          cd "${webui_dir}/frontend"
           pnpm install --frozen-lockfile
 
       - name: Generate coverage
@@ -238,14 +249,25 @@ jobs:
         with:
           node-version: "22"
           cache: "pnpm"
-          cache-dependency-path: crates/ironclaw_webui/frontend/pnpm-lock.yaml
+          # actions/setup-node hashes this list to build the cache key
+          # (verified against the pinned commit's bundled dist/setup/index.js:
+          # `hashFiles` walks one globber built from every newline-separated
+          # pattern and only throws when the COMBINED walk finds nothing), so
+          # the flat line stays live for today's tree and the nested line picks
+          # up the family move (crates/<family>/ironclaw_webui, PROPOSAL §5)
+          # without either one needing to be conditional.
+          cache-dependency-path: |
+            crates/ironclaw_webui/frontend/pnpm-lock.yaml
+            crates/*/ironclaw_webui/frontend/pnpm-lock.yaml
 
       - name: Enable pnpm
         run: corepack enable pnpm
 
       - name: Install WebUI frontend dependencies
         run: |
-          cd crates/ironclaw_webui/frontend
+          set -euo pipefail
+          webui_dir="$(bash scripts/ci/crate-dir.sh ironclaw_webui)"
+          cd "${webui_dir}/frontend"
           pnpm install --frozen-lockfile
 
       # Pre-build the reborn binary under the same llvm-cov env so the E2E

.github/workflows/docker.yml

@@ -79,11 +79,21 @@ jobs:
       - name: Extract version from the ironclaw CLI Cargo.toml
         id: version
         run: |
+          set -euo pipefail
           # The shipped image is the Reborn CLI (`ironclaw`), so the release
           # version is that package's version — NOT the root workspace manifest,
           # which is the test-only `ironclaw_reborn_integration_tests` package
           # pinned at 0.1.0 since Tier B deleted the v1 monolith.
-          VERSION=$(grep '^version' crates/ironclaw_reborn_cli/Cargo.toml | head -1 | sed 's/.*"\(.*\)"/\1/')
+          #
+          # Resolved through the shared crate inventory (scripts/ci/crate-dir.sh)
+          # rather than the flat `crates/ironclaw_reborn_cli` literal, so this
+          # step needs no edit when the crate moves into a family directory
+          # (PROPOSAL §5). If resolution ever fails, `set -e` aborts here before
+          # `grep` runs against an empty/garbage path — belt-and-suspenders with
+          # the version-format guard immediately below, which already catches
+          # an empty VERSION either way.
+          reborn_cli_dir="$(bash scripts/ci/crate-dir.sh ironclaw_reborn_cli)"
+          VERSION=$(grep '^version' "${reborn_cli_dir}/Cargo.toml" | head -1 | sed 's/.*"\(.*\)"/\1/')
           if [[ ! "${VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
             echo "::error::Extracted version '${VERSION}' must match MAJOR.MINOR.PATCH[-prerelease] (Docker tags forbid '+')"
             exit 1

.github/workflows/ironclaw-stress.yml

@@ -264,7 +264,9 @@ jobs:
 
       - name: Install WebUI frontend dependencies
         run: |
-          cd crates/ironclaw_webui/frontend
+          set -euo pipefail
+          webui_dir="$(bash scripts/ci/crate-dir.sh ironclaw_webui)"
+          cd "${webui_dir}/frontend"
           pnpm install --frozen-lockfile
 
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2

.github/workflows/nightly-deep-ci.yml

@@ -116,10 +116,21 @@ jobs:
         # Targets the dispatch routing logic itself. Keep this pointed at a file
         # with real mutable statements — a pure `pub use` re-export file yields
         # zero mutants and makes this step silently vacuous.
-        run: >-
-          scripts/mutation-audit.sh
-          -p ironclaw_capabilities
-          crates/ironclaw_capabilities/src/dispatch.rs
+        #
+        # The crate directory is resolved through the shared inventory
+        # (scripts/ci/crate-dir.sh) rather than the flat `crates/
+        # ironclaw_capabilities` literal, so this step needs no edit when the
+        # crate moves into a family directory (PROPOSAL §5) — a stale literal
+        # here used to be a SILENT failure: cargo-mutants would match zero
+        # mutants under a path that no longer exists and report a clean run
+        # over code it never read. `set -e` aborts here if resolution itself
+        # fails; scripts/mutation-audit.sh's own file-existence guard is the
+        # second layer, catching dispatch.rs being renamed within a crate that
+        # still resolves.
+        run: |
+          set -euo pipefail
+          capabilities_dir="$(bash scripts/ci/crate-dir.sh ironclaw_capabilities)"
+          scripts/mutation-audit.sh -p ironclaw_capabilities "${capabilities_dir}/src/dispatch.rs"
       - name: Upload mutation triage queue
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

.github/workflows/platform-and-compat.yml

@@ -113,11 +113,16 @@ jobs:
           # and every WASM ABI check silently skips — the WS10 failure mode
           # (#6963). `crates/ironclaw_wasm_product_adapters/` was also dropped:
           # that crate no longer exists, so the alternative had been matching
-          # nothing. scripts/ci/ws12_workflow_contracts.py pins this regex
+          # nothing. The bare `wit/` alternative went the same way when the WIT
+          # directory moved inside its owning crate (CHECKLIST WS4): the ABI
+          # files are `crates/ironclaw_wasm/wit/*.wit` now, already in scope via
+          # the `ironclaw_wasm` crate alternative, which unlike a repo-root
+          # prefix survives the WS7 family move too.
+          # scripts/ci/ws12_workflow_contracts.py pins this regex
           # against the real crate inventory and against a real first-party
           # extension manifest path, so a renamed, moved or deleted crate fails
           # loudly here instead of quietly falling out of scope.
-          if has_match '^(wit/|crates/([^/]+/)*ironclaw_common/|crates/([^/]+/)*ironclaw_wasm/|crates/([^/]+/)*packages/[^/]+/(manifest\.toml|wasm-src/)|registry/|scripts/build-wasm-extensions\.sh$|scripts/check-version-bumps\.sh$|\.github/workflows/(platform-and-compat|nightly-deep-ci)\.yml$)'; then
+          if has_match '^(crates/([^/]+/)*ironclaw_common/|crates/([^/]+/)*ironclaw_wasm/|crates/([^/]+/)*packages/[^/]+/(manifest\.toml|wasm-src/)|registry/|scripts/build-wasm-extensions\.sh$|scripts/check-version-bumps\.sh$|\.github/workflows/(platform-and-compat|nightly-deep-ci)\.yml$)'; then
             has_direct_wasm_abi_risk=true
           fi
           echo "has_direct_wasm_abi_risk=$has_direct_wasm_abi_risk" >> "$GITHUB_OUTPUT"
@@ -264,12 +269,16 @@ jobs:
         with:
           node-version: "22"
           cache: "pnpm"
-          cache-dependency-path: crates/ironclaw_webui/frontend/pnpm-lock.yaml
+          cache-dependency-path: |
+            crates/ironclaw_webui/frontend/pnpm-lock.yaml
+            crates/*/ironclaw_webui/frontend/pnpm-lock.yaml
       - name: Enable pnpm
         run: corepack enable pnpm
       - name: Install WebUI frontend dependencies
         run: |
-          cd crates/ironclaw_webui/frontend
+          set -euo pipefail
+          webui_dir="$(bash scripts/ci/crate-dir.sh ironclaw_webui)"
+          cd "${webui_dir}/frontend"
           pnpm install --frozen-lockfile
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
@@ -310,12 +319,16 @@ jobs:
         with:
           node-version: "22"
           cache: "pnpm"
-          cache-dependency-path: crates/ironclaw_webui/frontend/pnpm-lock.yaml
+          cache-dependency-path: |
+            crates/ironclaw_webui/frontend/pnpm-lock.yaml
+            crates/*/ironclaw_webui/frontend/pnpm-lock.yaml
       - name: Enable pnpm
         run: corepack enable pnpm
       - name: Install WebUI frontend dependencies
         run: |
-          cd crates/ironclaw_webui/frontend
+          set -euo pipefail
+          webui_dir="$(bash scripts/ci/crate-dir.sh ironclaw_webui)"
+          cd "${webui_dir}/frontend"
           pnpm install --frozen-lockfile
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:

.github/workflows/reborn-e2e.yml

@@ -203,7 +203,16 @@ jobs:
         with:
           node-version: "24"
           cache: "pnpm"
-          cache-dependency-path: crates/ironclaw_webui/frontend/pnpm-lock.yaml
+          # actions/setup-node hashes this list to build the cache key
+          # (verified against the pinned commit's bundled dist/setup/index.js:
+          # `hashFiles` walks one globber built from every newline-separated
+          # pattern and only throws when the COMBINED walk finds nothing), so
+          # the flat line stays live for today's tree and the nested line picks
+          # up the family move (crates/<family>/ironclaw_webui, PROPOSAL §5)
+          # without either one needing to be conditional.
+          cache-dependency-path: |
+            crates/ironclaw_webui/frontend/pnpm-lock.yaml
+            crates/*/ironclaw_webui/frontend/pnpm-lock.yaml
 
       - name: Enable pnpm
         run: corepack enable pnpm
@@ -213,7 +222,9 @@ jobs:
 
       - name: Install WebUI frontend dependencies
         run: |
-          cd crates/ironclaw_webui/frontend
+          set -euo pipefail
+          webui_dir="$(bash scripts/ci/crate-dir.sh ironclaw_webui)"
+          cd "${webui_dir}/frontend"
           pnpm install --frozen-lockfile
 
       - name: Install Python

.github/workflows/reborn-playwright.yml

@@ -51,14 +51,25 @@ jobs:
         with:
           node-version: "22"
           cache: "pnpm"
-          cache-dependency-path: crates/ironclaw_webui/frontend/pnpm-lock.yaml
+          # actions/setup-node hashes this list to build the cache key
+          # (verified against the pinned commit's bundled dist/setup/index.js:
+          # `hashFiles` walks one globber built from every newline-separated
+          # pattern and only throws when the COMBINED walk finds nothing), so
+          # the flat line stays live for today's tree and the nested line picks
+          # up the family move (crates/<family>/ironclaw_webui, PROPOSAL §5)
+          # without either one needing to be conditional.
+          cache-dependency-path: |
+            crates/ironclaw_webui/frontend/pnpm-lock.yaml
+            crates/*/ironclaw_webui/frontend/pnpm-lock.yaml
 
       - name: Enable pnpm
         run: corepack enable pnpm
 
       - name: Install WebUI frontend dependencies
         run: |
-          cd crates/ironclaw_webui/frontend
+          set -euo pipefail
+          webui_dir="$(bash scripts/ci/crate-dir.sh ironclaw_webui)"
+          cd "${webui_dir}/frontend"
           pnpm install --frozen-lockfile
 
       - name: Restore Rust cache