Waves 0–4 batch 2: register to zero, adapter-registry move, ruled decisions (accumulating the fleet)

crates/AGENTS.md

@@ -167,7 +167,7 @@ Boundary rule: if you need an upstream crate in a low-level crate, stop and chec
 - Hooks and prompt context: `ironclaw_hooks` for hook registration/dispatch/failure policy; `ironclaw_prompt_envelope` for model-visible untrusted or trust-labeled snippet wrapping.
 - Reborn runtime execution: lane crate (`scripts`, `mcp`, `wasm`) first; `ironclaw_capabilities` for the authorized dispatch path; `host_runtime` for secrets/network/resources/redaction; `processes` for background lifecycle; `ironclaw_wasm_limiter` only for shared limiter mechanics.
 - Reborn turns/agent loop: `ironclaw_turns` for turn coordination; `ironclaw_agent_loop` for strategy/planner/executor contracts; `ironclaw_loop_host` for host support ports.
-- Product adapter flow: `ironclaw_product` contracts and `adapter_registry` manifest projection -> `ironclaw_product` orchestration -> concrete adapter crate.
+- Product adapter flow: `ironclaw_extension_contracts::product_adapter_section` (the `[product_adapter.*]` schema) -> `ironclaw_extensions::host_api::product_adapter` (host-API manifest contract + resolved projection) -> `ironclaw_product` orchestration -> concrete adapter crate.
 - Reborn binary/composition: `ironclaw_reborn_config` for boot config; `ironclaw_reborn_composition` for production wiring; the `ironclaw_reborn_cli/` directory (package `ironclaw`) for commands; `ironclaw_runner` for standalone adapters/driver registry; `ironclaw_webui` for host-owned WebChat v2 listener lifecycle.
 - Model/provider behavior: `ironclaw_llm`; do not leak provider auth/cache/retry concerns into engine or product orchestration.
 - UI presentation: `ironclaw_webui` owns the Reborn WebChat route surface, Vite SPA, serving, and auth. It is the only UI surface — the v1 TUI and gateway crates are gone.

crates/extensions/ironclaw_extension_support/Cargo.toml

@@ -11,7 +11,21 @@ repository = "https://github.com/nearai/ironclaw"
 publish = false
 
 [package.metadata.ironclaw]
-layer = "loops"
+# `runtimes`, not `loops` (WS3, 2026-08-04). The executor/adapter seam this
+# crate was re-chartered around in WS3 makes the *kernel* a designed consumer:
+# a tool arrives here as an executor and leaves its `FirstPartyCapabilityHandler`
+# in `ironclaw_host_runtime`, so `host_runtime -> extension_support` is
+# structural, not transitional. A crate the kernel is designed to call cannot
+# sit two rungs above it. `runtimes` is the least demotion that legalizes that
+# consumer, it matches this crate's own §8.2 posture (mediated services arrive
+# by injection; kernel ✗ — the same cell the wasm/mcp/sandbox lanes carry), and
+# it costs zero same-layer edges, where `substrates` would hide six of this
+# crate's seven dependencies from the layer matrix. Ceiling checked both ways:
+# every normal dependency and every domain this crate's charter names
+# (memory, traces, triggers) is `substrates` or `contracts`; every consumer is
+# `kernel` or above. Consumer set frozen by the `DowngradePin` in
+# `reborn_same_layer_edge_inventory.rs`.
+layer = "runtimes"
 
 [dependencies]
 async-trait = "0.1"

crates/ironclaw_approvals/Cargo.toml

@@ -21,6 +21,14 @@ ironclaw_authorization = { path = "../ironclaw_authorization" }
 ironclaw_events = { path = "../ironclaw_events" }
 ironclaw_filesystem = { path = "../ironclaw_filesystem" }
 ironclaw_host_api = { path = "../ironclaw_host_api" }
+# Both arrived with the profile approval gate evicted from the composition root
+# (WS6). The gate implements `ironclaw_authorization`'s
+# `TrustAwareCapabilityDispatchAuthorizer`, whose signature names
+# `ironclaw_trust::TrustDecision`, and it consumes the `MinimalApprovalBypass`
+# classification `ironclaw_runtime_policy` owns (§4.4: the one place that
+# classification lives). Both are inventoried same-layer kernel edges.
+ironclaw_runtime_policy = { path = "../ironclaw_runtime_policy" }
+ironclaw_trust = { path = "../ironclaw_trust" }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 thiserror = "2"

crates/ironclaw_approvals/src/lib.rs

@@ -9,6 +9,8 @@ mod auto_approve;
 mod capability_permission;
 mod cas_record;
 mod policy;
+mod profile_gate;
+mod profile_gate_policy;
 
 #[cfg(any(test, feature = "test-support"))]
 pub mod test_support;
@@ -53,6 +55,15 @@ pub use policy::{
     PersistentApprovalPolicyStorePort, PersistentApprovalScope,
     permission_mode_allows_persistent_approval, persistent_approval_grant_issuer,
 };
+#[cfg(any(test, feature = "test-support"))]
+pub use profile_gate::EmptyApprovalSettingsProvider;
+pub use profile_gate::{
+    ApprovalSettingsProvider, OriginGateRequirement, ProfileApprovalGatePolicy,
+    profile_approval_authorizer,
+};
+pub use profile_gate_policy::{
+    RuntimeProfileApprovalGateEffectSets, RuntimeProfileApprovalGatePolicy,
+};
 
 pub type ToolPermissionOverride = CapabilityPermissionOverride;
 pub type ToolPermissionOverrideInput = CapabilityPermissionOverrideInput;

crates/ironclaw_reborn_composition/src/profile_approval_authorization.rs → crates/ironclaw_approvals/src/profile_gate.rs

@@ -1,7 +1,7 @@
 use std::{borrow::Cow, sync::Arc};
 
+use crate::{ToolPermissionOverride, permission_mode_allows_persistent_approval};
 use async_trait::async_trait;
-use ironclaw_approvals::{ToolPermissionOverride, permission_mode_allows_persistent_approval};
 use ironclaw_authorization::{GrantAuthorizer, TrustAwareCapabilityDispatchAuthorizer};
 use ironclaw_host_api::{
     Timestamp,
@@ -36,7 +36,7 @@ use ironclaw_trust::TrustDecision;
 /// Class-B modulation (tool overrides, leases, auto-approve, always-allow) stays
 /// entirely between the two tiers, exactly as for the effect gates it mirrors.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum OriginGateRequirement {
+pub enum OriginGateRequirement {
     /// The origin may not invoke this capability at all — a hard deny
     /// (fail-closed), not suppressible by any class-B grant/lease or by the
     /// Minimal (yolo) approval bypass.
@@ -60,7 +60,7 @@ pub(crate) enum OriginGateRequirement {
     None,
 }
 
-pub(crate) trait ProfileApprovalGatePolicy: Send + Sync {
+pub trait ProfileApprovalGatePolicy: Send + Sync {
     fn capability_exempt_from_approval(&self, _capability: &CapabilityId) -> bool {
         false
     }
@@ -119,7 +119,7 @@ pub(crate) trait ProfileApprovalGatePolicy: Send + Sync {
 /// decision allows the candidate so settings apply without process restart
 /// while non-runnable candidates do not spend approval-store reads.
 #[async_trait]
-pub(crate) trait ApprovalSettingsProvider: Send + Sync {
+pub trait ApprovalSettingsProvider: Send + Sync {
     async fn tool_override(
         &self,
         scope: &ResourceScope,
@@ -137,12 +137,17 @@ pub(crate) trait ApprovalSettingsProvider: Send + Sync {
 }
 
 /// No stored overrides and global auto-approve off: the gate behaves exactly as
-/// it did before #4959. Test-only — production wires
+/// it did before #4959. Test-only — production wires composition's
 /// `StoreApprovalSettingsProvider`.
-#[cfg(test)]
-pub(crate) struct EmptyApprovalSettingsProvider;
-
-#[cfg(test)]
+///
+/// Gated on `test-support` rather than `cfg(test)` because composition's own
+/// capability-host tests drive the gate through this double; the crate-local
+/// `cfg(test)` form it carried inside composition is unreachable across a crate
+/// boundary.
+#[cfg(any(test, feature = "test-support"))]
+pub struct EmptyApprovalSettingsProvider;
+
+#[cfg(any(test, feature = "test-support"))]
 #[async_trait]
 impl ApprovalSettingsProvider for EmptyApprovalSettingsProvider {
     async fn tool_override(
@@ -167,7 +172,7 @@ impl ApprovalSettingsProvider for EmptyApprovalSettingsProvider {
     }
 }
 
-pub(crate) fn profile_approval_authorizer(
+pub fn profile_approval_authorizer(
     approval_policy: ApprovalPolicy,
     gate_policy: Arc<dyn ProfileApprovalGatePolicy>,
     settings: Arc<dyn ApprovalSettingsProvider>,
@@ -509,7 +514,7 @@ fn approval_request(
 
 #[cfg(test)]
 mod tests {
-    use ironclaw_approvals::persistent_approval_grant_issuer;
+    use crate::persistent_approval_grant_issuer;
     use ironclaw_host_api::{
         action::NetworkPolicy,
         capability::{
@@ -1424,7 +1429,7 @@ mod tests {
         use ironclaw_runtime_policy::MinimalApprovalBypass;
 
         use super::*;
-        use crate::runtime_profile_approval_policy::{
+        use crate::profile_gate_policy::{
             RuntimeProfileApprovalGateEffectSets, RuntimeProfileApprovalGatePolicy,
         };
 

crates/ironclaw_reborn_composition/src/runtime_profile_approval_policy.rs → crates/ironclaw_approvals/src/profile_gate_policy.rs

@@ -6,16 +6,16 @@ use ironclaw_host_api::{
 };
 use ironclaw_runtime_policy::MinimalApprovalBypass;
 
-use crate::profile_approval_authorization::{OriginGateRequirement, ProfileApprovalGatePolicy};
+use crate::profile_gate::{OriginGateRequirement, ProfileApprovalGatePolicy};
 
 #[derive(Debug, Clone)]
-pub(crate) struct RuntimeProfileApprovalGateEffectSets {
-    pub(crate) ask_writes: Vec<EffectKind>,
-    pub(crate) ask_destructive: Vec<EffectKind>,
+pub struct RuntimeProfileApprovalGateEffectSets {
+    pub ask_writes: Vec<EffectKind>,
+    pub ask_destructive: Vec<EffectKind>,
 }
 
 impl RuntimeProfileApprovalGateEffectSets {
-    pub(crate) fn new(ask_writes: Vec<EffectKind>, ask_destructive: Vec<EffectKind>) -> Self {
+    pub fn new(ask_writes: Vec<EffectKind>, ask_destructive: Vec<EffectKind>) -> Self {
         Self {
             ask_writes,
             ask_destructive,
@@ -24,7 +24,7 @@ impl RuntimeProfileApprovalGateEffectSets {
 }
 
 #[derive(Debug, Clone)]
-pub(crate) struct RuntimeProfileApprovalGatePolicy {
+pub struct RuntimeProfileApprovalGatePolicy {
     /// Whether `ApprovalPolicy::Minimal` may bypass effect gates, as a
     /// resolved policy *value* — not a deployment profile this type then asks
     /// about itself (§4.4). `ironclaw_runtime_policy::minimal_approval_bypass`
@@ -35,7 +35,7 @@ pub(crate) struct RuntimeProfileApprovalGatePolicy {
 }
 
 impl RuntimeProfileApprovalGatePolicy {
-    pub(crate) fn new(
+    pub fn new(
         minimal_bypass: MinimalApprovalBypass,
         effects: RuntimeProfileApprovalGateEffectSets,
     ) -> Self {
@@ -46,10 +46,7 @@ impl RuntimeProfileApprovalGatePolicy {
         }
     }
 
-    pub(crate) fn with_exempt_capabilities(
-        mut self,
-        exempt_capabilities: Vec<CapabilityId>,
-    ) -> Self {
+    pub fn with_exempt_capabilities(mut self, exempt_capabilities: Vec<CapabilityId>) -> Self {
         self.exempt_capabilities = exempt_capabilities;
         self
     }

crates/ironclaw_architecture/tests/reborn_composition_boundaries.rs

@@ -201,6 +201,82 @@ fn composition_public_pub_use_surface_matches_snapshot() {
     );
 }
 
+/// CHECKLIST WS6 asks that the re-export wall be reduced *to a documented
+/// snapshot* — "every survivor names consumer + enforcing test". The snapshot
+/// half is pinned above; this is the documentation half.
+///
+/// Every top-level `pub use` in composition's `lib.rs` must carry a
+/// `// consumer: … · pinned by: …` line in the comment block directly above it
+/// (above any `#[cfg(…)]` attributes, which is also where the snapshot
+/// extractor expects them, so annotating never perturbs the snapshot).
+///
+/// The rule this enforces: a re-export earns its place only when the consumer
+/// cannot reach the symbol at its owning crate. Without the annotation, a wall
+/// entry is indistinguishable from an accident, which is how the previous 52
+/// entries accumulated 17 with no consumer at all.
+#[test]
+fn composition_public_pub_use_entries_name_their_consumer() {
+    let lib = std::fs::read_to_string(composition_src_path().join("lib.rs"))
+        .expect("composition lib.rs readable");
+    let lines: Vec<&str> = lib.lines().collect();
+
+    let mut undocumented = Vec::new();
+    let mut documented = 0usize;
+    let mut in_pub_use = false;
+    for (index, line) in lines.iter().enumerate() {
+        if in_pub_use {
+            if line.trim_start().contains(';') {
+                in_pub_use = false;
+            }
+            continue;
+        }
+        if !line.starts_with("pub use") {
+            continue;
+        }
+        if !line.trim_start().contains(';') {
+            in_pub_use = true;
+        }
+
+        // Walk back over the contiguous attribute / comment block above the
+        // entry looking for the annotation.
+        let mut cursor = index;
+        let mut annotated = false;
+        while cursor > 0 {
+            let above = lines[cursor - 1].trim_start();
+            let is_block = above.starts_with("#[")
+                || above.starts_with("//")
+                || above.starts_with("///")
+                || above.starts_with("]");
+            if !is_block {
+                break;
+            }
+            if above.starts_with("// consumer:") && above.contains("pinned by:") {
+                annotated = true;
+            }
+            cursor -= 1;
+        }
+        if annotated {
+            documented += 1;
+        } else {
+            undocumented.push(format!("lib.rs:{}: {}", index + 1, line));
+        }
+    }
+
+    assert!(
+        documented > 0,
+        "the annotation scan found no documented entries at all — the scan is broken, \
+         not the wall"
+    );
+    assert!(
+        undocumented.is_empty(),
+        "every public `pub use` in the composition root must name its consumer and the \
+         test that pins it, as a `// consumer: <who> · pinned by: <test>` line above the \
+         entry (above any `#[cfg]`). A re-export whose consumer can reach the symbol at \
+         its owning crate should be deleted, not annotated. Undocumented entries:\n{}",
+        undocumented.join("\n")
+    );
+}
+
 #[test]
 fn extension_host_cluster_stays_internal() {
     let lib = std::fs::read_to_string(composition_src_path().join("lib.rs"))