WS6: evict the policy cluster from composition; sever product→loop_host by BenKurrek · Pull Request #7190 · nearai/ironclaw

BenKurrek · 2026-08-04T22:16:41Z

Stacked on #7170 (ws/waves-0-4-batch). Cut from 89080c516; review the top three commits only.

CHECKLIST WS6 composition-evictions, the policy half of the "Still owed" list. Two evictions land, two clauses are refused with measurements rather than forced, and the composition mass gate is re-ratcheted at wave close.

Composition production LOC 45,127 → 42,688 (−2,439).

1. Approval/authorization policy → `ironclaw_approvals` (`16be4d362`)

profile_approval_authorization.rs (1,844) → approvals/src/profile_gate.rs, runtime_profile_approval_policy.rs (334) → approvals/src/profile_gate_policy.rs. git mv; no content edits beyond import repointing and visibility.

Why approvals and not authorization: §6.5.2 says ironclaw_authorization may never do "approvals resolution" — which is precisely this module's subject (origin-gate matrix folding against effect gates, with tool overrides / leases / auto-approve / always-allow modulating between the two tiers). It was a leaf inside composition — zero crate:: imports in production — so it moved with no churn.

Deliberately not moved, each with a reason:

builtin_capability_policy.rs — pinned in place: reborn_composition_boundaries.rs hard-asserts mod builtin_capability_policy; stays at composition's crate root.
capability_authorization.rs — StoreApprovalSettingsProvider is an adapter over composition-selected durable stores plus a TTL/single-flight cache, and it reads builtin_capability_policy, which cannot leave.
runtime/approval.rs — depends on product/extensions/extension_host.
production_runtime_policy.rs — a smart constructor over composition's own error type. runtime_policy needed nothing.

Cost, stated not hidden: ironclaw_approvals takes two new same-layer kernel edges (→ trust, → runtime_policy) and SAME_LAYER_EDGE_BASELINE rises 72 → 74 — the only growth that number has taken. Neither is avoidable at the destination: the gate implements TrustAwareCapabilityDispatchAuthorizer, whose signature names ironclaw_trust::TrustDecision, and it consumes MinimalApprovalBypass, which §4.4 pins to ironclaw_runtime_policy. Both rows are inventoried with rationale; the kernel family already carries twelve such edges (capabilities and host_runtime hold six each).

2. Fire-time trigger-access policy → `ironclaw_triggers` (`4d7c62f91`)

Zero new dependency edges, in either direction. Split by what each piece is:

Moved to ironclaw_triggers::fire_access — decisions about a persisted trigger's own stored scope, no backend behind them: the check contract (TriggerFireAccessCheck/Decision/Error/Checker, previously declared in composition's runtime_input.rs), StaticOwnerTriggerFireChecker (including the load-bearing tenant_id bound — the due-trigger repository is global, so owner+scope alone could authorize a foreign tenant's trigger), and CompositeTriggerFireChecker (including "unavailable beats denied", so a transient identity-store fault stays retryable).

Stayed in composition: TriggerFireAccessPolicy/Grant (the deployment grant — §6.10.1's Keeps list names config-as-data as composition's charter) and IdentityMembershipTriggerFireChecker (a lookup against a backend composition selects; moving it would buy triggers a dependency on the identity crate for one get_user).

To stop the halves drifting, the deny reason and exact-scope rule are exported once and called by the composition-side checker rather than restated — a second copy of the deny string is how two checkers diverge.

3. Two clauses refused, with measurements (`b941678dd`)

Trusted-submit → triggers/conversations — STOPPED, not attempted. automation/trigger_poller_trusted_submit.rs is 2,268 lines of which only ~470 are production. That surface writes the transcript (record_trigger_prompt), so it needs ironclaw_threads plus one ironclaw_product helper. ironclaw_conversations is refused by its own crate doc — "It is not the transcript. ironclaw_threads owns canonical threads and their message content … Keep it that way" — and it holds no ironclaw_threads dependency today. ironclaw_triggers is refused by cost: four or five new same-layer substrates edges to host an adapter that is composition-shaped. This clause needs a destination decision (a different owner, or the materializer inverted behind a port the way #7159 did for the coordinator handle), not an eviction.

All five trusted-submit security gates are green and UNMODIFIED: untrusted_ingress_paths_cannot_submit_host_trusted_inbound, conversation_trusted_trigger_submitter_stays_conversation_or_composition_owned, ..._stays_out_of_root_exports, conversation_trusted_trigger_classifier_stays_out_of_root_exports, trusted_trigger_submit_request_minting_stays_worker_owned.

product → loop_host sever — the recorded count is wrong and hides a seam. WS1's row says "three production import sites". Measured here: five production files across three seams, and the third is recorded nowhere.

Seam	Sites	Status
Input-queue enqueue — `HostInputEnqueuePort`, `RejectingInputEnqueue`, `EnqueueQueuedMessageRequest`, `HostInputQueueError`, `HostInputEnvelope` (all from `loop_host/src/input_queue.rs`)	`reborn_services.rs:68`, `steering.rs:24`, `inbound_turn.rs:25,27` + 3 test files	Unrecorded. `RebornServices` holds an `Arc<dyn HostInputEnqueuePort>` and steering calls it — a port inversion, not a move
Synthetic capability — six `SyntheticCapability*`	`project_create_capability.rs:16`	Recorded
Attachment read — `LoopAttachmentReadPort`/`Error`	`scoped_fs/attachment_reader.rs:23`	Recorded; already documented immovable to `ironclaw_attachments`

Also refuted: §6.4.11's destination for the project-create capability is unreachable as written. ironclaw_projects is layer = "substrates" and ironclaw_loop_host is loops, so projects → loop_host is upward and matrix-illegal. The reachable owner is ironclaw_first_party_extension_ports (loops, already depends on loop_host, already hosts the exact sibling skill_activation_capability.rs) — and only after ProjectService leaves ironclaw_product, since fpep → product is upward too. That makes it a two-step, not a file move.

So the manifest dep cannot be dropped by any wave that moves only the two recorded sites, and this PR did not attempt it. All three seams are design changes.

4. Re-ratchet

loc_ceiling, loc_observed, and COMPOSITION_ABSOLUTE_SRC_LOC → 42,688, measured with check-composition-budget.sh --print on the post-eviction tree, not derived by subtracting the diff. The absolute gate now prints no NUDGE. Siblings are shrinking composition too — a numeric conflict here is expected and trivial: take the lower number, then re-measure on the merged tree.

Two NUDGEs remain, deliberately not actioned because neither slack is this PR's to bank: ceiling_bp (17.80pp) is the share metric whose poisoned denominator that same file documents and whose ~17.4pp slack predates this branch (tracked by CHECKLIST WS0); arc_dyn_ceiling sat 263 below its ceiling at the base commit, so lowering it would lock in mostly other people's headroom and collide with every sibling shrinking composition.

Verification

Run verbatim on the final tree.

Un-masking — every touched crate, full unfiltered suites, before/after --list rosters:

Crate	Before	After	Delta	Accounting
`ironclaw_reborn_composition`	957	918	−39	−33 approval gate, −6 trigger access
`ironclaw_approvals`	85	118	+33	exactly the 33 that left composition
`ironclaw_triggers`	169	175	+6	exactly the 6 that left composition

Leaf names identical on both sides, zero unclassified, no surviving assertion edited.

cargo test -p ironclaw_reborn_composition --all-features   # 35 binaries, 916 passed, 0 failed
cargo test -p ironclaw_approvals          --all-features   # 118 passed, 0 failed
cargo test -p ironclaw_triggers           --all-features   # 175 passed, 0 failed
cargo test -p ironclaw_architecture       --all-features   # 37 binaries, 259 passed, 0 failed
cargo test -p ironclaw_reborn_integration_tests --features integration
cargo clippy -p ironclaw_triggers -p ironclaw_reborn_composition \
             -p ironclaw_approvals -p ironclaw_architecture \
             --all-targets --all-features -- -D warnings    # clean
cargo check --workspace --all-features --all-targets        # clean
cargo fmt --all
bash scripts/ci/check-composition-budget.sh                 # OK, no absolute NUDGE

Integration suite: green except backend_parity_replies_to_greeting::case_3, which fails at harness construction with StorageMode::Postgres requires a reachable Docker daemon — no Docker on this host. Environmental, test unmodified, unrelated to this diff. The trigger and approval integration suites are unmodified and green.

One honest note about local runs. An earlier pass of these same suites produced up to 15 spurious runtime::tests::* failures on a tree already verified green. The cause was the host filling its root filesystem to 117 MiB free; those tests exercise on-disk filesystem backends and time out when writes cannot land. After reclaiming space every suite is green, and the counts above are exact (531 → 525 = −6 across the trigger commit). Recorded rather than quietly re-run, because "it passed the second time" is how a real failure gets buried.

One drive-by fix: a pre-existing -D warnings clippy break inherited from the batch base (reborn_extension_specificity.rs — a blank line between two doc-comment blocks on WS0_EXTENSION_SPECIFICITY_ALLOWLIST_BASELINE). Untouched by these evictions, but it made a clean clippy run impossible.

Docs ticked/annotated only on this PR's own clauses, dated and measured (CHECKLIST WS6 + the WS1 product → loop_host row; PROPOSAL §2.3 + §6.10.1). CHECKLIST adjacency conflicts with siblings are expected.

🤖 Generated with Claude Code

…contract (WS3) Deletes the two `-> ironclaw_extensions` layer-matrix exceptions (`ironclaw_mcp`, `ironclaw_scripts`) by giving the runtimes-layer lanes a contracts home for the descriptors they read, instead of the registry crate they may not depend on. Exceptions 13 -> 11; baseline lowered in the same change. Moved to `ironclaw_extension_contracts`: - `runtime::{ExtensionRuntime, ExtensionAssetPath, ExtensionAssetPathError}` - `hosted_mcp::{HostedMcpDiscoveredTool, HostedMcpDiscoveredToolAnnotations}` `ExtensionPackage`/`ExtensionManifest` deliberately stay in `ironclaw_extensions`: they carry the whole parsed manifest tree and a `PackageRootBinding` typed on `ironclaw_filesystem::VirtualPath`, which the §11.2.3 contracts-purity allowlist (`{ironclaw_host_api}` only) forbids the contracts crate from naming. Measured instead: both lanes read exactly three things off the package — `id`, `capabilities`, `manifest.runtime` — so the lane request structs now take those three and the caller (which owns the package) projects them. Also repointed `ResourceReceipt` to its real owner: `ironclaw_resources` only re-exports `ironclaw_host_api::resource::ResourceReceipt`, so the lanes' import was a §11.2.4 two-import-paths hop, not a dependency. No `pub use` shims (§11.3): every consumer is repointed in this change, and `resolve_under` becomes the free function `ironclaw_extensions::resolve_asset_under` because the orphan rule forbids an inherent impl on the moved type. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Creates `ironclaw_sandbox` (runtimes) from the three halves of "run an already-authorized command away from the host", and deletes the two crates PROPOSAL §6.6.4 marks for merge: - `ironclaw_process_sandbox` (plan contract) -> `src/plan.rs`, `src/validation.rs` - `ironclaw_host_runtime::sandbox_process` -> `src/sandbox_process/**` - `ironclaw_scripts` (script lane + Docker path) -> `src/script.rs` The kernel sheds the Docker/CA cone: `bollard`, `rcgen`, `x509-parser` and `time` are gone from `ironclaw_host_runtime`'s manifest, and `bollard`/`rcgen` are now declared by exactly one crate in the workspace. Two migration details PROPOSAL §6.6.4 and CHECKLIST WS10 call load-bearing: - `PROCESS_SANDBOX_CAPABILITY_ID` -> `ironclaw_host_api::capability`, so `ironclaw_loop_host` drops its lane dependency (production dep gone; a dev-dep remains for the tests that build plans). - `SandboxCommandTransport` -> `ironclaw_host_api::process`, with the shapes it names (`CommandExecutionRequest`/`Output`, `RuntimeProcessError`, `SavedCommandOutput`, `SavedCommandOutputSanitization`). Without this the runtimes-layer lane could not implement what the kernel consumes. Enumerating gates were repointed, never relaxed: the specificity carve-outs and the struct/test-support ratchet entries moved with their files (both baselines unchanged at 129 and their prior values), the panic-gate baseline row moved, `reborn-crate-test-buckets.sh` registers the new crate, and the three `reborn-e2e-rust.sh` script selectors follow the tests (plus `docker_security`, which had no selector before). One gate would have gone silently vacuous and was fixed rather than moved: the script-lane surface scan in `reborn_dependency_boundaries.rs` read a hardcoded `src/lib.rs`, which after the merge no longer holds the lane. It now scans the whole crate source tree with a fatal-read walk and a non-vacuity assertion. One deletion, recorded: `RebornScopedSandboxCommandTransport::into_process_port` returned a kernel type a runtimes crate may not name. It had zero callers workspace-wide; the kernel wraps the transport, which is the direction the port inversion requires. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…ence Three dated amendments, each quoting the text it replaces: 1. CHECKLIST WS3 sandbox row + PROPOSAL §6.6.4 — "all pieces currently unwired/test-only" is REFUTED. Three production paths cross the merged crate (spawn-path plan validation, the process_executor routing check, and the saved-command-output scope digest). The accurate claim is narrower: no production *execution backend*. Behavior preservation is therefore argued at the diff (11 of 26 moved files byte-identical, 9 more differing by one import line, +63/-36 overall), not inferred from deadness. 2. CHECKLIST WS3 mcp row + PROPOSAL §6.6.3 — the prior wave's "structurally blocked" finding is half right, and the wrong half is load-bearing: only `ExtensionPackage` is un-absorbable, and no lane ever needed it (both read `id`, `capabilities`, `manifest.runtime` and nothing else). The registry half of the flip is done; the `resources` half is refuted as phrased — the estimate/usage vocabulary the row asks about is already in `host_api::resource` and already imported from there, while the real blocker is the `ResourceGovernor` authority port and `ResourceError`'s denial cone. 3. Recorded as a structural finding, not a note: the sandbox row and the mcp row are ONE problem. `ironclaw_scripts` imports the identical DTO set, so the merge alone deletes zero exceptions and only the mcp carve-out lets either lane shed the registry edge. Also reconciled: PROPOSAL §6.1.2's as-built inventory gains the two modules WS3 landed (and states why `ExtensionPackage` stayed); §2's package count 66 -> 65; the §9 disposition rows for `ironclaw_scripts`/`ironclaw_process_sandbox`/ `ironclaw_mcp`; the §11.2.2 ratchet rows (13 -> 11); the WS3 verify row; the stale WS1.3 sentence asserting the blocker as settled fact; and `reborn_restructure_baselines.rs`'s doc table, which still read 15. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

`process_port.rs` no longer names `MountView` or `thiserror::Error` (both went to `host_api::process` with the types that used them), and `sandbox_process.rs` no longer needs `sync::Arc` after `into_process_port` was deleted. Found by per-crate `clippy --all-targets --all-features -D warnings`. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…tions Three fail-closed gaps in `reborn_pr_test_plan.py`, all hit by this PR and all live on `main` today — any PR with the same change shape is unplannable. 1. `.claude/**` was unclassified, so the planner refused outright. It is agent guidance in exactly the sense `docs/**` is human guidance: no Rust test reads either as data (the only in-tree references are prose citations in test doc comments). Added to `IGNORED_PREFIXES`. Without this, "guidance travels with the change" — the restructure's own discipline — cannot be satisfied in a single PR. 2. `crates/AGENTS.md`, `crates/README.md`, `crates/Architecture.md` raised "unmapped crate path": they sit under `crates/` but belong to no package. Now classified as crate-tree prose, matched by "Markdown no package directory owns" so a genuinely unmapped crate path is unaffected. 3. An unmapped crate path used to raise. `git diff` reports a deleted crate's old paths and CI feeds the planner that diff, so **every crate deletion or rename was unplannable** — including the six deletions PROPOSAL §2 plans. It now widens to the exhaustive plan. This is a semantic change and it is the safe direction: the full plan is a superset of any narrowing, so an unattributable path can never cause under-selection, whereas refusing to plan blocks the PR instead of protecting it. Malformed input is still rejected by the unclassified-path branch. Each lands with fixtures per WS10's rule, positive and negative: guidance paths select nothing while non-guidance paths still fail closed; crate-tree prose selects nothing while crate *code* under the same unmapped directory widens to `full` (so the Markdown carve-out cannot swallow code). The pre-existing `test_unmapped_crate_path_fails_fast` is renamed and rewritten to pin the new contract rather than deleted. Verified against this PR's real 130-path diff: the planner returns `mode: full`, and the workflow's own exhaustiveness guard passes on that output. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

… a wave Review (#7065) caught that both surviving `-> ironclaw_resources` exceptions declared `removes_in = "WS3"` — the wave this PR *is*, which does not remove them. That is precisely the defect §11.2.2 already records against `conversations -> turns` ("`removes_in = "WS5"` and WS5 has partly shipped without it falling"), and it would have been repeated here. Both now point at issue #7067, which owns the design work that actually clears them: replacing the `ResourceGovernor` dependency with a narrow reserve/reconcile/release port. The issue carries the measurements — 3 of 10 methods used, zero implementors, and the `ResourceError` denial cone — plus the two open questions (error shape, port home) that make it a design slice rather than a move. An owning issue is also what §11.2.2 asks for and what the ratchet still cannot enforce (there is no `owning_issue` field yet), so this is the strongest form currently expressible. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…on_contracts `validate_asset_path` moved here with `ExtensionAssetPath`, the type it constructs. In `ironclaw_extensions` it was only ever reached indirectly through manifest parsing, so its six rejection branches had no direct test — and a contracts crate that carries validation owes that validation one. Two tests: every reject branch with its exact reason and `Display` output (empty, NUL/control, URL, absolute, Windows drive and backslash, and the empty/`.`/`..` segment cases) plus the manifest-relative shapes that must keep being accepted; and `ExtensionRuntime::kind()` over all five variants, since that projection is what every lane uses to reject a runtime it does not serve. Also removes a changed-line coverage risk this PR would otherwise carry into the merge queue: the gate does not run on ordinary PRs (#7036), so ~100 newly-added lines of validator would first be measured where a failure is expensive to diagnose. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…andbox lane `RATCHET FAIL: ironclaw_host_runtime` — observed 18854 covered vs a `floor_covered_lines` of 20538. This is the shrinkage case the ratchet's own "To fix" text describes, not a coverage regression: `sandbox_process/**` moved to `ironclaw_sandbox`, so the crate's denominator fell 23277 -> 21267 (-2010 instrumented lines) and its covered lines fell with it. The percentage floor is **raised, not lowered**: observed 88.65% against an old floor of 88.23%, so the entry now reads 88.65. Only the absolute line count moves down, and it must — those lines are no longer in this crate. To keep that from being a net loss of protection, `ironclaw_sandbox` is floored on arrival at its observed 87.09% (3185 / 3657). This is a net *increase* in ratchet coverage: neither `ironclaw_scripts` nor `ironclaw_process_sandbox` was ever floored, and the `sandbox_process` half was protected only as part of host_runtime's line count, which this PR necessarily reduces. Floored crates 16 -> 17. Verified by replaying the ratchet arithmetic against CI's observed numbers: both crates pass on percentage and on covered lines. Numbers taken from the failing run's own report (job 91740733521), which is the authority for this gate. The `Tests (Reborn)` roll-up failed solely on this sub-job ("coverage-report result 'failure' did not match planned=true"); no other lane failed — 50 pass, 2 fail, both this root cause and its roll-up. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…itive gate WS3 hit a gate no move row had named. `tests/integration/coverage-floor.toml` is keyed on crate identity plus absolute covered-line counts, so it is invisible to WS10's path-keyed gate audit and yet it fails on every crate move, merge, rename, or family `git mv` that shifts instrumented lines between crates — as it did here, while the percentage floor was *improving*. Recorded on WS10 with the three rules WS7 will need: re-capture in the same PR, raise the percentage floor rather than leaving it, and floor the destination crate or the move silently drops that code out of the ratchet. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Brings in #6780 (ironhub deep-link register/install + the REBORN_COV_COLLECT hermetic-env allowlist fix), #7050, and #7033. Two conflicts, both resolved as a union with each side's contribution verified present afterwards: - `crates/ironclaw_extension_host/src/available_extension_import.rs` — main added `use ironclaw_extension_contracts::recipe::VendorAuthRecipe;` at the same import position this branch added `use ironclaw_extension_contracts::runtime::ExtensionAssetPath;`. Both kept. - `scripts/ci/test_reborn_pr_test_plan.py` — main added `test_selected_integration_lane_keeps_msrv_override` and kept `test_unmapped_crate_path_fails_fast`; this branch had replaced the latter with `test_unmapped_crate_path_widens_instead_of_refusing`. Resolution keeps main's new test verbatim and this branch's rewrite, and drops the superseded original — it asserts the exact behavior this branch deliberately changed (an unmapped crate path now widens instead of refusing, so crate deletions are plannable). Keeping both would have been contradictory, not a union. 37 tests pass (36 here + main's 1). Post-merge verification of both sides: exceptions 11 with baseline 11 and `ironclaw_scripts` absent from the matrix (this branch); 9 #7033 decision markers and the `REBORN_COV_COLLECT` allowlist entry present (main). Note on the coverage floors this branch re-captured: #6780's fix stops the hermetic env filter stripping `REBORN_COV_COLLECT`, which gates *whether* a lane collects coverage. This branch's numbers were captured on a `full` plan, where every lane collects either way, so they are expected to hold — CI re-measures and will say so. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…Path A semantic conflict the merge could not see: #6780 landed `ironhub/{package,catalog}.rs` importing `ExtensionAssetPath` from `ironclaw_extensions`, while this branch moved that type to `ironclaw_extension_contracts::runtime`. Different files, so git auto-merged cleanly and the breakage surfaced only at `cargo check`. Repointed both sites to the contracts crate (no shim, per §11.3). The manifest already named `ironclaw_extension_contracts`, so this is imports only. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…gate The changed-lines coverage gate went red on four files while changed-line coverage was 95.35% against a 90% floor: the failure was its two fail-closed STRUCTURAL assertions, not any percentage. Every line below was derived by replaying scripts/ci/reborn_changed_coverage.py against this PR's own merged lcov (run 30831658659) with the base lcov the gate itself resolved (run 30828540055 @ b89fcd3), until the replay reproduced the CI verdict byte-identically. Line numbers come from the gate's own `candidate_lines - mechanically_uninstrumentable_lines()`, not from the log. - host_api/src/process.rs (31 lines): new placement-neutral process vocabulary with no function body anywhere in the file; rustc emits no LCOV record for it at all. Same shape already exempted for product_contracts/loop_contracts. - extension_contracts/src/hosted_mcp.rs (12): field declarations of the two new tools/list descriptor structs. The file is plainly instrumented (191 DA, 164 hit), so this is a no-region artifact, not an instrumentation gap. - host_runtime/src/services/runtime_adapters.rs (13): continuation lines of three rewritten calls, all PROVEN EXECUTING by their region-start heads (lines 380/434/977 score 24/16/63 hits). The four genuinely-uncovered lines in the same rewrite are deliberately NOT exempted -- the gate already subtracts them as pre-existing debt inherited from base. - composition capability_host_tests/approval_gates.rs (6): type positions in a test double whose body region scores 1 hit. The last one is a finding, not just a waiver: that file is 100% test code behind `#[cfg(test)] mod capability_host_tests;`, but the gate's test_only_path() recognises /tests/, /test_support/, */tests.rs and *_tests.rs and NOT a cfg(test) module DIRECTORY, so it measures it as production. It is the only such directory in crates/ today. Docs (target-architecture, same PR per the docs-truth rule): - CHECKLIST WS10 gains the changed-lines gate beside the ratchet row, cross- referencing the WS2.1 note rather than restating it: percentages are not what fail a move; derive lines by byte-identical replay (--fetch-base-coverage silently degrades without --github-repo); and a stranded exemption path is an ABORT with no verdict, not a loud failure. - CHECKLIST WS10 exception-ratchet row: the constant was cited at :4063 and sits at :4164 -- corrected by removing the line pin, since the file is edited every wave. Records that the baseline is a UNION across parallel WS3 lanes. - families/contracts.md: records extension_contracts' new ownership of the runtime descriptor vocabulary -- the carve-out that let BOTH lanes drop the registry edge -- and the orphan-rule seam that keeps resolve_asset_under in the registry crate. - families/lanes.md: two "Never" claims were reading as satisfied when they are not. ironclaw_mcp's "never depends on the resource-governor crate directly" is refuted (the compiled edge survives; #7067 tracks the narrow port), and ironclaw_sandbox's "no direct process spawning outside the transport seam" is aspirational -- script.rs:454 still builds Command::new("docker"). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…tion cost Two review findings verified against the tree; three refuted with evidence in the PR threads. Valid — the sandbox wiring inventory was self-contradictory. `CLAUDE.md` said "Two production call paths ... and both are plan validation" directly above a list of THREE bullets, and `lib.rs` omitted the third entirely. The third is real and is not validation: `host_runtime/src/process_output.rs:482` derives the scoped saved-output directory through `RebornSandboxScopeKey::from_scope`. That inventory is what tells a future agent which paths are live, so an undercount invites deleting a production path as dead code. Both surfaces now say three and no longer claim they are all plan validation (the `loop_host` capability-id comparison never was either). Valid, and recorded rather than redesigned — the registry carve-out cost a type-level invariant. Replacing `package: &ExtensionPackage` with independent `extension` / `capabilities` / `runtime` borrows is what deleted the `mcp -> extensions` and `scripts -> extensions` exceptions, but it also means the type no longer guarantees the three came from one package. `execute_extension_json` re-checks the descriptor half (`descriptor.provider == extension`); the runtime half cannot be re-derived, because nothing in an `&ExtensionRuntime` names its owning extension. No caller can trip it today -- there is exactly one production caller (`runtime_adapters`) and it projects all three from one package in one expression -- so this is a latent structural weakening, not a live defect. Restoring the compile-time binding needs a sealed projection minted by the package owner; a check inside the lane cannot express it, and re-taking the registry edge would undo the carve-out. Both request types now carry the caller obligation in their field docs. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…pport (WS3) WS3's first-party-tools row, family 1 of 6: skill management / URL install. `skill_url_install.rs` and its `bundle`/`github`/`zip_bundle` submodules, plus the install-input normalizer, move out of `ironclaw_host_runtime::first_party_tools` into `ironclaw_extension_support::skills::{url_install, resolve_install_input}`, where the skill executor half already lived. Move-only: no behavior change, no test edited for content. `ironclaw_host_runtime -> ironclaw_skills` is deleted from LAYER_MATRIX_EXCEPTIONS — the edge is gone, not waived (exceptions 13 -> 12, WS0_LAYER_MATRIX_EXCEPTION_BASELINE drops with it). `ironclaw_skills` and `zip` survive as dev-dependencies for host_runtime's own tests; dev edges are outside the matrix by construction. Two doc ambiguities are resolved in the same diff, as dated PROPOSAL amendments quoting the text they replace: - §6.8.4's "the builtin first-party tool handlers absorbed from host_runtime/first_party_tools" contradicted §8.2's "kernel: ✗ (ports only)" row and the enforced BoundaryRule. Resolution: the seam splits executor from adapter — the executor moves behind a neutral request/error pair, the FirstPartyCapabilityHandler / CapabilityManifest / registry wiring stay host-side. Same shape the groupware and web-access tools already ship. - §8.2's "ports only" cell now says what it means: contracts-layer ports the kernel also consumes, not permission to name a kernel trait. Two cost corrections recorded for the remaining families: `host_runtime -> extension_support` is not divisible family-by-family (mod.rs holds it via `extension_support::coding`), and `host_runtime -> ironclaw_extensions` is not reachable by this row at all. PATH_TERM_COLLISIONS shrinks by two: the installer's github carve-outs now sit inside a scan-exempt crate. Test accounting (un-masking discipline), unfiltered `--list` over both crates: 1398 -> 1398, with exactly two tests renamed by module path and none lost. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…nothing Review asked why the migrated docker_security test can pass with no daemon. The skip is pre-existing (the file differs from its pre-merge original by one import line); WS3 only enrolled it in the required Rust e2e lane, where it was not run at all before. The real defect the question surfaced is worse and also pre-existing: this crate's tests/support/docker_gate.rs states that IRONCLAW_REQUIRE_DOCKER_TESTS=1 makes a missing daemon a hard failure and that "CI sets this" -- and nothing sets it. Repo-wide the name occurs only in docker_gate.rs and attribution_tests.rs, here and on main. So every real-Docker test in the crate skips-and-passes everywhere, which is exactly the gap the gate's own comment says let sandbox security bugs ship unnoticed. docker_security.rs additionally open-codes its own check rather than using the gate, so it would stay fail-open even once something did set the variable. Recorded rather than fixed: setting the variable is a CI-behavior change that would hard-fail any lane without a daemon or the ironclaw-worker image, which is not verifiable from inside a move PR whose evidence claim is behavior preservation. Filed as the #6945 guardrail-claim-vs-reality class with the two-part fix stated. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

The crate's CLAUDE.md said "first-party runtime tools belong under `first_party_tools/`" without saying that only the host half does. WS3 moves each tool's executor into `ironclaw_extension_support`, which may not name this crate, so the rule now names both halves and points at the skill-install family as the worked example. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

The moved executor returns `SkillManagementCapabilityError`, and routing it through `skill_management_error` would have added a `debug!` line to a path that had none before the move. A move-only change must not add one, so the install-input arm maps the kind directly and the `dispatch` arm keeps the record it already had. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…move The ratchet does not run on `pull_request` (`reborn_pr_test_plan.py:21`; issue #7036), so this PR's green checks were not evidence on this axis. A full-plan `workflow_dispatch` run on this exact head reported: RATCHET FAIL: ironclaw_host_runtime observed: 88.59% (20485 / 23124 lines) floor: 88.23% ... floor_covered_lines: 20538 (effective floor 20518) The percentage went UP while `floor_covered_lines` went DOWN — shedding well-covered code lowers the absolute numerator, which is a separate assertion from the percentage one. Re-captured to the observed numbers (floor raised 88.23 -> 88.59, not merely held). Verified locally against that run's own merged lcov artifact: ENFORCING mode, 17 PASS / 0 FAIL, exit 0. run: https://github.com/nearai/ironclaw/actions/runs/30858257594 head: e07b3b0 The destination crate is deliberately not floored, because it cannot be: every crate under `crates/extensions/` is invisible to the coverage tooling — `reborn_coverage_lcov.py:19`'s CRATE_RE still requires a crate directory directly under `crates/`, which #7037's colocation broke. Filed as #7083 with the measurement; the global floor is left alone rather than re-captured onto that hole. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CHECKLIST WS4 + WS10 `wit/` rows. `wit/{tool,channel}.wit` moves from the repo root to `crates/ironclaw_wasm/wit/` — the crate that owns the ABI — per PROPOSAL §6.6.1. Behavior-free: same bytes, same generated bindings. Wave-3 coordinates: the docs write the destination as `crates/lanes/ironclaw_wasm/wit/`, but `crates/lanes/` does not exist until WS7. Because the files now sit *inside* the crate, the WS7 family move carries them with no further path edit anywhere — which is the whole point of putting them there. Ten wit-bindgen `path:` args repointed (the host plus nine guests: six under `crates/extensions/packages/*/wasm-src/`, three under `test-tools/*/wasm-src/` — the CHECKLIST row said six). All nine guests verified building against the moved WIT on wasm32-wasip2. The four `include_str!` readers of the ABI text do NOT get repointed literals. Doing that would turn the two `ironclaw_host_runtime` sites from repo-root reach-ins into *cross-crate* ones — §11.2.7's strict class, the one WS2 turns into hard failures — taking the scan from 19 to 21 while ticking a box that says "§11.2.7 scan passes". Instead the ABI text gets one owner, `ironclaw_wasm::TOOL_WIT` (`src/config.rs`, beside `WIT_TOOL_VERSION`), and all four sites read the const over cargo edges that already exist. Measured with the scan: 133 -> 129 escaping sites, cross-crate 19 -> 19, zero `wit/` entries remaining. Path-keyed gates repointed: `scripts/check-version-bumps.sh` (both ABI paths), `.githooks/pre-commit`, and `platform-and-compat.yml`'s `has_direct_wasm_abi_risk` filter — where the bare `wit/` alternative is *deleted* rather than rewritten, because the filter's existing `crates/([^/]+/)*ironclaw_wasm/` alternative already matches both the Wave-3 and the WS7 location. `scripts/ci/ws12_workflow_contracts.py` anchored on that deleted string, so its anchor moves to `build-wasm-extensions` and its in-scope probe now pins both locations. `Dockerfile` loses two `COPY wit/ wit/` lines in the planner and builder stages: both already run `COPY crates/ crates/`, so the files arrive with the crate and the old line would COPY a path that no longer exists. Docs: the WS4 row's `crates/lanes/wit/` destination was the only doc site placing the directory beside the crate rather than inside it; corrected there and in README's tree, with dated amendments in CHECKLIST, PROPOSAL §6.6.1 and PLAN Wave 3 recording what the move found. Test accounting (unfiltered `--list`, name-by-name, quiescent tree): ironclaw_wasm 51 -> 51, ironclaw_host_runtime 1246 -> 1246, ironclaw_architecture 198 -> 198. Zero diff, no test edited for content. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Forced by the previous commit, not incidental to it. `scripts/ci/check-wasm-artifact-freshness.py` keys each package's committed `wasm/<name>.wasm` to a digest of the `wasm-src/` tree that produced it, so editing a guest's `wit_bindgen::generate!` `path:` — which the `wit/` move requires in all six shipped guests — invalidates the recorded digest and fails the gate. The gate's own contract forbids the shortcut: "Re-record only after `./scripts/build-wasm-extensions.sh --first-party` and committing the rebuilt artifact — the digest asserts a claim about the artifact, and updating it without rebuilding launders a stale one." So the artifacts are genuinely rebuilt (`--first-party`, exit 0, 6 OK / 2 host-native SKIP), not re-recorded in place. Byte sizes move by more than the source change accounts for because these builds are not reproducible by design — the guests pin no toolchain and resolve their own `Cargo.lock` at build time, which is the documented reason the gate hashes sources rather than artifact bytes. Verified: `check-wasm-artifact-freshness.py` OK (6 packages), and `cargo test -p ironclaw_extension_support` green (102/46/4) — that crate `include_bytes!`s these artifacts, so it exercises the rebuilt components. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

… edits The `wit/` move had to rebuild six shipped WASM binaries because `check-wasm-artifact-freshness.py` digests each guest's whole `wasm-src/` tree. WS7 hits the same wall from the other direction: the six package guests reach the ABI across two trees, so moving either `ironclaw_wasm` or `extensions/packages` rewrites all six `path:` literals and forces the same rebuild. Recorded on CHECKLIST WS10's `wit/` row (point 6), on the loud-path-pattern row that owns the WS7 repoint (also corrected six -> nine guests there), and on PLAN's Wave 5 block with the cheap mitigation: move the two crates in one PR and pay it once. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

# Conflicts: # docs/reborn/target-architecture/CHECKLIST.md

Reconciles this lane with #7064, which landed the parallel WS3/WS4 runner sheds and edited the same coordination files. Five conflicts, all in shared coordination surfaces — no code move in this PR was altered (all 117 PR-only files are byte-identical to the pre-merge tip; the 5 apparent diffs are deletions absent on both sides). - `reborn_dependency_boundaries.rs`: the array auto-merged to the union of both sides' removals; only `WS0_LAYER_MATRIX_EXCEPTION_BASELINE` conflicted. Recomputed as `len()` of the merged list — 13 base, minus #7064's three (`hooks -> wasm_limiter`, `runner -> agent_loop`, `runner -> loop_host`) and this PR's three (`mcp -> extensions`, `scripts -> extensions`, `scripts -> resources`), plus this PR's justified `ironclaw_sandbox -> ironclaw_resources` = **8**. Counted by parsing only the entries between the const and its closing `];`, so the struct definition and the four test fixtures are excluded. - `loop_host/Cargo.toml`: both sides added a `[dev-dependencies]` line; kept both (`http` from main, `ironclaw_sandbox` from this PR). - `CHECKLIST.md`: kept both dated amendments in date order — #7064's `13 -> 10` and this PR's, with its count corrected from the authored-in-isolation `11` to the merged `8` exactly as the §11.2.2 row instructs. Also kept this PR's two new coverage-gate rows beside main's amended loud-inventory row. - `reborn_pr_test_plan.py`: both sides made the same `.claude/` fix; took main's landed wording (`startswith` makes tuple order irrelevant). - `test_reborn_pr_test_plan.py`: union of both sides' new tests, no name collisions — 46 tests pass. Also repointed the one PR-authored `changed-coverage-exemptions.toml` entry the merge shifted: `hosted_mcp.rs` moved +1 because main added a doc-comment line, so its line-keyed exemption now resolves to byte-identical source lines. The other stale entries in that manifest are inherited and already stale on main; left untouched. Verified: architecture suite 206 passed / 0 failed, `cargo check --all-targets` clean, `cargo fmt` a no-op, zero conflict markers, and both sides' `coverage-floor.toml` recaptures intact (runner 82.53 from #7064; host_runtime 88.65 and the new ironclaw_sandbox 87.09 from this PR). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Reconciles this lane with #7064, which landed the parallel WS3/WS4 runner sheds and edited the same coordination files. One conflict: `WS0_LAYER_MATRIX_EXCEPTION_BASELINE` in `reborn_dependency_boundaries.rs`. The array itself auto-merged to the union of both sides' removals — #7064's three (`hooks -> wasm_limiter`, `runner -> agent_loop`, `runner -> loop_host`) and this PR's one (`host_runtime -> skills`). Recomputed the constant as `len()` of the merged list: main is at 10, so this slice takes it to **9**. Counted by parsing only the entries between the const and its closing `];`, which excludes the struct definition and the four test fixtures. This slice was authored off 13 and computed `13 -> 12` in isolation; the ratchet narrative and the two doc rows that quoted that figure (PLAN's "First-party tools" bullet and CHECKLIST's W7-progress row) now read `10 -> 9` and record why, per the union rule on the CHECKLIST §11.2.2 row. The edge deleted is unchanged; only the total moved. Everything else auto-merged and was verified rather than assumed: both sides' `coverage-floor.toml` recaptures are intact (runner 82.53 and the new `ironclaw_loop_host` 90.89 from #7064; `host_runtime` 88.59 from this PR), and both sides' dated amendments survive in CHECKLIST, PROPOSAL and PLAN. All 14 PR-only files are byte-identical to the pre-merge tip, so no code move was altered. Verified: architecture suite 206 passed / 0 failed, `cargo check --all-targets` clean, `cargo fmt` a no-op, zero conflict markers, and the changed-coverage manifest validates with no exemption stranded or shifted by this merge. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

`Detect Reborn test scope` exits 1 on any pull request whose diff holds a path `reborn_pr_test_plan.py` has no rule for, which made this PR unmergeable: it must edit `Dockerfile` (the moved directory's `COPY wit/ wit/` no longer resolves) and `scripts/check-version-bumps.sh` (the ABI gate would otherwise grep dead paths and silently stop enforcing). 18 of its 46 paths were unclassified. Same class as the `.claude/` gap #7064 fixed, and classified the same way — one rule per class, recorded beside the constant: * `Dockerfile` / `.dockerignore` — `platform-and-compat.yml` keys `has_docker_risk` off exactly this pair and owns the image build. * `.githooks/**` — Code Style triggers on the tree and lints its contents (`test-ci-comm-locale-pin.sh`); no Reborn lane runs a hook. * `scripts/{build-wasm-extensions,check-version-bumps}.sh` — `platform-and-compat.yml`'s `has_direct_wasm_abi_risk` classifier both scopes and runs them. * markdown owned by no crate (`crates/AGENTS.md`, `test-tools/README.md`) — prose, like `docs/` and `.claude/`. A crate-resident doc still selects its own crate's lane. The first-party extension package assets are deliberately NOT ignored. `crates/extensions/packages/*/wasm/*.wasm` is a shipped artifact that `ironclaw_extension_support` embeds with `include_bytes!`, and `test-tools/*/manifest.toml` is `include_str!`d by `ironclaw_extension_host`. Calling either prose would convert today's loud failure into a silent under-schedule of a change to production output — the WS10 failure mode. `EMBEDDED_ASSET_OWNERS` routes each tree to the crate that compiles it instead, so this PR now additionally schedules `ironclaw_extension_{support,host,manager}`: the crates that consume the six rebuilt WASM artifacts. Also fixes #7085 in a file this PR already touches. The WIT version extractors used the GNU-only BRE `\+`, so on BSD sed (macOS) they matched nothing, and because the `WIT_TOOL_VERSION` cross-check is guarded on a non-empty version the hook printed "All version checks passed" having compared nothing. `[[:space:]][[:space:]]*` is identical under GNU sed, so the enforced Linux CI lane is unchanged; verified on BSD sed that both `wit/tool.wit` (0.3.0) and `wit/channel.wit` (0.3.1) now extract. Regression tests: every classified class gets a case in `test_reborn_pr_test_plan.py`, including the paired assertion that the embedded assets *select a lane* rather than merely being accepted (the inverse of the `.claude/` prose test), and a staleness pin that fails if an asset tree or its owning crate moves. All ten new cases fail against the planner on `main`. `test_unclassified_build_input_fails_fast` moves off `Dockerfile` onto a still-undecided input so the fail-closed arm stays exercised. Refs #7087, #7085 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…ners (WS3) `crates/ironclaw_host_runtime/src/obligations.rs` was 3,122 lines fusing the three owners PROPOSAL §6.5.9 charters separately, held apart only by an `// arch-exempt: large_file` waiver. It is now one module per owner: - `obligations::handler` — which obligations apply and what each does before/after dispatch, plus the audit/redaction/ceiling/mount validation. - `obligations::staged_handoffs` — material staged for a later consumer: the runtime-secret and network-policy stores and the credential-account resolver port. - `obligations::process_store` — post-start handoff discard and reservation reconciliation. - `obligations::mod` — only `BuiltinObligationServices`, the assembly seam, and deliberately the one place naming all three at once. Every module is under the 1,500-line gate, so the waiver is deleted rather than carried forward: re-fusing the owners now trips `pre-commit-safety.sh`. `mod obligations;` stays private and the crate's `pub use obligations::{…}` names are unchanged, so no consumer outside the crate sees this. Behavior-free. Cross-owner access is `pub(super)` (three methods), not `pub(crate)`. The split revealed one narrowing in the other direction: `secret_present` was `pub(crate)` with no caller outside its own file and is now private. Also from the same CHECKLIST row, the bounded half of "shrink `services/builder.rs` toward composition-facing factories": three builder methods whose only callers are inside the crate's `src` narrow to `pub(crate)`. The rest of that clause is measured and deferred in the CHECKLIST amendment — 17 methods need a `test-support` cargo feature, three are callerless and belong to WS8, and the remaining 33 are a redesign of the fluent surface rather than a shrink of it. `+production_wiring` is refuted there: it is readiness diagnostics, not assembly. Two loud path-keyed gates fired and were repointed, not relaxed: `reborn_host_runtime_services_do_not_expose_lower_substrate_handles` now scans the whole `obligations/` directory and asserts it read ≥ 4 files (`collect_runtime_rs` returns a count; both its callers now assert non-zero), and `reborn_struct_test_support_ratchet`'s frozen per-file count moves to `staged_handoffs.rs` with its count unchanged at 1. Test accounting (un-masking discipline): `cargo test -p ironclaw_host_runtime --all-targets -- --list` is 1,246 before and 1,246 after, name-by-name identical — zero added, removed or renamed. `LAYER_MATRIX_EXCEPTIONS` is 10 before and after; an intra-crate split cannot move the register. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…t_contracts port (WS3) `ironclaw_operator` is a products-tier crate and held `ironclaw_secrets`, the substrate that owns CAS one-shot leases, AAD/crypto and the OS keychain master key. PROPOSAL §8.2's product row says the products tier loses that edge, and §12.1b requires the port replacement to land before the edge is removed. Both happen here, in that order. - Port: `ironclaw_product_contracts::operator_secrets::OperatorSecretValueStore`. - Implementor: `ironclaw_reborn_composition::RuntimeOperatorSecretValueStore`, the same placement as `OperatorStatusService` — assembly is the only layer that may name both a products-tier port and a substrate. Registered in `INVERTED_PORTS` beside it. - `ironclaw_secrets` is gone from the operator manifest under every dependency kind, and `"ironclaw_secrets"` is now in the crate's `boundary_rules()` forbidden list. That gate's comment previously said the entry was deliberately absent because "the row owns it"; the row now owns it. The port is deliberately narrower than the substrate, so this is a tightening rather than a relocation: it takes no `ResourceScope` (the implementor fixes the operator scope, where the caller used to pass one), exposes no lease/consume protocol, and carries only a `&'static str` classification instead of the substrate's error `Display` — asserted, including that the backend message and the handle name are both absent from what crosses. Two tests travelled with the behavior rather than being pointed at a fake: `read_is_repeatable_across_reloads` (repeatability is a property of the lease protocol) and the #4673 production-store reproduction (its value is wiring the store exactly as production does, which now means the real store *behind the adapter*). Two `FaultInjecting`-over-real-store fixtures became per-operation port fakes, with the substrate error mapping re-pinned at the adapter; a third assertion got stronger — batched-vs-N+1 stored-key lookup is now observed at the port rather than by counting filesystem ops. Test accounting: operator 154 -> 153, product_contracts 142 -> 143, composition 937 -> 942 with zero removed; name-by-name diffs on a quiescent tree. Two findings the row could not have anticipated, both recorded in the CHECKLIST amendment: - The `webui` half of the row was already closed and was never a production edge. `ironclaw_secrets` has been a dev-dependency of `ironclaw_webui` since the commit that added it (#6619), both src mentions are `#[cfg(test)]`, and webui's boundary rule already forbade it. - `ironclaw_extension_manager` (layer `products`) still holds a normal `ironclaw_secrets` edge in `admin_configuration.rs`. §8.2 covers it; the row does not, because the crate landed with WS2.4 after the row was written, and the substrate sits in the service's type parameters so it is not a like-for-like swap. Filed as #7095. `LAYER_MATRIX_EXCEPTIONS` is 10 before and after: `products -> substrates` is matrix-legal, so this edge was always an §8.2 rule and never a layer exception. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Review asked why the required Rust e2e lane can report `docker_security` as passing with no daemon. Half of that is #7081 (nothing sets IRONCLAW_REQUIRE_DOCKER_TESTS=1, so the switch is inert) and is not fixable from here -- arming it hard-fails any lane lacking a daemon or the worker image, which needs a runner guaranteed to have both. The other half is fixable here and is fixed: docker_security.rs open-coded its own `docker version` / `image inspect` checks with three bare `return`s, so it sat entirely outside docker_gate and would have stayed fail-open even once something did set the variable. It now takes both preconditions from docker_gate::{docker_available, docker_image_available} and skips with the visible `SKIP:` line that gate's module doc requires. Measured, same machine, image absent: before, IRONCLAW_REQUIRE_DOCKER_TESTS=1 -> "skipping ..." / 1 passed after, IRONCLAW_REQUIRE_DOCKER_TESTS=1 -> panic at docker_gate.rs:74 / FAILED after, variable unset -> "SKIP: ..." / 1 passed The third line is the no-op proof: the variable is set nowhere in this tree or on main, so no lane's behavior changes today. The daemon-down path already reached the image check and skipped there, so the outcome is identical; only the branch it takes differs. Two stale comments in docker_gate.rs corrected with it (they claimed docker_security used its own gate, and that docker_image_available had no consumer), and the crate's Known debt entry now splits the done half from the #7081 half instead of describing both as open. cargo test -p ironclaw_sandbox: 193 passed, 0 failed cargo clippy -p ironclaw_sandbox --tests --all-features -- -D warnings: exit 0 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Two review findings, both correct, both artifacts of this PR's own renames. 1. engine-v2-to-reborn-parity.md note 4 read "a native script/software execution lane (`ironclaw_sandbox`, `RuntimeKind::Script`) sandboxed via `ironclaw_sandbox`" -- self-referential after the merge collapsed ironclaw_scripts and ironclaw_process_sandbox into one crate, and it contradicts note 5 four paragraphs down ("no production execution backend is wired for it"). Re-stated as the typed runtime contract it is, citing the measurement: `with_script_runtime` has zero production callers (`rg` finds only the builder itself, docs, and 30 test call sites). 2. CHECKLIST WS10 ratchet note 2 said "raise the percentage floor ...; only the line count should fall". That generalises WS3's sandbox merge, where observed coverage happened to rise. It is wrong as guidance for WS7, and the counterexample is in this same file: the 2026-08-03 entry from #7064 records ironclaw_runner falling 85.55% -> 82.53% because the shed removed the crate's better-covered half, holding the floor, and RATCHET FAILing in the merge queue. Note 2 now says re-capture from the merged artifact, and lower only with that entry's move-not-regression counterfactual (add the moved files back, confirm the union clears the old floor, plus a zero-tests- lost name set-diff). cargo test -p ironclaw_architecture: 32 targets, 206 passed, 0 failed Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Three review findings on the `wit/` move, each verified before it was acted on. 1. `ws12_workflow_contracts.py` probed `crates/ironclaw_wasm/wit/host.wit` and its nested twin. No `host.wit` exists in this repository — `git ls-files '*.wit'` returns only `tool.wit` and `channel.wit` — so both probes sat under the `crates/([^/]+/)*ironclaw_wasm/` alternative and re-asserted the crate-name term while saying nothing about the canonical ABI contracts. In a validator whose stated design is "probe derived from reality rather than from a guessed layout", a fabricated filename is a defect on its own terms. Replaced with a `crate_globs` entry, `("ironclaw_wasm", "wit/*.wit")`, which discovers the contracts on disk, requires each in scope, and synthesises the nested WS7 form — so a third contract, or the directory leaving the crate, fails the pin instead of passing on a stale name. Verified non-vacuous: narrowing the workflow alternative to `.../ironclaw_wasm/src/` now reports `tool.wit`, `channel.wit` and the nested probe as out of scope. 2. The embedded-asset routing test substituted `alpha`/`beta` owners so it could reuse the synthetic workspace. That exercised the real prefix strings through the real routing, but left the prefix->owner *pairing* — the table's entire semantic content — asserted nowhere: swapping `ironclaw_extension_support` and `ironclaw_extension_host` passed. Fixed in two halves. The routing test now drives the real `EMBEDDED_ASSET_OWNERS` against a workspace carrying the real owners' names and real manifest paths (the synthetic one could not: `build_plan` rejects a changed package outside the canonical set), asserting the real owner is selected. And the not-stale test now derives the same pairing from the tree instead of restating the constant: it resolves every literal `include_str!`/`include_bytes!` in every workspace crate through `crate_tree`, keeps the targets no crate owns — the ones that actually reach the table — and asserts that every crate compiling one of them is the routed owner or a dependent of it. That surfaced a property worth pinning: `crates/extensions/packages/` is embedded by four crates, not one. `ironclaw_extension_host`, `ironclaw_extension_manager` and `ironclaw_reborn_composition` reach into it alongside `ironclaw_extension_support`, and routing to the support crate covers them only because each depends on it. If that edge goes, a shipped artifact change stops scheduling a crate that embeds it — the silent under-schedule the table exists to prevent. Regression coverage verified red by sabotage, all three wrong tables: owners swapped (7 failures), `packages/` -> `ironclaw_llm` ("embeds nothing from it"), and the hardest case, `packages/` -> `ironclaw_reborn_composition` — a real embedder that the other embedders do not depend on ("...does not depend on..., so routing there never schedules it"). 3. CHECKLIST WS10 claimed each of the nine `wit_bindgen` guest edits forces a committed WASM artifact rebuild. Only six do: `scripts/ci/check-wasm-artifact-freshness.py` scans `crates/extensions/packages/*/wasm-src` alone, `wasm-src-digests.toml` holds exactly six entries, and `git ls-files '*.wasm'` returns exactly those six. The three `test-tools/*/wasm-src/` guests commit no artifact; the tenth site is the host's `bindings.rs`, not a guest. Corrected, and the `wit/` row now states the boundary rather than implying it. Guest paths, `wit/` contents and the six rebuilt artifacts are untouched. Verified: `test_reborn_pr_test_plan.py` 46/46, `test_ws12_workflow_contracts.py` 25/25, `ws12_workflow_contracts.py` green on the real tree, `cargo test -p ironclaw_architecture` 206/206 across 32 binaries. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Git kept the shared issue/review_after tail of both sides' final entries outside the conflict markers; the union reorder handed it to the wrong block, leaving the tool_payloads.rs entry (#166) without its policy fields. Validated with CI's own invocation this time (--validate-manifest-only), not just a TOML parse. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

`Detect Reborn test scope` failed on this branch: Reborn PR test planner failed: unmapped test or CI path: scripts/check-version-bumps.sh Same shape as the two planner gaps the WS10 CHECKLIST row already records: `scripts/ci/reborn_pr_test_plan.py` fails closed on any path it has no rule for, so an unclassified class makes "never edit this file" the only satisfiable behaviour — and the failure takes `Tests (Reborn)` down with it, since every downstream lane reports `skipping` when the scope job is red. Repo-root `scripts/` is deliberately not prefix-classified, so each file needs a decision recorded beside the constant. Four were missing: - `scripts/check-version-bumps.sh` -> PR_STATIC_CONTROL_PATHS. Invoked only by `platform-and-compat.yml`, behind that workflow's own `has_direct_wasm_abi_risk` filter (which already names the script). No `Tests (Reborn)` lane runs it. - `scripts/run-reborn-webui.sh` -> PR_STATIC_CONTROL_PATHS. A local developer launcher referenced by no workflow at all, so no lane can be selected for it. - `scripts/reborn_qa_matrix/` -> QA_HARNESS_PREFIXES, beside `live-canary/` and `reborn_webui_v2_live_qa/`. Offline QA tooling over the route descriptors. The fail-closed arm is untouched: an undecided repo-root script still refuses, pinned by the existing second half of `test_decided_repo_root_script_paths_are_owned_by_other_workflows`. Regression tests: the two existing classification tests are extended to cover all four paths. Sabotage-verified by removing the classifications and observing 4 errors (`ERROR: ... (path='scripts/check-version-bumps.sh')` and the three siblings), then restoring -> 45 tests OK. The planner also now runs clean over this PR's exact 45-path changed set. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

`code_style.yml`'s architecture step is `cargo test -p ironclaw_architecture reborn` — a NAME filter, not a binary filter. None of the twelve new test functions matched it, so all twelve of this PR's guardrails were invisible in that lane: green, and checking nothing there. `cargo test -p ironclaw_architecture reborn -- --list` counted 45 before this change and 57 after, with every new gate now named: reborn_crate_inventory_measures_the_real_tree reborn_rust_and_python_crate_inventories_agree reborn_logical_spellings_resolve_to_each_crates_real_directory reborn_resolution_is_the_identity_on_a_flat_fixture_tree reborn_crate_moved_into_a_family_directory_still_resolves reborn_crate_that_no_longer_exists_is_refused_not_answered reborn_ambiguous_crate_name_is_refused_not_picked reborn_truncated_tree_refuses_rather_than_reporting_an_empty_inventory reborn_separate_workspaces_nested_manifests_and_build_output_are_excluded reborn_allowlist_entries_follow_a_crate_into_its_family_directory reborn_build_scripts_do_not_derive_the_repo_root_by_counted_parent_hops reborn_fixed_depth_matcher_catches_the_banned_shapes_and_ignores_prose Rename only; no assertion changed. Full suite still 219 passed / 0 failed, fmt clean, clippy zero warnings. Note for the WS10 "guardrails must fail loudly on their own regressions" row: that filter means Code Style runs 57 of the crate's 219 architecture tests. The `Tests (Reborn)` bucket lane runs the crate unfiltered (`cargo test -p <pkg> --all-targets`), so nothing is unrun overall — but a gate whose name misses `reborn` is absent from the lane most reviewers read. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The row's amendment listed four defects found while converting. Two more turned up afterwards, from the PR's own CI run, and belong on the same row because both are the fail-closed-with-no-rule / guardrail-that-checks-nothing shape it already documents twice: - `reborn_pr_test_plan.py` had no rule for four repo-root `scripts/` files the conversion touched, failing `Detect Reborn test scope` outright and skipping every downstream Reborn lane. - `code_style.yml`'s architecture step filters on the test NAME `reborn`, so the twelve new gates were absent from it (45 -> 57 listed after the rename), and the lane as a whole runs 57 of the crate's 219 architecture tests. Docs-only; the code changes both landed in earlier commits on this branch. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

# Conflicts: # crates/ironclaw_architecture/tests/reborn_restructure_baselines.rs # docs/reborn/target-architecture/CHECKLIST.md

ironclaw_conversations drops ironclaw_turns from [dependencies] and declares the one coordinator call its inbound orchestration makes as a port. Zero production behaviour moved: the orchestration, the trusted-trigger submitter and every one of their tests stay in the crate that owned them. The port (src/turn_submission.rs): ConversationTurnSubmitter, one method submit_conversation_turn; ConversationTurnSubmission carrying only host_api::turn vocabulary plus ConversationInboundClassification, the trust value the orchestration derives from its own binding policy and never from the adapter string; TurnSubmissionError with retry() and category()/ adapter_status_code() over the host's verbatim rendered cause. The adapter (composition, automation/conversation_turn_submitter.rs, +158 net production lines): holds the TurnCoordinator handle composition already constructed for the trigger poller, calls product_context::resolve_inbound, and maps TurnError -> port error totally (no wildcard arm). CORRECTION to the pre-build analysis: the retry class is NOT derivable from the category. The Conflict category straddles retryable TurnError::Conflict and permanent LeaseMismatch/InvalidTransition/RunNotRetryable, so the port error carries two independent axes, not one three-valued one. Same branches, same ordering, same user-visible messages at every effect. Invariants amended in the same diff, not silently contradicted: both ironclaw_conversations/AGENTS.md and CLAUDE.md now name the port error and its class partition where they named ironclaw_turns::TurnError, and both gained the standing rule that a TurnCoordinator handle or an ironclaw_turns normal dependency must not come back. untrusted_trigger_adapter_records_product_inbound_not_scheduled_trigger is byte-identical (verified) and still in inbound.rs. It asserts on the SubmitTurnRequest a coordinator receives, so the fakes swapped to the port and gained a documented mirror of the production adapter; ironclaw_turns is retained as a DEV-dependency for that, with the reason in the manifest. Dev-deps are not layer-matrix edges (is_normal_dependency filters them), and cargo metadata confirms kind = dev with normal deps exactly {extension_contracts, filesystem, host_api, safety, triggers} -- PROPOSAL 6.4.2's Deps clause, literally. New seam coverage at the real adapter: conversation_turn_submitter_maps_every_turn_error_to_its_class (16 rows: all 12 TurnError variants, AdmissionRejected once per reason; asserts category, retry, that the port status equals the kernel's, and that the cause is verbatim); conversation_turn_submitter_covers_every_turn_error_variant (discriminant census); conversation_turn_submitter_mints_scheduled_trigger_only_for_trusted_trigger (the composition half of the spoof guard). Composition's five classify_materializer_inbound_error submission tests now build inputs through the production mapping instead of a stand-in. One consumer arm changed shape and is provably unreachable: ironclaw_product's map_conversation_error only ever sees ConversationBindingService failures, which never submit a turn (product has its own DefaultInboundTurnService). It now yields TurnSubmissionRejected carrying the port error's rendering rather than fabricating a TurnError to satisfy a variant no caller can reach. Recorded in the CHECKLIST row rather than hidden. Register: the conversations -> turns entry is deleted and WS0_LAYER_MATRIX_EXCEPTION_BASELINE lowered 4 -> 3. No other entry touched. Docs in the same diff: CHECKLIST WS5 row ticked with the as-built shape, WS1's "count <= 12" verify row ticked (its enumerated clause is now fully true -- no *->turns exception remains), PROPOSAL 6.4.2 amended with the built shape. docs/plans/composition-pubuse.snapshot 131 -> 132 for the one deliberate export, the module-owned adapter factory the integration harness uses instead of hand-mirroring the wiring. Verification (all unfiltered, none piped through head/tail): cargo fmt --all clean clippy (6 crates, --all-targets --all-features -Dwarn) zero warnings cargo test -p ironclaw_conversations 99 passed / 0 failed cargo test -p ironclaw_product 1050 passed / 0 failed cargo test -p ironclaw_reborn_composition 945 passed / 0 failed cargo test -p ironclaw_architecture 207 passed / 0 failed cargo test --test reborn_group_triggers 15 passed / 0 failed cargo test --test reborn_group_journeys 16 passed / 0 failed cargo check --workspace --all-targets clean (one pre-existing dead_code warning, unused_fetch_context in extension_support/src/skills.rs:572, confirmed on the base via git stash) Register reads 3 entries against baseline 3; the ratchet and the staleness check both pass. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…hat failed changed-coverage The full-mode PR run failed the changed-line gate two ways: 74.74% vs the 90% floor (1,080 misses — 1,065 of them the capabilities host.rs six-workflow split, the obligations three-owner split, and the first-party-tools move re-attributed as new code) and the generated wasm bindings.rs tripping the empty-denominator fail-closed rule on its single changed line (the wit path arg). Same-run proof of no real loss: the global floor and every configured per-crate floor PASSED in the failing run. Exact-line exemptions per manifest policy (#6963 class); the 15 uncovered lines in other crates stay measured. Offline arithmetic on the gate's own numbers: 3,195/3,210 = 99.53% post-exemption. Validated with --validate-manifest-only (191 entries). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…waves-0-4-batch

…nto ws/waves-0-4-batch # Conflicts: # crates/ironclaw_architecture/tests/reborn_dependency_boundaries.rs # crates/ironclaw_architecture/tests/reborn_restructure_baselines.rs

…s/waves-0-4-batch # Conflicts: # crates/ironclaw_architecture/tests/reborn_dependency_boundaries.rs # docs/reborn/target-architecture/CHECKLIST.md # scripts/check-version-bumps.sh # scripts/ci/reborn_pr_test_plan.py

…ws/waves-0-4-batch # Conflicts: # crates/ironclaw_architecture/tests/reborn_extension_specificity.rs # crates/ironclaw_architecture/tests/reborn_restructure_baselines.rs

…th the batch's re-layers The #7156 gates met the batch's real movement and demanded the full delta: ironclaw_sandbox's layer-origin row; five new same-layer edges (four kernel edges made same-layer by the processes re-layer, one substrates edge by the skills re-layer) with the baseline raised 70->75 then banked back to 72 as three stale skills edges deleted; the skills DowngradePin freezing its six consumers at the move; and two stale rows (deleted crates' origins, mcp's dead extensions consumer entry). Every finding a real batch effect, none suppressed. Composition absolute ceiling re-seeded to the batch tree's measured 45127 with the test record moved in lockstep. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…onclaw_approvals WS6's composition-evictions row, "Still owed" clause 1 (approval/authorization policy -> approvals/authorization). PROPOSAL §6.5.2 names the destination: the profile-policy authorizer's *policy content* moves to `approvals`, not `authorization` — §6.5.2 forbids `authorization` from doing "approvals resolution", which is exactly what this module does. Two files move by `git mv`, no content edits beyond import repointing and visibility: - `composition/src/profile_approval_authorization.rs` (1,844) -> `approvals/src/profile_gate.rs`. The class-A/class-B approval composition algorithm: origin-gate matrix folding (Forbidden -> hard deny, AskAlways -> hard floor, GatedUnlessGranted -> soft gate) against effect gates, with tool overrides / leases / auto-approve / always-allow modulating strictly between the two tiers. It was a leaf inside composition — zero `crate::` imports in production code — so it moved first with no churn. - `composition/src/runtime_profile_approval_policy.rs` (334) -> `approvals/src/profile_gate_policy.rs`. The concrete `ProfileApprovalGatePolicy` the TOML data feeds. What deliberately did NOT move, each for a stated reason: - `builtin_capability_policy.rs` — `reborn_composition_boundaries.rs` hard-asserts `mod builtin_capability_policy;` stays at composition's crate root ("runtime-profile policy"), and its `.toml` is config-as-data, which is §6.10.1's Keeps list. - `capability_authorization.rs` — `StoreApprovalSettingsProvider` is an adapter over composition-selected durable stores plus a TTL/single-flight cache; it reads `builtin_capability_policy`, which cannot leave. - `runtime/approval.rs` — depends on `product`/`extensions`/`extension_host`; genuinely composition-shaped. - `production_runtime_policy.rs` — a smart constructor over `crate::RebornCompositionError` / `RebornRuntimeProcessBinding`. Cost, stated rather than hidden: `ironclaw_approvals` takes two new same-layer kernel edges, `-> ironclaw_trust` and `-> ironclaw_runtime_policy`, and `SAME_LAYER_EDGE_BASELINE` rises 72 -> 74 with both rows inventoried. Neither is avoidable at the destination — the gate *implements* `TrustAwareCapabilityDispatchAuthorizer`, whose signature names `ironclaw_trust::TrustDecision`, and it consumes `MinimalApprovalBypass`, which §4.4 pins to `ironclaw_runtime_policy` as the one place that classification lives. The kernel family already carries twelve such edges (`capabilities` and `host_runtime` hold six each). Un-masking evidence (full unfiltered suites, both crates): - composition 957 -> 924 tests, approvals 85 -> 118. The 33 that left composition are the 33 that arrived in approvals, leaf names identical, zero unclassified, no surviving assertion edited. - composition lib 564 -> 531 passing (-33), 0 failed across all 35 test binaries; approvals 118 passing, 0 failed. - Two `RunTimeout { timeout: 3s }` failures appeared on one run taken immediately after `cargo fmt --all` + a full rebuild; both are wall-clock deadlines, both pass on a settled tree, and the base tree under the same full-suite load is 564/564. Recorded rather than silently re-run. Full `ironclaw_architecture` package green (37 binaries, 0 failures). Composition production LOC 45,127 -> 42,943. Also fixes one pre-existing `-D warnings` clippy break inherited from the batch base (`reborn_extension_specificity.rs`: a blank line between two doc-comment blocks on `WS0_EXTENSION_SPECIFICITY_ALLOWLIST_BASELINE`). Untouched by this eviction, but it made a clean clippy run impossible. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

… to ironclaw_triggers WS6's composition-evictions row, "Still owed" clause 1, trigger-fire half ("approval/authorization/trigger-fire policy -> ... `runtime_policy`+`triggers`"). Zero new dependency edges, in either direction. The split follows what each piece actually is, not the file it happened to sit in: MOVED to `ironclaw_triggers::fire_access` — decisions about a persisted trigger's own stored scope, with no backend behind them: - the check contract (`TriggerFireAccessCheck`/`Decision`/`Error`/`Checker`), previously declared in `composition/src/runtime_input.rs`; - `StaticOwnerTriggerFireChecker` — a pure comparison, including the load-bearing `tenant_id` bound (the due-trigger repository is global, so owner+scope alone could authorize a foreign tenant's trigger); - `CompositeTriggerFireChecker` — the OR-combinator, including its "unavailable beats denied" rule so a transient identity-store fault stays retryable rather than becoming a hard denial. STAYED in `ironclaw_reborn_composition`, each for a stated reason: - `TriggerFireAccessPolicy`/`TriggerFireAccessGrant` — the deployment grant the `serve`/`run` edge resolves. §6.10.1's Keeps list names "deployment config-as-data" as composition's charter, and this is exactly that; `build_reborn_runtime` still turns a policy into a checker. - `IdentityMembershipTriggerFireChecker` — a lookup against a backend composition selects (`RebornUserDirectory`). An adapter over a chosen backend is assembly, and moving it would have bought `ironclaw_triggers` a dependency on the identity crate to hold one `get_user` call. To keep the two halves from drifting, the deny reason and the exact-scope rule are exported once (`trigger_fire_access_denied`, `trigger_fire_scope_matches`) and called by the composition-side checker rather than restated there — a second copy of the deny string is how two checkers diverge. Un-masking evidence (full unfiltered suites): - triggers 169 -> 175 tests, composition 924 -> 918. The 6 that left composition are the 6 that arrived in triggers, leaf names identical, zero unclassified, no surviving assertion edited. - composition lib 531 -> 525 passing (-6), 0 failed across all 35 binaries (916 passing); triggers 175 passing, 0 failed. - Full `ironclaw_architecture` package green: 37 binaries, 259 passing, 0 failed. - Root integration suite green except `backend_parity_replies_to_greeting::case_3`, which fails at harness construction with "StorageMode::Postgres requires a reachable Docker daemon" — no Docker on this host. Environmental, unmodified, unrelated to this diff. A note for whoever reads the CI history of this branch: an earlier local run of these same suites produced up to 15 spurious `runtime::tests::*` failures on a tree that had already been verified green. The cause was the host filling its root filesystem to 117Mi free; those tests exercise on-disk filesystem backends and fail or time out when writes cannot land. Recorded rather than quietly re-run, because "it passed the second time" is how a real failure gets buried. Composition production LOC 42,943 -> 42,688. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…r measurements Closes out the two WS6 policy evictions in this branch and writes down what measuring them refuted, so the next agent measures from here rather than re-deriving. **Re-ratchet (the wave-close rule, executed not deferred).** Composition production LOC 45,127 -> 42,688 (-2,439). `[gate].loc_ceiling`, `loc_observed`, and `COMPOSITION_ABSOLUTE_SRC_LOC` all lowered to the measured count in the same PR that removed the lines, so the improvement is banked as a floor. Read with `bash scripts/ci/check-composition-budget.sh --print` on the post-eviction tree, not derived by subtracting the diff. The absolute gate now prints no NUDGE. Siblings are shrinking composition too: a numeric conflict here is expected and trivial — take the lower number, then re-measure on the merged tree rather than trusting either side. Two NUDGEs remain and are deliberately NOT actioned, because neither slack is this PR's to bank: `ceiling_bp` (17.80pp) is the share metric whose poisoned denominator this same file documents, and whose ~17.4pp of slack predates this branch and is tracked by CHECKLIST WS0; `arc_dyn_ceiling` (277) sat 263 below its ceiling at the base commit, so lowering it to 845 would lock in mostly other people's headroom and collide with every sibling shrinking composition. **CHECKLIST WS6 / PROPOSAL §6.10.1** — the approval/authorization/trigger-fire clause is struck with what actually landed, including the two same-layer kernel edges it cost and why `runtime_policy` needed nothing (`builtin_capability_policy` is pinned at composition's crate root by an architecture test). **Trusted-submit: STOPPED and recorded, not attempted.** The row names `triggers`/`conversations`; measured on this tree, both are refused by a stated rule. `ironclaw_conversations`' own crate doc says "It is not the transcript … Keep it that way", and the materializer's job is writing the transcript; `ironclaw_triggers` would need four or five new same-layer edges to host an adapter that is composition-shaped. The clause needs a destination decision, not an eviction. All five trusted-submit security gates verified green and unmodified. **`product -> loop_host`: the recorded count is wrong and hides a seam.** WS1's row says "three production import sites". It is five production files across three seams, and the third — an input-queue enqueue seam in `reborn_services.rs`, `steering.rs`, and `inbound_turn.rs`, five symbols all from `loop_host/src/input_queue.rs` — appears nowhere in these documents. It is a port inversion, not a move: `RebornServices` holds an `Arc<dyn HostInputEnqueuePort>`. Also refuted: §6.4.11's destination for the project-create capability is unreachable as written — `ironclaw_projects` is `substrates` and `ironclaw_loop_host` is `loops`, so that edge is upward and matrix-illegal. The reachable owner is `ironclaw_first_party_extension_ports`, which already holds the sibling `skill_activation_capability.rs`, and only after `ProjectService` leaves `ironclaw_product`. The manifest dep therefore cannot be dropped by any wave that moves only the two recorded sites, and this one did not try. Full `ironclaw_architecture` package green (37 binaries, 259 passing, 0 failed); `cargo check --workspace --all-features --all-targets` clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

railway-app · 2026-08-04T22:16:50Z

🚅 Deployed to the ironclaw-pr-7190 environment in ironclaw-ci-preview

Service	Status	Web	Updated (UTC)
ironclaw	✅ Success (View Logs)	Web	Aug 4, 2026 at 10:25 pm

coderabbitai · 2026-08-04T22:16:57Z

Important

Review skipped

Too many files!

This PR contains 347 files, which is 47 over the limit of 300.

To get a review, reduce the PR to 300 files or fewer by splitting it into smaller PRs or changing its base branch.

Usage-priced reviews support at most 300 files.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 69de4c6a-4da5-43f0-8eac-6730ddf4b28e

📥 Commits

Reviewing files that changed from the base of the PR and between ba34587 and b941678.

⛔ Files ignored due to path filters (9)

Cargo.lock is excluded by !**/*.lock, !**/Cargo.lock
crates/extensions/packages/github/wasm/github_tool.wasm is excluded by !**/*.wasm, !**/*.wasm
crates/extensions/packages/google-docs/wasm/google_docs_tool.wasm is excluded by !**/*.wasm, !**/*.wasm
crates/extensions/packages/google-drive/wasm/google_drive_tool.wasm is excluded by !**/*.wasm, !**/*.wasm
crates/extensions/packages/google-sheets/wasm/google_sheets_tool.wasm is excluded by !**/*.wasm, !**/*.wasm
crates/extensions/packages/google-slides/wasm/google_slides_tool.wasm is excluded by !**/*.wasm, !**/*.wasm
crates/extensions/packages/slack/wasm/slack_user_tool.wasm is excluded by !**/*.wasm, !**/*.wasm
docs/zh/extensions/building-a-tool.md is excluded by !docs/zh/**
harness/latency/runner/Cargo.lock is excluded by !**/*.lock, !**/Cargo.lock

📒 Files selected for processing (347)

.claude/commands/triage-prs.md
.claude/rules/safety-and-sandbox.md
.githooks/pre-commit
.github/workflows/code_style.yml
.github/workflows/coverage.yml
.github/workflows/docker.yml
.github/workflows/ironclaw-stress.yml
.github/workflows/nightly-deep-ci.yml
.github/workflows/platform-and-compat.yml
.github/workflows/reborn-e2e.yml
.github/workflows/reborn-playwright.yml
.github/workflows/reborn-tests.yml
Cargo.toml
Dockerfile
FEATURE_PARITY.md
crates/AGENTS.md
crates/README.md
crates/extensions/ironclaw_extension_support/AGENTS.md
crates/extensions/ironclaw_extension_support/Cargo.toml
crates/extensions/ironclaw_extension_support/src/skills.rs
crates/extensions/ironclaw_extension_support/src/skills/url_install.rs
crates/extensions/ironclaw_extension_support/src/skills/url_install/bundle.rs
crates/extensions/ironclaw_extension_support/src/skills/url_install/github.rs
crates/extensions/ironclaw_extension_support/src/skills/url_install/zip_bundle.rs
crates/extensions/packages/github/wasm-src/src/lib.rs
crates/extensions/packages/google-docs/wasm-src/src/lib.rs
crates/extensions/packages/google-drive/wasm-src/src/lib.rs
crates/extensions/packages/google-sheets/wasm-src/src/lib.rs
crates/extensions/packages/google-slides/wasm-src/src/lib.rs
crates/extensions/packages/slack/wasm-src/src/lib.rs
crates/ironclaw_approvals/Cargo.toml
crates/ironclaw_approvals/src/lib.rs
crates/ironclaw_approvals/src/profile_gate.rs
crates/ironclaw_approvals/src/profile_gate_policy.rs
crates/ironclaw_approvals/tests/boundary_contract.rs
crates/ironclaw_architecture/tests/ratchet_support/mod.rs
crates/ironclaw_architecture/tests/reborn_build_script_roots.rs
crates/ironclaw_architecture/tests/reborn_composition_boundaries.rs
crates/ironclaw_architecture/tests/reborn_contracts_vendor_census.rs
crates/ironclaw_architecture/tests/reborn_conversations_threads_attachments.rs
crates/ironclaw_architecture/tests/reborn_crate_inventory.rs
crates/ironclaw_architecture/tests/reborn_cross_crate_include_scan.rs
crates/ironclaw_architecture/tests/reborn_dependency_boundaries.rs
crates/ironclaw_architecture/tests/reborn_deployment_mode_branching_ratchet.rs
crates/ironclaw_architecture/tests/reborn_extension_specificity.rs
crates/ironclaw_architecture/tests/reborn_operator_port_inversion.rs
crates/ironclaw_architecture/tests/reborn_origin_gate_matrix_ratchet.rs
crates/ironclaw_architecture/tests/reborn_process_storage_scan_gate.rs
crates/ironclaw_architecture/tests/reborn_restructure_baselines.rs
crates/ironclaw_architecture/tests/reborn_retired_failure_vocabulary.rs
crates/ironclaw_architecture/tests/reborn_same_layer_edge_inventory.rs
crates/ironclaw_architecture/tests/reborn_sealed_evidence_mint_ratchet.rs
crates/ironclaw_architecture/tests/reborn_struct_test_support_ratchet.rs
crates/ironclaw_architecture/tests/telegram_extension_gates.rs
crates/ironclaw_authorization/tests/boundary_contract.rs
crates/ironclaw_capabilities/AGENTS.md
crates/ironclaw_capabilities/CLAUDE.md
crates/ironclaw_capabilities/src/host.rs
crates/ironclaw_capabilities/src/host/approval_resume.rs
crates/ironclaw_capabilities/src/host/auth_resume.rs
crates/ironclaw_capabilities/src/host/authorize.rs
crates/ironclaw_capabilities/src/host/error_mapping.rs
crates/ironclaw_capabilities/src/host/invoke.rs
crates/ironclaw_capabilities/src/host/mod.rs
crates/ironclaw_capabilities/src/host/obligation_seams.rs
crates/ironclaw_capabilities/src/host/resume_support.rs
crates/ironclaw_capabilities/src/host/spawn.rs
crates/ironclaw_capabilities/src/host/spawn_resume.rs
crates/ironclaw_capabilities/src/host/tests.rs
crates/ironclaw_capabilities/tests/capability_boundary_contract.rs
crates/ironclaw_conversations/AGENTS.md
crates/ironclaw_conversations/CLAUDE.md
crates/ironclaw_conversations/Cargo.toml
crates/ironclaw_conversations/src/conversation_state_store.rs
crates/ironclaw_conversations/src/error.rs
crates/ironclaw_conversations/src/inbound.rs
crates/ironclaw_conversations/src/lib.rs
crates/ironclaw_conversations/src/memory.rs
crates/ironclaw_conversations/src/traits.rs
crates/ironclaw_conversations/src/trusted_trigger.rs
crates/ironclaw_conversations/src/turn_submission.rs
crates/ironclaw_conversations/src/types.rs
crates/ironclaw_conversations/tests/inbound_contract.rs
crates/ironclaw_extension_contracts/src/hosted_mcp.rs
crates/ironclaw_extension_contracts/src/lib.rs
crates/ironclaw_extension_contracts/src/runtime.rs
crates/ironclaw_extension_host/build.rs
crates/ironclaw_extension_host/src/activation_credentials.rs
crates/ironclaw_extension_host/src/available_extension_import.rs
crates/ironclaw_extension_host/src/available_extensions.rs
crates/ironclaw_extension_host/src/channel_config.rs
crates/ironclaw_extension_host/src/channel_connection.rs
crates/ironclaw_extension_host/src/channel_host/e2e_tests.rs
crates/ironclaw_extension_host/src/channel_identity_binding.rs
crates/ironclaw_extension_host/src/channel_subject_routes.rs
crates/ironclaw_extension_host/src/extension_bundle.rs
crates/ironclaw_extension_host/src/generic_host.rs
crates/ironclaw_extension_host/src/host_api_contracts.rs
crates/ironclaw_extension_host/src/hosted_mcp_manifest.rs
crates/ironclaw_extension_host/src/lifecycle_restore.rs
crates/ironclaw_extension_host/src/mcp.rs
crates/ironclaw_extension_host/src/mcp_catalog_safety.rs
crates/ironclaw_extension_host/src/mcp_discovery.rs
crates/ironclaw_extension_host/src/product_lifecycle.rs
crates/ironclaw_extension_host/tests/lifecycle_restore_contract.rs
crates/ironclaw_extension_manager/src/channel_config_product_service.rs
crates/ironclaw_extension_manager/src/ironhub/catalog.rs
crates/ironclaw_extension_manager/src/ironhub/package.rs
crates/ironclaw_extension_manager/src/test_support/lifecycle.rs
crates/ironclaw_extensions/AGENTS.md
crates/ironclaw_extensions/src/host_api/mod.rs
crates/ironclaw_extensions/src/hosted_mcp_discovery.rs
crates/ironclaw_extensions/src/lib.rs
crates/ironclaw_extensions/tests/extension_contract.rs
crates/ironclaw_host_api/AGENTS.md
crates/ironclaw_host_api/src/capability.rs
crates/ironclaw_host_api/src/host_port.rs
crates/ironclaw_host_api/src/lib.rs
crates/ironclaw_host_api/src/process.rs
crates/ironclaw_host_api/src/resource.rs
crates/ironclaw_host_api/src/turn.rs
crates/ironclaw_host_runtime/AGENTS.md
crates/ironclaw_host_runtime/CLAUDE.md
crates/ironclaw_host_runtime/Cargo.toml
crates/ironclaw_host_runtime/src/capability_catalog.rs
crates/ironclaw_host_runtime/src/extension_contracts.rs
crates/ironclaw_host_runtime/src/first_party_tools/mod.rs
crates/ironclaw_host_runtime/src/first_party_tools/shell.rs
crates/ironclaw_host_runtime/src/first_party_tools/skill_management.rs
crates/ironclaw_host_runtime/src/first_party_tools/trace_commons.rs
crates/ironclaw_host_runtime/src/invocation_services/tests.rs
crates/ironclaw_host_runtime/src/lib.rs
crates/ironclaw_host_runtime/src/memory_native_extension.rs
crates/ironclaw_host_runtime/src/obligations.rs
crates/ironclaw_host_runtime/src/obligations/handler.rs
crates/ironclaw_host_runtime/src/obligations/mod.rs
crates/ironclaw_host_runtime/src/obligations/process_store.rs
crates/ironclaw_host_runtime/src/obligations/staged_handoffs.rs
crates/ironclaw_host_runtime/src/obligations/tests.rs
crates/ironclaw_host_runtime/src/post_edit_check.rs
crates/ironclaw_host_runtime/src/process_output.rs
crates/ironclaw_host_runtime/src/process_port.rs
crates/ironclaw_host_runtime/src/production.rs
crates/ironclaw_host_runtime/src/services.rs
crates/ironclaw_host_runtime/src/services/builder.rs
crates/ironclaw_host_runtime/src/services/process_executor.rs
crates/ironclaw_host_runtime/src/services/runtime_adapters.rs
crates/ironclaw_host_runtime/src/services/tests.rs
crates/ironclaw_host_runtime/src/services/tests/extension_tool_binder.rs
crates/ironclaw_host_runtime/src/services/tests/mcp_runtime_adapter.rs
crates/ironclaw_host_runtime/src/services/wasm_execution.rs
crates/ironclaw_host_runtime/tests/extension_v2_lifecycle_e2e.rs
crates/ironclaw_host_runtime/tests/first_party_builtin_tools.rs
crates/ironclaw_host_runtime/tests/first_party_coding_tools.rs
crates/ironclaw_host_runtime/tests/first_party_runtime_contract.rs
crates/ironclaw_host_runtime/tests/github_wasm_runtime_contract.rs
crates/ironclaw_host_runtime/tests/host_runtime_services_contract.rs
crates/ironclaw_host_runtime/tests/reborn_durable_restart_integration.rs
crates/ironclaw_host_runtime/tests/reborn_e2e_gate.rs
crates/ironclaw_host_runtime/tests/runtime_http_egress_contract.rs
crates/ironclaw_host_runtime/tests/support/host_runtime_harness.rs
crates/ironclaw_loop_host/Cargo.toml
crates/ironclaw_loop_host/src/capability_port.rs
crates/ironclaw_mcp/CLAUDE.md
crates/ironclaw_mcp/Cargo.toml
crates/ironclaw_mcp/src/lib.rs
crates/ironclaw_mcp/tests/mcp_adapter_contract.rs
crates/ironclaw_mcp/tests/mcp_dispatch_integration.rs
crates/ironclaw_network/Cargo.toml
crates/ironclaw_network/src/lib.rs
crates/ironclaw_network/src/test_rewrite.rs
crates/ironclaw_network/tests/boundary_contract.rs
crates/ironclaw_operator/AGENTS.md
crates/ironclaw_operator/Cargo.toml
crates/ironclaw_operator/src/llm_admin/llm_config_service.rs
crates/ironclaw_operator/src/llm_admin/llm_key_store.rs
crates/ironclaw_process_sandbox/CLAUDE.md
crates/ironclaw_process_sandbox/Cargo.toml
crates/ironclaw_process_sandbox/src/lib.rs
crates/ironclaw_processes/Cargo.toml
crates/ironclaw_product/CLAUDE.md
crates/ironclaw_product/src/conversation_binding.rs
crates/ironclaw_product_contracts/CLAUDE.md
crates/ironclaw_product_contracts/src/lib.rs
crates/ironclaw_product_contracts/src/operator_secrets.rs
crates/ironclaw_product_contracts/src/test_support/fakes.rs
crates/ironclaw_reborn_cli/src/commands/config/set.rs
crates/ironclaw_reborn_cli/src/commands/onboard/llm_credentials.rs
crates/ironclaw_reborn_cli/src/runtime/mod.rs
crates/ironclaw_reborn_cli/tests/smoke.rs
crates/ironclaw_reborn_composition/Cargo.toml
crates/ironclaw_reborn_composition/src/automation/conversation_turn_submitter.rs
crates/ironclaw_reborn_composition/src/automation/mod.rs
crates/ironclaw_reborn_composition/src/automation/trigger_poller_trusted_submit.rs
crates/ironclaw_reborn_composition/src/builtin_capability_policy.rs
crates/ironclaw_reborn_composition/src/capability_authorization.rs
crates/ironclaw_reborn_composition/src/capability_authorization/tests.rs
crates/ironclaw_reborn_composition/src/factory/capability_host_tests/approval_gates.rs
crates/ironclaw_reborn_composition/src/factory/production_backend_assembly.rs
crates/ironclaw_reborn_composition/src/factory/runtime_lane_assembly.rs
crates/ironclaw_reborn_composition/src/factory/test_support.rs
crates/ironclaw_reborn_composition/src/factory/tests.rs
crates/ironclaw_reborn_composition/src/lib.rs
crates/ironclaw_reborn_composition/src/operator_secret_store.rs
crates/ironclaw_reborn_composition/src/product_surface.rs
crates/ironclaw_reborn_composition/src/runtime.rs
crates/ironclaw_reborn_composition/src/runtime/capability_host.rs
crates/ironclaw_reborn_composition/src/runtime/capability_host/outbound_delivery.rs
crates/ironclaw_reborn_composition/src/runtime/capability_host/refreshing_capability_port.rs
crates/ironclaw_reborn_composition/src/runtime/capability_host/shell_tests.rs
crates/ironclaw_reborn_composition/src/runtime/capability_host/tests.rs
crates/ironclaw_reborn_composition/src/runtime/capability_host/workspace_scoping_tests.rs
crates/ironclaw_reborn_composition/src/runtime/tests/core.rs
crates/ironclaw_reborn_composition/src/runtime_input.rs
crates/ironclaw_reborn_composition/src/trigger_fire_access.rs
crates/ironclaw_reborn_composition/src/trigger_poller_assembly.rs
crates/ironclaw_reborn_composition/tests/admin_api_e2e.rs
crates/ironclaw_reborn_composition/tests/first_party_manifest_v3_parity.rs
crates/ironclaw_reborn_composition/tests/gsuite.rs
crates/ironclaw_reborn_composition/tests/libsql_substrate.rs
crates/ironclaw_reborn_composition/tests/operator_llm_key_store_wiring.rs
crates/ironclaw_reborn_composition/tests/postgres_substrate.rs
crates/ironclaw_reborn_composition/tests/production_runtime_automations.rs
crates/ironclaw_reborn_composition/tests/production_runtime_identity.rs
crates/ironclaw_reborn_composition/tests/production_runtime_project_service.rs
crates/ironclaw_reborn_composition/tests/production_runtime_trigger_poller.rs
crates/ironclaw_reborn_composition/tests/service_factory.rs
crates/ironclaw_resources/src/lib.rs
crates/ironclaw_resources/src/runtime_budget.rs
crates/ironclaw_runner/Cargo.toml
crates/ironclaw_sandbox/AGENTS.md
crates/ironclaw_sandbox/CLAUDE.md
crates/ironclaw_sandbox/Cargo.toml
crates/ironclaw_sandbox/src/lib.rs
crates/ironclaw_sandbox/src/plan.rs
crates/ironclaw_sandbox/src/plan_tests.rs
crates/ironclaw_sandbox/src/sandbox_process.rs
crates/ironclaw_sandbox/src/sandbox_process/attribution.rs
crates/ironclaw_sandbox/src/sandbox_process/attribution_tests.rs
crates/ironclaw_sandbox/src/sandbox_process/broker.rs
crates/ironclaw_sandbox/src/sandbox_process/ca.rs
crates/ironclaw_sandbox/src/sandbox_process/ca/tests.rs
crates/ironclaw_sandbox/src/sandbox_process/connect.rs
crates/ironclaw_sandbox/src/sandbox_process/container_identity.rs
crates/ironclaw_sandbox/src/sandbox_process/credential_firewall.rs
crates/ironclaw_sandbox/src/sandbox_process/credential_firewall/tests.rs
crates/ironclaw_sandbox/src/sandbox_process/key_codec.rs
crates/ironclaw_sandbox/src/sandbox_process/mounts.rs
crates/ironclaw_sandbox/src/sandbox_process/network_allowlist.rs
crates/ironclaw_sandbox/src/sandbox_process/registry.rs
crates/ironclaw_sandbox/src/sandbox_process/scope_key.rs
crates/ironclaw_sandbox/src/sandbox_process/shell_limits.rs
crates/ironclaw_sandbox/src/sandbox_process/user_key.rs
crates/ironclaw_sandbox/src/script.rs
crates/ironclaw_sandbox/src/validation.rs
crates/ironclaw_sandbox/tests/docker_security.rs
crates/ironclaw_sandbox/tests/script_dispatch_integration.rs
crates/ironclaw_sandbox/tests/script_http_adapter_contract.rs
crates/ironclaw_sandbox/tests/script_runner_contract.rs
crates/ironclaw_sandbox/tests/support/docker_gate.rs
crates/ironclaw_scripts/CLAUDE.md
crates/ironclaw_scripts/Cargo.toml
crates/ironclaw_secrets/tests/boundary_contract.rs
crates/ironclaw_skills/Cargo.toml
crates/ironclaw_triggers/src/fire_access.rs
crates/ironclaw_triggers/src/lib.rs
crates/ironclaw_turns/src/lib.rs
crates/ironclaw_turns/src/process_projection/runtime.rs
crates/ironclaw_turns/src/response.rs
crates/ironclaw_wasm/AGENTS.md
crates/ironclaw_wasm/CLAUDE.md
crates/ironclaw_wasm/Cargo.toml
crates/ironclaw_wasm/src/bindings.rs
crates/ironclaw_wasm/src/config.rs
crates/ironclaw_wasm/src/lib.rs
crates/ironclaw_wasm/tests/wasm_dispatch_integration.rs
crates/ironclaw_wasm/tests/wit_tool_runtime_contract.rs
crates/ironclaw_wasm/wit/channel.wit
crates/ironclaw_wasm/wit/tool.wit
docs/adr/0002-native-memory-uses-host-storage-ports.md
docs/channels/building-a-channel.mdx
docs/extensions/building-a-tool.md
docs/plans/composition-pubuse.snapshot
docs/reborn/README.md
docs/reborn/contracts/extensions.md
docs/reborn/contracts/host-api.md
docs/reborn/contracts/host-runtime.md
docs/reborn/contracts/live-vertical-slice.md
docs/reborn/contracts/mcp.md
docs/reborn/contracts/memory-profiles.md
docs/reborn/contracts/network.md
docs/reborn/contracts/scripts.md
docs/reborn/contracts/wasm.md
docs/reborn/engine-v2-to-reborn-parity.md
docs/reborn/extension-runtime/checklist.md
docs/reborn/harness/e2e.md
docs/reborn/how-to-port-tool-to-reborn.md
docs/reborn/target-architecture/CHECKLIST.md
docs/reborn/target-architecture/PLAN.md
docs/reborn/target-architecture/PROPOSAL.md
docs/reborn/target-architecture/README.md
docs/reborn/target-architecture/families/contracts.md
docs/reborn/target-architecture/families/extensions.md
docs/reborn/target-architecture/families/lanes.md
docs/reborn/target-architecture/families/product.md
scripts/check-version-bumps.sh
scripts/ci/check-composition-budget.sh
scripts/ci/classify-test-scope.sh
scripts/ci/composition-budget.toml
scripts/ci/crate-dir.sh
scripts/ci/cut_ironclaw_release.py
scripts/ci/lib/crate_tree.py
scripts/ci/quality_gate_strict.sh
scripts/ci/reborn-crate-test-buckets.sh
scripts/ci/reborn_pr_test_plan.py
scripts/ci/run-hermetic-deterministic-suite.sh
scripts/ci/test-check-composition-budget.sh
scripts/ci/test-classify-test-scope.sh
scripts/ci/test-hermetic-test-process.sh
scripts/ci/test_cut_ironclaw_release.py
scripts/ci/test_pre_commit_staged_paths.py
scripts/ci/test_reborn_pr_test_plan.py
scripts/ci/test_ws12_workflow_contracts.py
scripts/ci/wasm-src-digests.toml
scripts/ci/ws12_workflow_contracts.py
scripts/live-canary/scrub-artifacts.sh
scripts/live-canary/test_scrub_artifacts.py
scripts/no_panics_reborn_baseline.txt
scripts/reborn-e2e-rust.sh
scripts/reborn_qa_matrix/audit_surface_inventory.py
scripts/reborn_qa_matrix/test_audit_surface_inventory.py
scripts/reborn_webui_v2_live_qa/slack_helpers.py
scripts/run-reborn-webui.sh
test-tools/README.md
test-tools/ascii-renderer/wasm-src/src/lib.rs
test-tools/hacker-news/wasm-src/src/lib.rs
test-tools/market-data/wasm-src/src/lib.rs
tests/integration/auth/oauth_connect.rs
tests/integration/auth/oauth_popup_journeys.rs
tests/integration/changed-coverage-exemptions.toml
tests/integration/coverage-floor.toml
tests/integration/support/extension_surface.rs
tests/integration/support/github.rs
tests/integration/support/harness_mcp.rs
tests/integration/support/harness_web_access.rs
tests/integration/support/process.rs
tests/integration/support/triggered_submit.rs

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

ironloopai · 2026-08-04T22:21:45Z

🔎 Review · PR #7190

🟢 Completed · Review submitted

1 actionable findings →

Reviewed the complete trusted base-to-head cumulative comparison. The runtime policy moves preserve their security-sensitive behavior, but one CI regression breaks the Windows all-features Clippy lane.

_{Automatic · PR opened · attempt 1 of 3 · completed in 1m 52s}

Run details

Repository: nearai/ironclaw
Base: main at ba34587
Head: ws6/evictions-policy at b941678
Created: Aug 4, 2026, 10:21 PM UTC
Updated: Aug 4, 2026, 10:23 PM UTC
Run: 35114602-4793-4ef0-a428-c135db0c63b1
Latest attempt: 1 · Completed · 0281acd5-a441-4b06-9d06-7adc40f9fc59

ironloopai

🔍 Review complete · PR #7190

💬 1 finding

Reviewed the complete trusted base-to-head cumulative comparison. The runtime policy moves preserve their security-sensitive behavior, but one CI regression breaks the Windows all-features Clippy lane.

Findings

🟠 Medium · Windows Clippy step uses Bash syntax under PowerShell — .github/workflows/code_style.yml:379-383
Details are attached to the relevant diff.

Validation and technical details

Inspected the full refs/ironloop/base...refs/ironloop/head comparison: 356 changed files, 21,413 additions, and 10,923 deletions.
Reviewed high-risk runtime and boundary changes including approval/profile gates, trigger fire authorization, conversation turn submission, operator secret storage, sandbox consolidation, capability/obligation splits, CI scope planning, and artifact scrubbing.
Verified the Windows job has no job- or step-level Bash shell override around the newly introduced Bash commands.
Targeted Rust tests could not be executed because cargo is not installed in the review environment.
git diff --check additionally found trailing whitespace in docs/reborn/target-architecture/PROPOSAL.md at lines 874 and 1256; treated as non-material documentation hygiene rather than a review finding.
Base: main
Head: ws6/evictions-policy at b941678
Run: 35114602-4793-4ef0-a428-c135db0c63b1

ironloopai · 2026-08-04T22:23:37Z

        run: |
-          cd crates/ironclaw_webui/frontend
+          set -euo pipefail
+          webui_dir="$(bash scripts/ci/crate-dir.sh ironclaw_webui)"
+          cd "${webui_dir}/frontend"
          pnpm install --frozen-lockfile


🟠 Medium · Windows Clippy step uses Bash syntax under PowerShell

The clippy-windows job runs on windows-latest, where run steps default to PowerShell, but this newly changed step uses Bash-only syntax (set -euo pipefail, $(...), and ${webui_dir}). Whenever the all-features matrix entry runs, the frontend dependency step fails before Clippy executes, eliminating Windows lint coverage. Set shell: bash for this step or rewrite it in PowerShell.

BenKurrek · 2026-08-05T03:55:47Z

Superseded: this branch's content merged to main in the Waves 0–4 batch-2 PR #7181 (squash 57c685f). Verified before closing: this branch tip is an ancestor of ws/waves-0-4-batch-2, so every commit was carried. Closing as merged-via-batch, not abandoned.

BenKurrek and others added 30 commits August 3, 2026 09:38

Merge remote-tracking branch 'origin/main' into wave3/wit-move

5a1b315

# Conflicts: # docs/reborn/target-architecture/CHECKLIST.md

BenKurrek and others added 15 commits August 4, 2026 13:20

Merge remote-tracking branch 'origin/main' into ws3-consolidated-merge

2ce58fa

# Conflicts: # crates/ironclaw_architecture/tests/reborn_restructure_baselines.rs # docs/reborn/target-architecture/CHECKLIST.md

Merge remote-tracking branch 'origin/ws3/lane-governor-port' into ws/…

6769fd9

…waves-0-4-batch

Merge remote-tracking branch 'origin/ws5/conversations-turns-sever' i…

35388b1

…nto ws/waves-0-4-batch # Conflicts: # crates/ironclaw_architecture/tests/reborn_dependency_boundaries.rs # crates/ironclaw_architecture/tests/reborn_restructure_baselines.rs

Merge remote-tracking branch 'origin/ws/enforcement-gates-7147' into …

6e82bc2

…ws/waves-0-4-batch # Conflicts: # crates/ironclaw_architecture/tests/reborn_extension_specificity.rs # crates/ironclaw_architecture/tests/reborn_restructure_baselines.rs

railway-app Bot temporarily deployed to ironclaw-ci-preview / ironclaw-pr-7190 August 4, 2026 22:16 Destroyed

github-actions Bot added scope: sandbox Docker sandbox scope: ci CI/CD workflows scope: docs Documentation scope: dependencies Dependency updates size: XL 500+ changed lines risk: medium Business logic, config, or moderate-risk modules contributor: core 20+ merged PRs labels Aug 4, 2026

ironloopai Bot reviewed Aug 4, 2026

View reviewed changes

BenKurrek mentioned this pull request Aug 4, 2026

Waves 0–4 batch 2: register to zero, adapter-registry move, ruled decisions (accumulating the fleet) #7181

Merged

BenKurrek closed this Aug 5, 2026

Navigation Menu

WS6: evict the policy cluster from composition; sever product→loop_host - #7190

WS6: evict the policy cluster from composition; sever product→loop_host#7190
BenKurrek wants to merge 103 commits into
mainfrom
ws6/evictions-policy

BenKurrek commented Aug 4, 2026

Uh oh!

railway-app Bot commented Aug 4, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Aug 4, 2026

Review skipped

Uh oh!

ironloopai Bot commented Aug 4, 2026 •

edited

Loading

🟢 Completed · Review submitted

Uh oh!

ironloopai Bot left a comment

Uh oh!

ironloopai Bot Aug 4, 2026

Uh oh!

BenKurrek commented Aug 5, 2026

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

BenKurrek commented Aug 4, 2026

1. Approval/authorization policy → ironclaw_approvals (16be4d362)

2. Fire-time trigger-access policy → ironclaw_triggers (4d7c62f91)

3. Two clauses refused, with measurements (b941678dd)

4. Re-ratchet

Verification

Uh oh!

railway-app Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Aug 4, 2026

Review skipped

Uh oh!

ironloopai Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔎 Review · PR #7190

🟢 Completed · Review submitted

1 actionable findings →

Uh oh!

ironloopai Bot left a comment

Choose a reason for hiding this comment

🔍 Review complete · PR #7190

Findings

Uh oh!

ironloopai Bot Aug 4, 2026

Choose a reason for hiding this comment

Uh oh!

BenKurrek commented Aug 5, 2026

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

1. Approval/authorization policy → `ironclaw_approvals` (`16be4d362`)

2. Fire-time trigger-access policy → `ironclaw_triggers` (`4d7c62f91`)

3. Two clauses refused, with measurements (`b941678dd`)

railway-app Bot commented Aug 4, 2026 •

edited

Loading

ironloopai Bot commented Aug 4, 2026 •

edited

Loading