feat!: a run acts as its invoker — remove shared-route subject binding (#7157 follow-ups)

[BenKurrek]

Summary

Follow-ups to #7157, applying one decision — a run acts as the user who invoked it — in the three places it was still split, plus the full review-hardening pass from the 2026-08-08 multi-agent audit (every must-fix and follow-up finding is folded into this PR; see "Review hardening" below):

• Scope = invoker, everywhere. Shared-route subject binding is removed end to end: a shared channel conversation binds one thread per (conversation, user), each owned by the actor who invoked the bot. The subject half of channel configuration is retired; the admission half stays, fail-closed (*_allowed_channels connected-channel lists, checked on resolve, lookup, and reset through the new SharedConversationAdmission port — the reset checkpoint is now test-pinned too). Channels whose actor identity is not per-user (no OAuth vendor, no pairing strategy) never receive an admission resolver at all: an operator-identity channel admitting a group would run every participant as the operator, so that class is now closed structurally rather than by manifest inventory.
• The approval-gate dance is scoped as the acting user — via one contract derivation. The interim acting_user_id/effective_user_id split in outbound_delivery.rs is unified onto LoopRunContext::acting_user_id, and the audit finished the job: the whole scope recipe is now LoopRunContext::acting_resource_scope on the contract type, and every remaining hand-rolled ladder (composition's owner-first resource_scope_for_run for workspace/skill mounts, the inline grant-minting copy, project_create_capability's effective_user_id) delegates to it. On the only run shape where owner and actor can differ — legacy runs parked across this deploy — mounts and grants now follow the ACTOR, matching gates, settings, and deliveries (pin-change recorded in visible_capability_request_uses_acting_user_for_runtime_scope).
• Every parked gate is announced — on both delivery lanes. Gate notices are keyed by their gate ref in the live observer AND the triggered/background lane (the sibling instance of the same collapse: a background run's second gate previously minted the identical projection id, deduped to AlreadyDelivered, recorded the delivery Failed, and was never announced or reply-routable). Over-long discriminators are hash-bounded so a maximal legal TurnGateRef can never make a notice undeliverable at the ProjectionUpdateRef cap.
• Telegram groups get a connect affordance. telegram_allowed_channels added (same generic convention as Slack). Previously any group the bot was added to ran as the deployment operator.

The thread-model decision (owner call)

Per-invoker scope cannot preserve the one-canonical-thread-per-channel model. The owner chose (a) one thread per (channel, user): stable ownership, participants fully isolated. User-visible consequences:

• Each shared-channel participant gets their own persistent thread; there is no cross-user shared context (Carol cannot follow up on Bob's summary).
• Every participant must be paired, and unpaired participants never run as the operator. In a shared channel an unpaired participant gets no reply at all — the host-authored one-person pairing prompt deliberately never lands in a shared room; pairing happens through Extensions, and direct messages still offer the connect prompt. (The operator docs, CHANGELOG, and the silence pin in run_delivery_contract.rs all state this; a group-safe pairing affordance, e.g. DM-ing the pinger, is possible follow-up work.)
• The invoker sees and approves their own runs' gates; the invoker's notification preferences and approval settings govern their runs.
• Shared channels are no longer offered as per-user notification delivery targets (their per-user ownership came from the retired subject map); DM targets are unchanged, and stored channel-target preferences fail closed at resolution. Re-introducing channel targets under a participation rule is possible follow-up work.

What happened to persisted bindings with an operator subject

Ignored-but-retained, pinned with a restart-path test (legacy_subject_owned_shared_binding_is_retained_but_unreachable_after_reopen): the domain key for shared routes gained a serde-defaulted per-actor component, so

• legacy Direct keys deserialize byte-identically — DM threads keep full continuity;
• legacy shared rows (keyed by conversation alone, owned by the configured subject) deserialize to a key no per-actor lookup ever builds — retained in durable state untouched (LLM data is never deleted; the old thread stays visible to its owner), and every participant's next message starts a fresh thread they own. The one key shape a legacy shared row CAN collide with — a Direct request for the same conversation — is now refused outright as a route-kind mismatch (BindingRequired) on resolve, lookup, reset, and link, so no adapter re-classification can ever resurrect a legacy subject-owned thread (Direct-probe leg added to the restart-path test);
• the forward half is pinned too: per_actor_shared_bindings_keep_their_threads_across_reopen proves a NEW per-actor shared binding resolves the same thread after a restart (a deserialize-side regression on the key component would otherwise orphan every group thread silently);
• legacy saved *_subject_routes config values are inert (pinned by test); channels admitted only through them must be re-admitted via *_allowed_channels (CHANGELOG + operator docs updated).

The deploy boundary (owner ≠ actor runs parked across this deploy)

Runs raised before this deploy with owner ≠ actor and resumed after it are the one surviving owner≠actor population. Three failure modes, all terminal-and-recoverable, all deliberate (the alternative was a permanent dual-derivation fallback):

1. Resume-payload miss (documented from the start): the scope-keyed replay payload was saved under the owner-derived scope; the resume loads under the actor and misses once, failing closed (replay payload is unavailable). Re-requesting approval recovers. Now pinned on BOTH ports: approval_resume_with_missing_replay_payload_fails_closed (runtime port) and approval_resume_misses_owner_scoped_replay_payload_and_fails_closed + its acting-scope positive control (synthetic port).
2. New-raise evidence miss: a NEW gate raised post-deploy inside such a resumed run saves its approval row under the actor while the blocked-exit evidence check reads the owner-side scope — the park is rejected and the run fails once; the participant's next message lands in a fresh owner==actor thread.
3. One-time gate-prompt re-announcement: a gate prompt delivered but not yet acknowledged at deploy time re-announces once afterwards — its durable delivery identity is now keyed by the gate ref (both lanes), so the pre-deploy AlreadyDelivered record no longer matches. Refless kinds (FinalReplyReady etc.) keep their historical id shape byte-for-byte (pinned).

The approval raise/resume coverage (Task 2)

Written first, at the capability-host tier: notification_channels_set_approval_raise_and_resume_stay_scope_matched_when_owner_differs_from_actor drives the full dance — raise, replay payload, approve (lease minted from the stored row's own scope/grantee/fingerprint, as production click-approval does), approved resume, lease claim, dispatch, lease consume — on a run whose thread owner differs from its acting user.

• It passed on the interim split (commit 2dd50af3d, gate scoped to the owner), and passes after unification (gate scoped to the actor) — the identity pin flipped as a recorded decision in the unification commit.
• In between, it caught a real bug: the resume-side replay-payload load lives in ironclaw_loop_host's synthetic-capability wrap — a different crate from the raise-side save — and still derived owner-first, stranding every approved resume with "replay payload is unavailable". The acting-identity ladder now has exactly one definition (LoopRunContext::acting_user_id, with the full scope recipe as LoopRunContext::acting_resource_scope) and every derivation in the workspace delegates to it — the hand-synced-copy class is closed, not re-synced. The ladder itself is unit-pinned in its owning crate (all three rungs, including the configured-fallback rung).
• Tier note: it sits at the capability-host tier rather than tests/integration/ because this PR makes owner ≠ actor unconstructible through every product front door — that run shape survives only as legal kernel state (runs parked across the deploy). The owner == actor dance stays covered end-to-end at the integration tier (outbound_target.rs).
• Paying for the shared ladder: loop_contracts' size ceiling was originally re-captured downward via the run_context/tests.rs split; the ladder tests and acting_resource_scope re-capture it with dated provenance.

Sabotage verification (Task 3, gate-notice collision)

observer_delivers_a_prompt_for_each_distinct_approval_gate drives the real DeliveryCoordinator over the real outbound store through two scripted gates and asserts two delivered prompts plus a recorded reply route for each. Verified live by sabotage: reverting the discriminator to None fails exactly this test; restored and green. The audit added the missing legs: observer_dedupes_a_reannounced_gate_and_still_delivers_the_next (g1 → g2 → g1: the repeat dedupes, nothing double-posts), observer_delivers_a_prompt_for_each_distinct_auth_gate (the BlockedAuth arm has its own discriminator wire), and triggered_second_gate_announces_instead_of_deduping_against_the_first (the background lane, where the un-fixed collapse recorded the delivery Failed and left gate two unroutable).

Review hardening (2026-08-08 audit — all findings folded in)

• Both red CI pins fixed: the extension_manager wire-shape pin gained the telegram_allowed_channels row (production projection was correct), and the identity-parity root bin was re-pinned to the per-actor model (distinct threads, per-actor owners — its identity-prompt isolation payload is retained and now the same-room multi-actor end-to-end lock).
• Triggered-lane gate keying fixed + pinned (above); projection-id discriminators hash-bounded with shape pins (run-notification:{kind}:{run_id} refless shape byte-stable, FinalReplyReady included).
• Identity unification completed across all surviving ladders (above); the same-name/opposite-precedence resource_scope_for_run trap is gone.
• widen_binding_route_access and ReplyRouteAccess::allow_shared deleted (structurally unreachable under per-actor keying — every Shared-keyed row is born shared; the persisted flag stays for legacy reads).
• SharedChannelAdmissionHandles collapsed to the one declared handle (Option<String> at scan, plain String in the resolver — "installed but handle-less" is no longer representable); no-auth-vendor channels never build an admission resolver (structural closure, above).
• docs/reborn/contracts/conversation-binding.md amended (rules 8/14/24 + the admission and retention semantics — it is the owning contract for this behavior); operator docs and CHANGELOG corrected to the real unpaired-participant behavior; CHECKLIST.md state contradiction reconciled.
• Vocabulary sweep: retired "subject" phrasing removed from live identifiers, test names, assertion messages, and doc comments across test support and host seams (canonical_actor_user, resolve_default_binding_actor_user, re-narrated legacy-shape tests, reworded workflow_request/ChannelHostIdentity docs); vestigial TenantId keep-alive and the unconditionally-Ok resolved_binding_from_resolution fallibility cleaned up where touched.
• observer.rs carries the arch-exempt: large_file annotation its size requires; REBORN_WEBUI_V2_LIVE_QA_SLACK_ALLOWED_CHANNELS is threaded through live-canary.yml; CHANGELOG sections follow Added/Changed/Removed order.

Change Type

• Bug fix
• New feature
• Security
• Documentation

Linked Issue

Follow-up to #7157 (same underlying decision; branched off its head).

Validation

• cargo fmt --all -- --check
• cargo clippy --all --benches --tests --examples --all-features -- -D warnings
• cargo build (via full test builds)
• Relevant tests pass — see Test Strategy
• Postgres-backed integration legs ran under colima (DOCKER_HOST=unix://$HOME/.colima/default/docker.sock)
• Manual testing: not performed; behavior pinned at unit/contract/integration tiers

Test Strategy

User behavior: shared-channel participants each get their own paired, self-owned thread; the invoker approves their own gates and every parked gate is announced on both delivery lanes; unconnected shared conversations are rejected; unpaired shared-channel participants get silence, never the operator's identity.

Risk areas:

• Side effect
• Persistence
• Security or permissions
• Cross-component behavior

Tests added or updated:

• Unit or contract: conversations per-actor + trusted-owner pins, legacy morphs, the legacy Direct-probe refusal, and the per-actor restart-continuity pin; shared_admission port shape; ChannelConfigSharedAdmission (admit/deny/malformed/foreign/per-request/legacy-inert); assistant admission coverage (recording/failing/admit-all doubles, not-connected rejections incl. existing bindings and the RESET checkpoint, admission-precedes-side-effects, direct-never-consults, per-actor threads, cross-actor lookup denial); authorization_and_approval_scopes_both_follow_the_actor; the contract-tier three-rung ladder pins (acting_user_id, acting_resource_scope); the two-gate observer regression (sabotage-verified) + same-gate dedupe + two-auth-gate legs; the triggered-lane two-gate regression; projection-id shape pins (refless byte-stability incl. FinalReplyReady, verbatim short refs, bounded over-long refs); the owner≠actor raise/resume dance (passed before and after unification) + the synthetic-port resume-miss pin with its acting-scope positive control; the runtime-scope pin flipped to the acting user as a recorded decision.
• Reborn integration: extension_delivery (telegram supergroup admitted via the new handle, reply as the invoker; stored shared targets fail closed); delivery_user_journeys; outbound_target; mcp; trace_capture; generated_gate_sequences; group_journeys; group_multiuser (multi-actor isolation pins unchanged and strictly stronger); reborn_identity_prompt_scope_isolation_parity re-pinned to the per-actor model.
• Recorded fixture: Not applicable: no model tool-choice behavior changed (tool schemas/prompts untouched)
• Browser E2E: Not applicable: no WebUI frontend change (zero frontend references to the subject model — verified by sweep)
• Backend or runtime: conversations restart-path legacy-envelope + per-actor continuity tests (in-memory backend over the real envelope codec); Postgres integration legs via testcontainers as above
• Live canary: orphaned subject env var removed from live-canary.yml; the new allowed-channels env var threaded; live-QA scripts re-pinned

What the tests prove: raise and resume derive one scope from one contract method (a half-unified derivation strands the approved capability — demonstrated in-PR, and the accepted deploy-boundary miss is itself pinned on both ports); admission fails closed on every path including existing bindings and reset; per-actor keying makes widening/probing another user's binding structurally impossible, and the legacy key-collision shape is refused; legacy data is retained but never silently reused, and new per-actor data survives restarts; each distinct gate reaches the user and is reply-routable on both delivery lanes, repeats dedupe, and no legal gate ref can make a notice undeliverable.

Security Impact

This PR is a security tightening: removes the shared-channel → operator-scope split (any participant could previously reach the operator's delivery targets/settings surface area; #7157 closed the worst reads/writes, this removes the split itself); admission is fail-closed on every binding path and never installed at all for operator-identity channels; unpaired participants can no longer act at all in shared channels; Telegram groups previously ran as the operator for anyone who added the bot — now allowlisted per chat; mounts, grants, gates, settings, and deliveries all derive one acting identity from one contract method. No new network calls, secrets handling, or sandbox changes.

Reborn Trust-Boundary Checklist

• Trust-bearing types: SharedConversationAdmission is a decision port (bool), constructed only by channel-host assembly/extras — and only for channels with per-user actor identity; no new evidence minting
• No new untrusted content enters prompts
• No new hashing beyond the stable FNV-1a projection-id bound (host-side dedupe key composition; not security material — the sha256-derived managed subject was deleted)
• New/changed variants: no enum variants changed; the not-connected rejection and the route-kind-mismatch refusal both reuse BindingRequired; downstream match sites unaffected
• serde(default) on BindingKey.shared_actor_user_id fails closed by construction (legacy shared rows become unreachable, never mis-owned; the Direct-collision shape is refused) and has migration tests in both directions
• No new unbounded collections
• Error classes: config-store failures stay Transient (pinned with projection test); rejections stay permanent
• No sandbox/native naming changes

Database Impact

None (no SQL migrations). The conversations envelope (/conversations/state.json over RootFilesystem) gains an optional serde-defaulted key component; old envelopes load unchanged (round-trip + legacy-shape tests on the shared codec; backend choice is below this layer).

Blast Radius

Channel binding resolution (Slack/Telegram shared conversations), notification-channel capability gating, run-notification delivery identities (both lanes), outbound target listings, operator channel configuration, and — for the legacy parked-run population only — mount/grant scoping (now actor-first like the rest of the dance). WebUI/openai_compat submit only Direct routes and are unaffected. The no-auth-vendor → operator residual is closed structurally: such channels can no longer admit shared conversations at all.

Rollback Plan

Revert the branch. Shared-channel data is NOT silently ignored on revert: the old BindingKey deserializer has no deny_unknown_fields, so every per-actor row for one conversation collapses onto the single legacy conversation-scoped key (map insertion order decides the arbitrary survivor), and the first post-revert save persists that collapse — the losing participants' binding rows are dropped from durable state and the channel re-binds to the surviving participant's thread under the old shared semantics (threads and messages themselves are ordinary retained threads and survive either way). A safe rollback therefore means either draining shared-channel traffic first or accepting one arbitrary re-binding per shared conversation. DM bindings round-trip byte-identically and are unaffected. The retired Slack config fields would need re-adding to the manifest on revert. No migrations to unwind.

Review Follow-Through

• The in-flight-gate deploy boundary (all three modes above) is accepted and documented; flag if you want a dual-derivation fallback instead.
• Shared channels as notification delivery targets are removed pending a participation rule (the caller holds a binding in the channel) — follow-up candidate.
• A group-safe pairing affordance for unpaired shared-channel participants (e.g. DM the pinger) — follow-up candidate; blocked on distinguishing the not-connected and not-paired rejections, which deliberately share BindingRequired.
• Not taken on (per the brief): moving trigger_delivery_migration.rs into ironclaw_triggers; the Task 1 work did not invert that registry lookup.

---

Review track: C (security/runtime)

🤖 Generated with Claude Code

https://claude.ai/code/session_01Q7eyxusG6UGBXBfJ8BnQDy

[BenKurrek]

Review triage — every open thread addressed

All 20 inline review comments (serrrfirat's audit findings + CodeRabbit) are resolved by the review-hardening commits now on the branch. Dispositions, thread by thread:

serrrfirat (audit findings):

1. memory.rs:1574 — Direct/legacy key aliasing splits threads and reaches legacy rows. Fixed, hardened beyond the report. A Direct request that key-collides with a retained legacy shared row is now refused outright as a route-kind mismatch (BindingRequired) on resolve, lookup, reset, and link, and the restart-path test gained a Direct-probe leg. Note the aliasing was not a regression — the pre-feat!: a run acts as its invoker — remove shared-route subject binding (#7157 follow-ups) #7377 key had no route/actor discriminator at all, so the identical request reached the identical row before; reachability strictly shrank and is now refused entirely. Kind-flapping for one conversation ref is not something today's adapters can produce (Slack C*/D*, Telegram positive/negative ids are disjoint); the guard makes that assumption enforced rather than assumed.
2. memory.rs:953 — per-(conversation,actor) rows multiply the whole-state blob. Accepted, no change. Pre-existing whole-state store design; the audit's performance reviewer returned zero findings at threshold. Worth revisiting if group sizes grow, tracked as store-level work, not binding-model work.
3. channel_shared_admission.rs:152 — per-message uncached config read. Accepted, no change. The per-request read is the fail-closed design (a disconnect takes effect immediately); caching would add invalidation complexity for a small JSON parse. Revisit only with profiling evidence.
4. conversation_binding.rs:512 — reset admission untested. Fixed. shared_admission_gates_every_resolve_without_rebuilding_scope gained the reset leg: disconnected shared conversation → reset refused with the not-connected rejection, nothing rotates, and the actor's thread survives re-admission intact.
5. run_context.rs:300 — ladder lacks a contract-tier test; fallback rung untested. Fixed. Three-rung table test (acting_user_id_prefers_actor_then_owner_then_configured_fallback) plus acting_resource_scope pins, in the owning crate.
6. outbound_delivery.rs:290 — owner-first twin with the same name survives and scopes mounts. Fixed. All surviving hand-rolled ladders now delegate to LoopRunContext::acting_user_id / the new acting_resource_scope (capability_host mounts + inline grant minting, project_create's effective_user_id deleted); the pin flip is a recorded decision (visible_capability_request_uses_acting_user_for_runtime_scope). The same-name/opposite-precedence trap is gone.
7. channel_shared_admission.rs:485 — vestigial TenantId keep-alive. Fixed (line, const, and import removed).
8. channel_shared_admission.rs:47 — doc grammar regression. Fixed in the handles-collapse rewrite (the struct is gone; the scan fn's doc reads naturally).
9. memory.rs:913 — widen unreachable under per-actor keying. Fixed. widen_binding_route_access and ReplyRouteAccess::allow_shared deleted; the persisted shared flag stays for legacy reads.
10. inbound_turn.rs:1423 — thread_scope_from_binding duplicated. Fixed. The private copy is gone; run_delivery.rs's pub(crate) fn is the one definition (workflow.rs's TurnScope builder cross-references it).
11. synthetic_capability.rs:36 — scope-recipe duplicated one level above the ladder. Fixed. The whole recipe is LoopRunContext::acting_resource_scope on the contract; both crate-local copies are deleted.
12. channel_shared_admission.rs:55 — one-field handles wrapper. Fixed. Scan returns Option<String>; the resolver holds a plain String ("installed but handle-less" is no longer representable).
13. observer.rs:815 — gate-ref ids don't dedupe against pre-upgrade records. Accepted + documented. One re-announcement per gate prompt delivered-but-unacked at deploy time, on both lanes now; recorded in the PR body's deploy-boundary section and the CHANGELOG. Inherent to fixing the collapse bug; a transitional legacy-id probe wasn't worth permanent code.

CodeRabbit:

14. conversation_state_store_contract.rs:548 — unreachability proven only from the Shared path. Fixed — Direct-probe leg added (see Move whatsapp channel source to channels-src/ for consistency #1), plus the new forward-continuity pin per_actor_shared_bindings_keep_their_threads_across_reopen.
15. inbound_contract.rs:395 — test name stale. Fixed — renamed to what the body proves (stored_shared_reply_target_resolves_both_access_kinds_only_for_its_own_actor).
16. extension_host/lib.rs:161 — restrict crate-local re-exports. Fixed — the root pub use of the admission items is removed; in-crate consumers use the module path.
17. telegram/manifest.toml:28 — add unlisted-group rejection coverage. Fixed — extension_delivery.rs gained the caller-path leg: correctly-signed webhook for an unlisted supergroup is acknowledged (no vendor retry storm) and produces no turn and no reply.
18. CHECKLIST.md:157 — contradictory open status. Fixed with a dated ✎ reconciliation note in the file's house style.
19. group.rs:809 — rename canonical_subject_user. Fixed (canonical_actor_user, locals and comments included).
20. binary_e2e.rs:478 — rename resolve_default_binding_subject_user. Fixed (resolve_default_binding_actor_user, call-site locals included).

Also folded in from the multi-agent audit (not raised in these threads): the triggered/background lane's sibling gate-collapse fix + regression, the identity-parity re-pin, projection-id hash bounding, the no-auth-vendor structural closure, the conversation-binding contract amendments, the corrected rollback plan, and the unpaired-shared-participant docs alignment. Details in the updated PR body.

[coderabbitai]

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/extensions/ironclaw_extension_host/src/channel_host.rs`:
- Around line 824-834: Update the shared-admission selection around
shared_admission and default_shared_admission to return None immediately when
actor_identity_is_per_user is false, before consulting extras.shared_admission
or the manifest resolver. Preserve override and default resolution only for
per-user identity channels, and add a caller-path regression test injecting
ChannelExtras.shared_admission for a channel without identity lookup to verify
shared ingress is rejected.

In `@crates/extensions/ironclaw_extension_host/src/channel_outbound_targets.rs`:
- Line 45: Use crate-relative paths for all internal channel admission
references: update handle_declares_field in channel_outbound_targets.rs to
import through crate::channel_shared_admission, and update
shared_channel_admission_handle plus ChannelConfigSharedAdmission in
channel_host.rs to use crate::channel_shared_admission.

In `@crates/product/ironclaw_assistant/src/channel_workflow.rs`:
- Around line 85-88: Update the comment describing the composed runtime’s
fallback operator user to insert “that” after “user,” making the sentence read
grammatically and clearly identify the user to whom host-initiated work is
attributed.

In `@tests/integration/extension_delivery.rs`:
- Around line 1723-1764: Extend the unlisted-update test around the ingress
request to capture the caller-visible turn acceptance or run count before
posting the update, then assert it remains unchanged after ingress.drain(). Keep
the existing sendMessage assertion, and use the existing test-facing
acceptance/run counter symbol rather than inferring admission solely from
network requests.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 432ba117-e458-4b53-be13-443834cd0062

📥 Commits

Reviewing files that changed from the base of the PR and between e71e5a8 and 6cc33c1.

⛔ Files ignored due to path filters (1)

• CHANGELOG.md is excluded by !CHANGELOG.md

📒 Files selected for processing (34)

• .github/workflows/live-canary.yml
• crates/app/ironclaw_architecture_tests/tests/reborn_dependency_boundaries.rs
• crates/app/ironclaw_composition/src/runtime/capability_host.rs
• crates/app/ironclaw_composition/src/runtime/capability_host/notification_channels_set.rs
• crates/app/ironclaw_composition/src/runtime/capability_host/outbound_delivery.rs
• crates/app/ironclaw_composition/src/runtime/capability_host/tests.rs
• crates/contracts/ironclaw_loop_contracts/src/host/run_context.rs
• crates/contracts/ironclaw_loop_contracts/src/host/run_context/tests.rs
• crates/domains/ironclaw_conversations/src/memory.rs
• crates/domains/ironclaw_conversations/tests/conversation_state_store_contract.rs
• crates/domains/ironclaw_conversations/tests/inbound_contract.rs
• crates/extensions/ironclaw_extension_host/src/channel_host.rs
• crates/extensions/ironclaw_extension_host/src/channel_outbound_targets.rs
• crates/extensions/ironclaw_extension_host/src/channel_shared_admission.rs
• crates/extensions/ironclaw_extension_host/src/lib.rs
• crates/extensions/ironclaw_extension_manager/src/channel_config_product_service.rs
• crates/loop/ironclaw_loop_host/src/synthetic_capability.rs
• crates/product/ironclaw_assistant/src/channel_workflow.rs
• crates/product/ironclaw_assistant/src/model_channel_delivery/tests.rs
• crates/product/ironclaw_assistant/src/project_create_capability.rs
• crates/product/ironclaw_assistant/src/run_delivery/observer.rs
• crates/product/ironclaw_assistant/src/run_delivery/prompts.rs
• crates/product/ironclaw_assistant/src/run_delivery/triggered.rs
• crates/product/ironclaw_assistant/tests/product_surface_contract.rs
• crates/product/ironclaw_assistant/tests/run_delivery_contract.rs
• docs/reborn/contracts/conversation-binding.md
• docs/reborn/setup-slack-for-reborn-binary.md
• docs/reborn/target-architecture/CHECKLIST.md
• tests/integration/extension_delivery.rs
• tests/integration/group_extensions/scenario_slack_channel_lifecycle_state_machine.rs
• tests/integration/support/group.rs
• tests/integration/support/group_constructors.rs
• tests/reborn_identity_prompt_scope_isolation_parity.rs
• tests/support/reborn_parity_qa/binary_e2e.rs

💤 Files with no reviewable changes (1)

• crates/extensions/ironclaw_extension_host/src/lib.rs

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Block admission overrides for operator-resolved channels.

extras.shared_admission takes precedence before the per-user identity check. A channel with OperatorActorUserResolver can therefore admit a shared conversation and run each participant as operator_user_id.

Check actor_identity_is_per_user before selecting either an override or the manifest resolver. Return None when it is false. Add a caller-path regression test that injects ChannelExtras.shared_admission for a channel without identity lookup and verifies that shared ingress is rejected.

As per coding guidelines, “Do not weaken … allowlists.” As per path instructions, the Trusted-ingress seal requires inbound requests to preserve the trusted boundary.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/extensions/ironclaw_extension_host/src/channel_host.rs` around lines
824 - 834, Update the shared-admission selection around shared_admission and
default_shared_admission to return None immediately when
actor_identity_is_per_user is false, before consulting extras.shared_admission
or the manifest resolver. Preserve override and default resolution only for
per-user identity channels, and add a caller-path regression test injecting
ChannelExtras.shared_admission for a channel without identity lookup to verify
shared ingress is rejected.

Sources: Coding guidelines, Path instructions

[coderabbitai]

📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf 'Locate files and relevant occurrences:\n'
fd -a 'channel_(outbound_targets|host).rs' . || true
printf '\nOccurrences of ironclaw_extension_host::channel_shared_admission:\n'
rg -n "ironclaw_extension_host::channel_shared_admission" . || true
printf '\nRelevant file slices:\n'
sed -n '1,80p' crates/extensions/ironclaw_extension_host/src/channel_outbound_targets.rs
printf '\n---\n'
sed -n '85,120p' crates/extensions/ironclaw_extension_host/src/channel_host.rs
printf '\nModule declaration:\n'
rg -n "^pub(crate)? (mod channel_shared_admission|use ironclaw_extension_host::channel_shared_admission)" crates/extensions/ironclaw_extension_host/src/lib.rs crates/extensions/ironclaw_extension_host/src/channel_host.rs crates/extensions/ironclaw_extension_host/src/channel_outbound_targets.rs || true

Repository: nearai/ironclaw

Length of output: 6150

---

Use crate:: for internal module references.

These references are cross-module imports within ironclaw_extension_host, and the repo guideline requires using crate:: for cross-module Rust imports.

• crates/extensions/ironclaw_extension_host/src/channel_outbound_targets.rs#L45: import handle_declares_field through crate::channel_shared_admission.
• crates/extensions/ironclaw_extension_host/src/channel_host.rs#L101/#L108: call shared_channel_admission_handle and construct ChannelConfigSharedAdmission through crate::channel_shared_admission.

📍 Affects 2 files

• crates/extensions/ironclaw_extension_host/src/channel_outbound_targets.rs#L45-L45 (this comment)
• crates/extensions/ironclaw_extension_host/src/channel_host.rs#L101-L108

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/extensions/ironclaw_extension_host/src/channel_outbound_targets.rs` at
line 45, Use crate-relative paths for all internal channel admission references:
update handle_declares_field in channel_outbound_targets.rs to import through
crate::channel_shared_admission, and update shared_channel_admission_handle plus
ChannelConfigSharedAdmission in channel_host.rs to use
crate::channel_shared_admission.

Sources: Coding guidelines, Path instructions

[coderabbitai]

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Clarify the operator-user sentence.

Lines 85-86 are grammatically incomplete: “the fallback operator user host-initiated work is attributed to”. Add that after user so the actor-scope rule is unambiguous.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/product/ironclaw_assistant/src/channel_workflow.rs` around lines 85 -
88, Update the comment describing the composed runtime’s fallback operator user
to insert “that” after “user,” making the sentence read grammatically and
clearly identify the user to whom host-initiated work is attributed.

[coderabbitai]

🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

Assert that the unlisted update creates no turn.

The test only verifies that no sendMessage request occurs. A disallowed update can still enter the turn workflow and then finish or fail without delivery.

Record a caller-visible turn acceptance or run count before the request. Assert that it is unchanged after ingress.drain(). This verifies the fail-closed admission boundary, not only the absence of a reply.

Repo invariant: “Test through the caller.”

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/integration/extension_delivery.rs` around lines 1723 - 1764, Extend the
unlisted-update test around the ingress request to capture the caller-visible
turn acceptance or run count before posting the update, then assert it remains
unchanged after ingress.drain(). Keep the existing sendMessage assertion, and
use the existing test-facing acceptance/run counter symbol rather than inferring
admission solely from network requests.

Source: Path instructions