chore: promote staging to main (2026-03-10 05:21 UTC)

[ironclaw-ci]

Auto-promotion from staging CI

Batch range: a868b1422119932a695d787e3fbe176ce97d84f6..3a2989d009c58d12bfaae52b9b1052f82bf07443
Promotion branch: staging-promote/3a2989d0-22888378864
Base: staging-promote/a868b142-22886164216
Triggered by: Staging CI batch at 2026-03-10 05:21 UTC

Waiting for gates:

• Tests: pending
• E2E: pending
• Claude Code review: pending (will post comments on this PR)

---

Auto-created by staging-ci workflow

[claude]

Code review

No issues found.

[claude]

Update: Bug scan review complete.

Found 1 minor issue:

[LOW:50] Empty DatabaseHandles fallback may silently skip secrets store initialization (src/app.rs ~line 288)

The code creates an empty DatabaseHandles as a fallback when database initialization returns early. This causes create_secrets_store() to return None, which gracefully skips credential injection. While this is intentional design for no-database scenarios, adding a debug log when this fallback path is taken would improve observability.

[claude]

Code Review - Performance & Production Issues

Found 8 production readiness issues:

1. [CRITICAL:95] Unwrap calls in production code (src/bootstrap.rs:598, src/channels/wasm/setup.rs:779,782)
   Panics on error instead of graceful handling. Violates CLAUDE.md guideline: no .unwrap()/.expect() in production.

2. [HIGH:85] N+1 query anti-pattern in secrets (src/channels/wasm/setup.rs:1073-1087)
   Calls secrets.list() then secrets.get_decrypted() for each secret. O(n) queries instead of O(1).

3. [HIGH:80] Unbounded memory allocation for secrets (src/channels/wasm/setup.rs:1074)
   secrets.list() loads all secrets without pagination or limits. No backpressure handling.

4. [HIGH:75] Spawned orchestrator task without error handling (src/orchestrator/mod.rs:2572-2576)
   Task startup errors silently logged, no recovery mechanism or handle tracking.

5. [MEDIUM:70] Sync mutex in async test context (src/config/mod.rs:3081,3102,3121)
   ENV_MUTEX.lock().unwrap() in async tests risks deadlock. Should use async-safe locking.

6. [MEDIUM:65] String allocations in credential loop (src/channels/wasm/setup.rs:1099,1109,1133)
   .to_uppercase() and .to_string() called per credential. Optimize with Cow or cached strings.

7. [MEDIUM:60] Fixed-size broadcast channel without backpressure (src/orchestrator/mod.rs:2543)
   Capacity 256 with no indication of dropped events. Risk of silent message loss.

8. [LOW:50] Unbounded iteration over secrets (src/channels/wasm/setup.rs:1082-1112)
   Linear memory growth with secret count. Consider adding iteration limits for large secret stores.

[claude]

Code Review - Clarification

Correction to performance review: The unwrap calls identified are actually in test code (marked with #[test]), not production code. The Security & Safety review correctly identified this.

Verified production issues remaining:

1. [HIGH:85] N+1 query anti-pattern in secrets (src/channels/wasm/setup.rs)

   • secrets.list() + per-secret get_decrypted() calls. O(n) instead of O(1)

2. [HIGH:80] Unbounded memory in secrets list (src/channels/wasm/setup.rs)

   • No pagination/limits on secrets.list(). Risk with large secret stores

3. [HIGH:75] Spawned orchestrator task without error handling (src/orchestrator/mod.rs)

   • Startup errors silently logged, no recovery mechanism

4. [MEDIUM:70] Sync mutex in async test context (src/config/mod.rs)

   • ENV_MUTEX deadlock risk in async tests

5. [MEDIUM:65] String allocations in credential loop (src/channels/wasm/setup.rs)

   • .to_uppercase() and .to_string() per credential

6. [MEDIUM:60] Broadcast channel without backpressure (src/orchestrator/mod.rs)

   • Fixed capacity 256, no indication of dropped events

7. [LOW:50] Unbounded iteration over secrets (src/channels/wasm/setup.rs)

   • Linear growth with secret count