IronClaw wants model-visible text to stop pretending string validation proves provenance

nearai/ironclaw issue #6688 is the inspected primary source: “Unify model-visible safe text around a screened core and typed views.” Issue #6688 inventories five overlapping wrappers around model-visible text. Three carry nearly the same safe-summary contract, while ModelResultPreview permits structured content and HostRemediation claims host authorship that its public String constructor cannot enforce. Existing validation mixes credential detection, control characters, byte bounds, one-line formatting, and delimiter restrictions; callers often discard useful text rather than redact it. The proposal introduces one credential-screened core plus sealed policy views for 512-byte captions, 24 KiB structured previews, and operator remediation. Persisted or relayed strings must re-enter through the same screener, and wire data cannot choose its own trust level. Host provenance would come from sealed templates or a host-owned authority rather than lexical inspection. PR #6684 similarly collapses five failure enums into one 35-variant vocabulary with exhaustive fate projections.

The facts

- nearai/ironclaw issue #6688 was created 2026-07-27T01:02:15Z and updated 2026-07-27T01:02:15Z; state is open. - nearai/ironclaw returned 12561 GitHub stars, 1407 open issues, default branch main, and last push 2026-07-26T23:37:18Z. - Latest tagged-release baseline checked: ironclaw-v1.0.0-rc.1 published 2026-07-21T03:57:55Z. - Issue #6688 inventories five overlapping wrappers around model-visible text. - Three carry nearly the same safe-summary contract, while ModelResultPreview permits structured content and HostRemediation claims host authorship that its public String constructor cannot enforce. - Existing validation mixes credential detection, control characters, byte bounds, one-line formatting, and delimiter restrictions; callers often discard useful text rather than redact it. - The proposal introduces one credential-screened core plus sealed policy views for 512-byte captions, 24 KiB structured previews, and operator remediation. - Persisted or relayed strings must re-enter through the same screener, and wire data cannot choose its own trust level.

What changed

Issue #6688 inventories five overlapping wrappers around model-visible text. Three carry nearly the same safe-summary contract, while ModelResultPreview permits structured content and HostRemediation claims host authorship that its public String constructor cannot enforce. Existing validation mixes credential detection, control characters, byte bounds, one-line formatting, and delimiter restrictions; callers often discard useful text rather than redact it. The proposal introduces one credential-screened core plus sealed policy views for 512-byte captions, 24 KiB structured previews, and operator remediation. Persisted or relayed strings must re-enter through the same screener, and wire data cannot choose its own trust level. Host provenance would come from sealed templates or a host-owned authority rather than lexical inspection. PR #6684 similarly collapses five failure enums into one 35-variant vocabulary with exhaustive fate projections. The primary record was inspected with its timestamps, state, body, and adjacent project records. ClawCharts supplied the assignment list; it does not establish the claim.

Why it matters

“Safe string” types often accumulate incompatible promises until none are mechanically true. Credential screening, output shape, resource bounds, and provenance are different properties with different owners. Encoding them as separate typed policies makes permissive previews harder to pass accidentally into narrow captions and makes trust claims reviewable. The operational test is whether persisted state, visible control, and runtime behavior agree at the handoff where authority changes.

Current

The design issue and failure-vocabulary PR were open. IronClaw’s latest tag remained 1.0.0-rc.1. The July 26 failure taxonomy found 11 tasks affected by read_file limit:0 and two by over-eager provider-argument screening, providing current evidence that safety and presentation contracts influence task quality. Repository metadata, current issues and pull requests, release baseline, Hacker News discovery, and the rendered ranking row were checked. Weak search residue and historically used source spines were not promoted.

Evidence

The primary URL is https://github.com/nearai/ironclaw/issues/6688. Supporting links are inspected current project records that establish implementation, adjacent direction, or boundary conditions. Dates, reproductions, test totals, and deployment observations remain attributed to their authors unless this brief explicitly says they were independently rerun.

Source boundary

Open work is described as open, closed work as closed, and operator reports as reports. Closure can reflect a documentation decision or triage outcome; it is not silently translated into a shipped code fix. Ranking explains why the project was scanned; it does not prove correctness, adoption, or package behavior.

Operator take

Demand caller-level tests at every untrusted-to-model-visible transition, wire revalidation on replay, and explicit constructors for provenance-bearing text. Do not use a type name to claim guarantees its constructor cannot establish. Preserve a before-state receipt and verify the narrowest invariant where state changes. Do not broaden permissions or delete state merely because the visible symptom is inconvenient.

Caveat

Public project records are mutable. Source state was captured at publication time, and later revisions may change status, scope, or evidence. No source here authorizes automatic mutation of a reader’s deployment.

Source inspected; source state, environment, and release boundary remain explicit.