IronClaw
IronClaw lands an inert TLS interception seam before wiring its credential firewall
An open IronClaw slice can terminate selected sandbox TLS connections with short-lived leaf certificates, then forwards decrypted bytes unchanged. Nothing constructs the configuration in production yet. The authors explicitly warn that a future permissive trust store would create a working man-in-the-middle behind a green unit suite.
nearai/ironclaw PR #6740 is the inspected primary source: “W6 phase 1 — TLS termination seam for the sandbox egress proxy.” PR #6740 ports a 601-line TLS interception module onto main after the in-memory certificate authority and credential-obligation primitives landed in PR #6723. Bound hosts receive a leaf certificate from the internal CA and decrypted bytes are forwarded unchanged; unbound hosts remain opaque bidirectional tunnels and do not mint certificates. Interception failures close the connection rather than falling back to plaintext. The source is explicit that no production caller currently constructs TlsInterceptConfig, so this phase neither injects credentials nor changes live egress. Four focused tests cover unbound hosts, scoped leaf certificates, relayed bytes and handshake failure before origin dialing. The author reports 450 passing host-runtime tests plus five unrelated environment or pre-existing failures, architecture tests, format, Clippy and a no-panics check. The warning is architectural: future origin_connector wiring must use a real root store and must never accept dangerous, empty or skip-verification settings, because present tests supply their own connectors. PR #6695 adds leaf-scoped mount containment and per-user sandbox identity primitives, also unwired by design.
The facts
- nearai/ironclaw PR #6740 was created 2026-07-27T22:41:27Z and updated 2026-07-28T00:52:23Z; state is open. - nearai/ironclaw returned 12571 GitHub stars, 1439 open issues, default branch main, and last push 2026-07-28T00:48:58Z. - Latest tagged-release baseline checked: ironclaw-v1.0.0 published 2026-07-27T19:32:01Z. - PR #6740 ports a 601-line TLS interception module onto main after the in-memory certificate authority and credential-obligation primitives landed in PR #6723. - Bound hosts receive a leaf certificate from the internal CA and decrypted bytes are forwarded unchanged; unbound hosts remain opaque bidirectional tunnels and do not mint certificates. - Interception failures close the connection rather than falling back to plaintext. - The source is explicit that no production caller currently constructs TlsInterceptConfig, so this phase neither injects credentials nor changes live egress. - Four focused tests cover unbound hosts, scoped leaf certificates, relayed bytes and handshake failure before origin dialing.
What changed
PR #6740 ports a 601-line TLS interception module onto main after the in-memory certificate authority and credential-obligation primitives landed in PR #6723. Bound hosts receive a leaf certificate from the internal CA and decrypted bytes are forwarded unchanged; unbound hosts remain opaque bidirectional tunnels and do not mint certificates. Interception failures close the connection rather than falling back to plaintext. The source is explicit that no production caller currently constructs TlsInterceptConfig, so this phase neither injects credentials nor changes live egress. Four focused tests cover unbound hosts, scoped leaf certificates, relayed bytes and handshake failure before origin dialing. The author reports 450 passing host-runtime tests plus five unrelated environment or pre-existing failures, architecture tests, format, Clippy and a no-panics check. The warning is architectural: future origin_connector wiring must use a real root store and must never accept dangerous, empty or skip-verification settings, because present tests supply their own connectors. PR #6695 adds leaf-scoped mount containment and per-user sandbox identity primitives, also unwired by design. The primary record was inspected with its timestamps, state, body and adjacent project records. ClawCharts supplied the assignment list; it does not establish the claim.
Why it matters
Credential injection at an egress proxy is deliberately controlled man-in-the-middle machinery. Landing it in slices can improve reviewability, but only if unwired status remains honest and the final composition gate tests the trust store, host allowlist, tenant attribution and failure behavior together. Unit tests cannot prove a production constructor that does not exist. The useful boundary is where persisted state, visible control and runtime behavior are expected to agree.
Current
The TLS seam and containment primitives were open. The CA and obligation-staging slice was closed, but its own source says nothing constructs it. IronClaw released 1.0.0 on July 27; none of the inspected records says this unwired sandbox program is active in that release. Repository metadata, current issues and pull requests, release baseline, Hacker News discovery and the rendered ranking row were checked. Weak search residue and historically used source spines were not promoted.
Evidence
The primary URL is https://github.com/nearai/ironclaw/pull/6740. Supporting links are inspected current project records that establish implementation, adjacent direction or boundary conditions. Dates, reproductions, test totals and deployment observations remain attributed to their authors unless this brief explicitly says they were independently rerun.
Source boundary
Open work is described as open, closed work as closed, and operator reports as reports. Closure can reflect a documentation decision or triage outcome; it is not silently translated into a shipped code fix. Ranking explains why the project was scanned; it does not prove correctness, adoption or package behavior.
Operator take
Require one composition test that drives a real sandbox request through attribution, host binding, certificate validation, placeholder substitution and origin TLS. Fail closed on ambiguous tenant identity. Make the production trust-store constructor impossible to instantiate with empty or permissive verification, then prove unbound traffic never enters interception. Preserve a before-state receipt and verify the narrowest invariant where state changes. Do not broaden permissions or delete state merely because the visible symptom is inconvenient.
Caveat
Public project records are mutable. Source state was captured at publication time, and later revisions may change status, scope or evidence. No source here authorizes automatic mutation of a reader’s deployment.
Source inspected; source state, environment and release boundary remain explicit.