IronClaw
IronClaw assembles an eight-part Ledger clear-signing path
IronClaw’s final signing stack adds signed intent, out-of-band review, device ceremony, driver-side verification and a supervised sidecar. Adjacent groups add tenant isolation, trust registration and an attested gate-resolution path that verifies and claims before advancing the turn.
nearai/ironclaw PR #6818 is the inspected primary source: “feat(signing): Ledger clear-signing product — intent, review, ceremony, sidecar (8/8).” The two related records below were inspected as supporting context, not treated as independent confirmation.
The facts
- nearai/ironclaw PR #6818 was created 2026-07-28T18:29:53Z and was open at inspection; its title is “feat(signing): Ledger clear-signing product — intent, review, ceremony, sidecar (8/8).” - nearai/ironclaw PR #6813 was created 2026-07-28T17:24:12Z and was open at inspection; its title is “feat(signing): multi-tenant isolation, trust registration, KMS ship-gate (7/8).” - nearai/ironclaw PR #6822 was created 2026-07-28T19:39:20Z and was open at inspection; its title is “feat(signing): attested gate resolve on the capability-dispatch model.” - The repository reported 12572 stars, 1414 open issues, default branch main, and last push 2026-07-30T01:01:37Z. - The latest tagged-release baseline checked was ironclaw-v1.0.0 published 2026-07-27T19:32:01Z.
What changed
nearai/ironclaw PR #6818 reports: What Group 8 of 8 — the final group.** Stacks on #6813. The Ledger clear-signing product: **Phase B** — the signed intent (agent attestation that it crafted *exactly this transaction for exactly this approver*) and the per-agent key lifecycle with 24h rotation overlap **Phase C** — the out-of-band review link, the authenticated intent read, and the /review/:intentId page **Phase D** — the device ceremony, DMK adapter, driver-side signature verification, and the ERC-7730 descriptor proxy **Phase E** — the Alpaca sidecar with its supervised child lifecycle Full design rationale is in
nearai/ironclaw PR #6813 reports: What Group 7 of 8.** Stacks on #6811. The hardening layer over the attested-signing substrate: **Multi-tenant operating model** with cross-tenant isolation tests **TrustEnrollment ceremony** and connected-wallet trust registration — domain-separated challenge digest, constant-time comparison, single-use challenge consumption **Grant expiry, tenant-keyed bindings, retryable consistency**, and the attested-continuation coherence follow-ups **KMS curve-capability fail-closed** on the custodial mainnet ship-gate: a backend that cannot prove it supports the curve it was asked for refuses, rather than signing on an assumption Porting Only one fix needed: FailureKind::InvalidInput → InputEncode, matching group 6's mapping onto main's
nearai/ironclaw PR #6822 reports: What The **attested gate/resolve ingress**, deferred from #6769 and now re-expressed for current main. Stacks on #6818. The old stack routed this through a WebUI-inbound facade that main **deleted outright** — webui_inbound has zero references there — and replaced with capability/command dispatch. Since RESOLVE_GATE_COMMAND already exists, an attested resolve is **a gate resolution carrying a claim**, not a new command. It therefore inherits the existing authorization, audit, and safety pipeline instead of standing up a second dispatch surface. The cross-user IDOR contract — the load-bearing part An attested resolution routes
Why it matters
Hardware signing is not a button; it is a chain of identity, intent, review, one-shot authorization and state transition. A dead authorization guard or alternate dispatch path can erase the value of the device ceremony. This is an operator boundary: persisted state, execution ownership and visible controls must describe the same event. A workaround that broadens access, deletes state or hides the symptom would trade a visible defect for an unmeasured one.
Current
The primary record was open when captured on 2026-07-30. The release baseline was ironclaw-v1.0.0 published 2026-07-27T19:32:01Z. Current repository metadata, pull requests, issues, release records, Google News discovery, Hacker News discovery, Lobsters, Metamesh and the rendered ClawCharts row were checked. ClawCharts selected the subject; it did not prove the claim.
Evidence
The primary URL is https://github.com/nearai/ironclaw/pull/6818. Supporting records are https://github.com/nearai/ironclaw/pull/6813 and https://github.com/nearai/ironclaw/pull/6822. Their source bodies, timestamps and states were captured in the daily evidence bundle. Test counts, reproductions and deployment observations remain attributed to their authors unless explicitly identified as independently rerun.
Source boundary
Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Issue closure would not by itself prove a deployed fix. Search residue, package mirrors and historically published source spines were excluded.
Operator take
Require physical-device verification before calling the path production-ready, preserve indistinguishable rejection shapes, and ensure failed proof never mutates the blocked turn. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently after intervention.
Caveat
Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.
Source inspected; source state, environment and release boundary remain explicit.