IronClaw
IronClaw binds IronHub installs to verified package identity
IronClaw’s IronHub patch verifies package identity before install and carries the claimed owner, name and digest through the gateway. Related work adds private-manifest deep links and makes skill activation refusals explain missing requirements instead of failing as vague discovery misses.
nearai/ironclaw PR #6933 is the inspected primary source: “fix(ironhub): bind installs to verified package identity.” The two related records below were inspected as supporting context, not treated as independent confirmation.
The facts
- nearai/ironclaw PR #6933 was created 2026-07-30T19:51:53Z and was open at inspection; its title is “fix(ironhub): bind installs to verified package identity.” - nearai/ironclaw PR #6780 was created 2026-07-28T10:56:59Z and was open at inspection; its title is “feat(reborn-ironhub): deep-link register/install gateway + private manifest source.” - nearai/ironclaw PR #6938 was created 2026-07-31T00:55:54Z and was open at inspection; its title is “fix(skills): explain activation refusals, enforce requirements, survive discovery limits.” - The repository reported 12578 stars, 1428 open issues, default branch main, and last push 2026-07-31T00:55:52Z. - The latest tagged-release baseline checked was ironclaw-v1.0.0 published 2026-07-27T19:32:01Z.
What changed
nearai/ironclaw PR #6933 reports: Summary Stack on #6780 and bind install approval to a versioned SHA-256 package digest covering the full catalog entry, including manifest artifact metadata. Require model-facing installs to provide the version and digest returned by ironhub_info, so catalog changes fail before artifact download. Reject signed manifests older than 30 days or more than five minutes in the future, while allowing an identical private manifest to retry after an artifact or lifecycle failure. Keep registry publisher descriptions on the untrusted prompt surface; a valid package signature authenticates origin and bytes, not prompt
nearai/ironclaw PR #6780 reports: Summary Re-port of #5409 (@neo-sky) onto the current extension-host layout. The design is @neo-sky's and is followed as specified. What this adds: **Public register handshake** — POST /api/ironhub/register with HMAC-SHA256, mounted outside bearer auth, plus the bearer-authenticated ironhub_deliver_install route on the v2 WebUI surface. **Caller-scoped delivery** — install delivery and nonce consumption are scoped to the authenticated caller, so one caller cannot consume another caller's nonce. **Private manifest source** — Ed25519-signed org-scoped manifests install from the configured catalog host behind a Private provenance tier that is rejected unless the install
nearai/ironclaw PR #6938 reports: Epic #6565 — the **missing/unusable skill** half. Companion to #6937 (routing/scoring). The epic says several of these states are "silent or reported only as 'not available'". Four of them were, and this makes each one say what happened. 1. A refusal now says *why* select_named_skill_activations reported a skill that exists but is not Trusted with the same string as a name that does not exist at all — "requested skill is not available". Those need opposite responses from the model ("try a different name" vs "this needs promoting and no
Why it matters
A marketplace name is not an identity. Installation needs a verified package coordinate, immutable artifact reference and a UI that distinguishes discovery, policy refusal and missing runtime requirements. This is an operator boundary: persisted state, execution ownership and visible controls must describe the same event. A workaround that broadens access, deletes state or hides the symptom would trade a visible defect for an unmeasured one.
Current
The primary record was open when captured on 2026-07-31. The release baseline was ironclaw-v1.0.0 published 2026-07-27T19:32:01Z. Current repository metadata, pull requests, issues, release records, Google News discovery, Hacker News discovery, Lobsters, Metamesh and the rendered ClawCharts row were checked. ClawCharts selected the subject; it did not prove the claim.
Evidence
The primary URL is https://github.com/nearai/ironclaw/pull/6933. Supporting records are https://github.com/nearai/ironclaw/pull/6780 and https://github.com/nearai/ironclaw/pull/6938. Their source bodies, timestamps and states were captured in the daily evidence bundle. Test counts, reproductions and deployment observations remain attributed to their authors unless explicitly identified as independently rerun.
Source boundary
Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Issue closure would not by itself prove a deployed fix. Search residue, package mirrors and historically published source spines were excluded.
Operator take
Verify owner and digest at the final install boundary, not only search time; preserve private-source provenance and ensure truncated discovery results cannot be mistaken for an authorization decision. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently after intervention.
Caveat
Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.
Source inspected; source state, environment and release boundary remain explicit.