IronClaw removes one direct secret-store edge and finds another

nearai/ironclaw PR #7096 is the inspected primary source: “refactor(operator,contracts): route operator secrets through a product_contracts port (WS3).” The related records below were inspected as supporting context rather than independent confirmation.

The facts

- nearai/ironclaw PR #7096 was created 2026-08-04T00:54:18Z and was open at inspection; its title is “refactor(operator,contracts): route operator secrets through a product_contracts port (WS3).” - nearai/ironclaw issue #7095 was created 2026-08-04T00:33:27Z and was open at inspection; its title is “products-tier: ironclaw_extension_manager still holds a direct ironclaw_secrets edge (§8.2).” - nearai/ironclaw PR #7077 was created 2026-08-03T20:12:25Z and was open at inspection; its title is “fix(auth): one vendor authorization covers every installed extension sharing the account.” - The repository reported 12585 stars, 1473 open issues, default branch main, and last push 2026-08-04T00:59:44Z. - The latest tagged-release baseline checked was ironclaw-v1.0.0 published 2026-07-27T19:32:01Z.

What changed

nearai/ironclaw PR #7096 reports: Wave 3, the **secrets direct-consumer tightening** row (CHECKLIST WS3, PROPOSAL §6.2.2 / §8.2 / §12.1b). Based on origin/main at 0f897e9366. **Security-sensitive**, and the ordering constraint is what shaped the diff. Tighten direct secrets consumers: remove the webui and operator edges via product_contracts ports; keep auth by charter; add the boundary rule. **(security-sensitive — PROPOSAL §12.1b; port replacements land first)** The row names two edges. Measured against this base there was one — and the crate it does *not* name is the one still open.** What was actually there | crate | layer | ironclaw_secrets at 0f897e9366 | disposition | |---|---|---|---| | ironclaw_webui | products | **dev-only, and always was** | already closed — no code, no rule | | ironclaw_auth | **substrates** | normal

nearai/ironclaw issue #7095 reports: ironclaw_extension_manager declares layer = "products" and holds a **normal** ironclaw_secrets dependency, used in production code: crates/ironclaw_extension_manager/src/admin_configuration.rs:22 — AdminConfigurationService crates/ironclaw_extension_manager/src/admin_configuration_capability.rs:29 — use ironclaw_secrets::SecretMaterial; (the remaining hits in that crate — channel_config_product_service.rs, extension_lifecycle_capabilities.rs, test_support/lifecycle.rs — are test/test-support.) PROPOSAL §8.2's product/ row says **"product/operator lose direct secrets (§6.2.2)"**. CHECKLIST WS3's row names only webui and operator because **this crate did not exist when the row was written** — it landed with WS2.4 (#7018), after the row. So the rule covers it and the row does not, which is why the WS3 secrets slice could close its own scope while leaving a products-tier crate holding the substrate. Surfaced while executing the WS3 secrets-tightening row. Measured at 0f897e9366; after that slice, ironclaw_extension_manager is the **only** products-layer crate with a normal

nearai/ironclaw PR #7077 reports: fix(auth): one vendor authorization covers every installed extension sharing the account Closes #7069 Verified bug On recent origin/main (f3cf3f21c), each Google service asks for its own Google authorization, and a service whose scopes are not on the account keeps returning auth_required. Reproduced as a failing test before the fix: Root cause An OAuth credential account is SHARED by every installed extension of a vendor — that is what the unified vendor recipe (ironclaw_extension_host::unified_vendor_recipes) and the Google-family credential visibility policy exist for. But the authorization REQUEST was scoped to a single extension: crates/ironclaw_auth/src/product_auth/oauth/oauth_gate.rs:137 and crates/ironclaw_webui/src/product_auth/oauth.rs:161 request only requirement.provider_scopes. The account stores ONE scope set that each exchange replaces (domain.rs:188), clamped to the recipe ceiling (engine/exchange.rs:474). Dispatch requires every scope to already be present (runtime_credentials.rs:533 account_has_provider_scopes); missing

Why it matters

The patch improves more than dependency geometry: products can no longer select arbitrary secret scopes, invoke lease vocabulary or receive substrate error detail. The remaining extension-manager edge and store-wide OAuth ceiling show the boundary is incomplete, not disproven. The operator test is whether persisted state, execution authority and the visible user outcome describe the same event after retries, restarts or delegation.

Current

The primary record was open when captured on 2026-08-04. The release baseline was ironclaw-v1.0.0 published 2026-07-27T19:32:01Z. Repository metadata, pull requests, issues, release records, Google News discovery, Hacker News discovery, Lobsters, Metamesh and the rendered ClawCharts row were checked. ClawCharts selected the subject; it did not prove the claim.

Evidence

The primary URL is https://github.com/nearai/ironclaw/pull/7096. Supporting records are https://github.com/nearai/ironclaw/issues/7095 and https://github.com/nearai/ironclaw/pull/7077. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts, reproductions and deployment observations remain attributed to their authors unless explicitly identified as independently rerun.

Source boundary

Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.

Operator take

Land port replacements before dependency bans, give extension_manager its own boundary rule, and scope vendor consent to the caller rather than the installation store. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently after intervention.

Caveat

Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.

Source inspected; source state, environment and release boundary remain explicit.