IronClaw
IronClaw repairs a startup migration that could strand rc1 state
IronClaw proposes a lossless 1.0.0-rc.1 to 1.1.0-rc.1 migration after identifying missing destination directories, absent backup restore, non-idempotent behavior and weak provenance. A companion Windows release-smoke fix supplies the identity variables the migration path expects.
nearai/ironclaw PR #7198 is the inspected primary source: “fix(migration): preserve rc1 state during 1.1 startup.” The related records below were inspected as supporting context rather than independent confirmation.
The facts
- nearai/ironclaw PR #7198 was created 2026-08-04T23:46:37Z and was open at inspection; its title is “fix(migration): preserve rc1 state during 1.1 startup.” - nearai/ironclaw issue #7178 was created 2026-08-04T21:04:29Z and was open at inspection; its title is “Make the 1.0.0-rc.1 → 1.1.0-rc.1 startup migration lossless.” - nearai/ironclaw PR #7197 was created 2026-08-04T22:58:55Z and was closed at inspection; its title is “ci: pass the Windows identity variables to the release smoke.” - The repository reported 12589 stars, 1516 open issues, default branch main, and last push 2026-08-05T01:21:46Z. - The latest tagged-release baseline checked was ironclaw-v1.0.0 published 2026-07-27T19:32:01Z.
What changed
nearai/ironclaw PR #7198 reports: Summary run the exact 1.0.0-rc.1 → 1.1.0-rc.1 record migration before runtime writers start preserve and re-index every thread and append-only message, including identical scopes in different tenants migrate channel roots, idempotency, processes, OAuth aliases, extension installations/activation, and Slack/Telegram setup state with fail-closed conflicts and durable restart read-back retain rc1 authorities, publish redacted per-domain/per-scope completion records, and document the migration/rollback matrix isolate the bounded release-pair coordinator in ironclaw_release_migration, leaving composition with startup wiring and barrier ordering only Change Type [x] Bug fix [x] New feature [x] Refactor [x] Documentation [x] CI/Infrastructure [x] Security [ ] Dependencies Linked Issue Fixes #7178 Validation [x] cargo fmt --all -- --check [x] Scoped warning-denied clippy for all affected packages, including ironclaw_release_migration and ironclaw_reborn_composition [x] cargo build -p ironclaw --bin ironclaw [x] Relevant tests pass: owning contract suites, full composition suite, architecture suite, and release-pair migration tests [x] bash scripts/ci/check-composition-budget.sh passes after moving release policy out
nearai/ironclaw issue #7178 reports: Problem Upgrading the shipped Reborn binary from ironclaw-v1.0.0-rc.1 to ironclaw-v1.1.0-rc.1 is not currently a lossless automatic migration. Compared releases: ironclaw-v1.0.0-rc.1: 8257215700fd75a3636338e969605f5dee8f99c4 ironclaw-v1.1.0-rc.1: ae1dc1178ace23a345e941dd17eb0e93bf77a704 PostgreSQL migrations V33/V34 are necessary, but they only add and correctly collate the ordered-index substrate. They do not populate application projections or move records whose authorities/paths changed. We have already observed threads appearing lost during a large PR. There are at least three independent ways this upgrade can produce that symptom: 1. Thread headers still exist, but the 1.1 ordered sidebar projection cannot find them. 2. Finalized assistant messages exist only in the rc1 append log, which the 1.1 transcript migration does not read. 3. Slack/Telegram conversation bindings still point at the old channel-specific roots, so subsequent inbound messages fork onto different canonical threads. Required migration matrix | Priority | State | 1.0 source → 1.1 target | Current status | Required behavior | | --- |
nearai/ironclaw PR #7197 reports: Scope reduced.** This PR previously also changed how the product resolves the Windows ACL account. That is now removed — it touches behavior that has shipped since 1.0.0, and a release branch is the wrong place to change it. See "Deliberately not fixed here" below. The blocker Preflight run 30955514028 got past the parent-directory fsync bug fixed in #7182 — 6 of 7 targets green — and Windows failed with: Cause scripts/ci/smoke-release-binary.py runs the packaged binary in a scrubbed environment built from an allow-list (_PASSTHROUGH_ENV). USERNAME/USERDOMAIN were not on it. The product reads those to pick the account icacls grants sole access to the standalone secrets master key, and fails closed when it cannot. The GitHub Windows runner does set USERNAME (runneradmin) — the harness was explicitly withholding it. Fix Add both to the allow-list. Every real Windows session sets them, so withholding them made the harness model a *service
Why it matters
Startup migration is an authority transfer. If the process can move state without a durable backup, provenance marker and idempotent rerun, a successful upgrade can still erase operator trust. The operator test is whether persisted state, execution authority and the visible outcome describe the same event after retries, restarts or delegation.
Current
The primary record was open when captured on 2026-08-05. The release baseline was ironclaw-v1.0.0 published 2026-07-27T19:32:01Z. Repository metadata, pull requests, issues, release records, Google News discovery, Hacker News discovery, Lobsters, Metamesh and the rendered ClawCharts row were checked. ClawCharts selected the subject; it did not prove the claim.
Evidence
The primary URL is https://github.com/nearai/ironclaw/pull/7198. Supporting records are https://github.com/nearai/ironclaw/issues/7178 and https://github.com/nearai/ironclaw/pull/7197. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts, reproductions and deployment observations remain attributed to their authors unless explicitly identified as independently rerun.
Source boundary
Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.
Operator take
Require backup verification, rerun the migration twice, test interrupted copy and rollback, and keep Windows release-smoke identity aligned with production startup. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently after intervention.
Caveat
Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.
Source inspected; source state, environment and release boundary remain explicit.