IronClaw makes sandbox and network defaults explicit

nearai/ironclaw PR #7214 is the inspected primary source: “feat(sandbox): add explicit Docker and Railway user sandbox profiles.” The related records below were inspected as supporting context rather than independent confirmation.

The facts

- nearai/ironclaw PR #7214 was created 2026-08-05T07:56:01Z and was open at inspection; its title is “feat(sandbox): add explicit Docker and Railway user sandbox profiles.” - nearai/ironclaw PR #7027 was created 2026-08-03T00:32:12Z and was open at inspection; its title is “fix(network): disable ambient proxy discovery.” - nearai/ironclaw PR #7253 was created 2026-08-05T15:34:49Z and was open at inspection; its title is “fix: keep custom MCP registration private and definition-only.” - The repository reported 12590 stars, 1516 open issues, default branch main, and last push 2026-08-06T00:59:16Z. - The latest tagged-release baseline checked was ironclaw-v1.1.0-rc.1 published 2026-08-05T04:13:21Z.

What changed

nearai/ironclaw PR #7214 reports: Summary Add explicit Docker and Railway user-sandbox profiles. The Docker profile uses local Docker; the Railway profile uses Railway without probing Docker. Scope workspaces/checkpoints to tenant plus user, and run each command in a fresh non-root Python worker with no caller environment or credentials. Sandbox-enabled profiles explicitly opt into unrestricted direct Docker/provider-NAT egress; ad-hoc transports remain networkless by default. Centralize construction behind composition functions that return a complete typed runtime binding, enforce the matching production process binding, and keep non-sandbox profiles unchanged. Add real-Docker/full-turn tests, Railway transport tests and operator docs, plus CI coverage for production profile selection and the real-Docker lane. Change Type [ ] Bug fix [x] New feature [x] Refactor [x] Documentation [x] CI/Infrastructure [x] Security [x] Dependencies Linked Issue Related #6468, #6469, #6473. Validation [x] cargo fmt --all -- --check [ ] cargo clippy --all --benches --tests --examples --all-features -- -D warnings (affected packages passed scoped

nearai/ironclaw PR #7027 reports: Summary disable reqwest system-proxy discovery in the hardened Reborn network transport so approved, pinned destination addresses remain authoritative add real HTTP and HTTPS ambient-proxy regression contracts that prove the destination hostname does not reach a proxy and the pinned address is used register the contract in the Reborn substrate suite and document that ambient proxy variables are ignored on this boundary Change Type [x] Bug fix [ ] New feature [ ] Refactor [x] Documentation [ ] CI/Infrastructure [x] Security [ ] Dependencies Linked Issue Fixes #7016 Validation [x] cargo fmt --all -- --check [ ] cargo clippy --all --benches --tests --examples --all-features -- -D warnings — not run workspace-wide; the stricter affected-package check below passed [ ] cargo build — not run separately; the focused and full crate test builds passed [x] Relevant tests pass: corrected focused ambient-proxy regression repeated 10 times (10/10); full ironclaw_network suite (57 passed); Reborn

nearai/ironclaw PR #7253 reports: Summary Keep hosted-MCP registration definition-only: registration admits a catalog definition and creates no installation, setup state, activation, or publication. Persist independent definition manager and visible-member sets, initialized to the authenticated registering user. Enforce creator-only visibility through catalog search and direct package resolution, including restart and guessed-ID paths. Reuse the same non-empty user-membership value object for definition visibility and installation ownership while preserving their separate lifecycles. Keep the ordinary Install action as the only transition into installation membership and activation. Future access management is intentionally not exposed in this PR. A future management operation may authorize either an explicit persisted manager or a caller's live tenant-admin role; admin IDs must not be snapshotted into definition membership. Change Type [x] Bug fix [ ] New feature [x] Refactor [x] Documentation [ ] CI/Infrastructure [x] Security [ ] Dependencies Linked Issue None. Reported directly as a cross-user custom-MCP visibility bug. Validation [x] cargo

Why it matters

Ambient proxy variables and implicit sandbox assumptions let a deployment inherit authority it never declared. Private MCP definitions also need to remain configuration, not accidental public capability surfaces. The operator test is whether persisted state, execution authority and the visible outcome describe the same event after retries, restarts or delegation.

Current

The primary record was open when captured on 2026-08-06. The release baseline was ironclaw-v1.1.0-rc.1 published 2026-08-05T04:13:21Z. Repository metadata, pull requests, issues, release records, Google News discovery, Hacker News discovery, Lobsters, Metamesh and the rendered ClawCharts row were checked. ClawCharts selected the subject; it did not prove the claim.

Evidence

The primary URL is https://github.com/nearai/ironclaw/pull/7214. Supporting records are https://github.com/nearai/ironclaw/pull/7027 and https://github.com/nearai/ironclaw/pull/7253. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts, reproductions and deployment observations remain attributed to their authors unless explicitly identified as independently rerun.

Source boundary

Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.

Operator take

Require an explicit sandbox profile, test direct and proxied egress separately, and verify custom MCP registration does not publish or execute beyond its declared lane. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently after intervention.

Caveat

Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.

Source inspected; source state, environment and release boundary remain explicit.