IronClaw
IronClaw teaches its agent to stop claiming unverified state
IronClaw proposes suppressing assertions about automation status, extension authorization and recalled memory when the runtime lacks evidence. Related trace work reduces raw logprobs to confidence envelopes, while a durable-memory parity matrix checks that remembered state survives different backends.
nearai/ironclaw PR #7474 is the inspected primary source: “fix(qa): stop the agent asserting unverified state — automation status, per-caller extension auth, recalled memory (#7246, #7247, #7294).” The related records below were inspected as supporting context rather than independent confirmation.
The facts
- nearai/ironclaw PR #7474 was created 2026-08-10T23:53:02Z and was open at inspection; its title is “fix(qa): stop the agent asserting unverified state — automation status, per-caller extension auth, recalled memory (#7246, #7247, #7294).” - nearai/ironclaw PR #7469 was created 2026-08-10T20:31:53Z and was open at inspection; its title is “feat(traces): reduce captured logprobs to envelope confidence aggregates.” - nearai/ironclaw PR #7426 was created 2026-08-10T09:10:26Z and was open at inspection; its title is “feat(stress): add durable memory parity matrix.” - The repository reported 12601 stars, 1476 open issues, default branch main, and last push 2026-08-11T01:01:32Z. - The latest tagged-release baseline checked was ironclaw-v1.1.1-rc.1 published 2026-08-10T13:58:58Z.
What changed
nearai/ironclaw PR #7474 reports: Summary Fixes the three Railway-QA "agent asserts state it never verified" bugs as one batch, one commit per issue, each reproduced deterministically before the fix. **#7246** — the model could always check automation state (builtin.trigger_list is core-tier, always listedd, allowed on scheduled fires) but nothing mapped "automations/routines" vocabulary to it or demanded check-before-assert. The tool description and input-schema description now bridge the vocabulary, declare the listing authoritative, require calling it before asserting a routine exists/is running/is missing, and ground the empty result ("say exactly that"). Mirrors the proven builtin__outbound_delivery_targets_list grounding pattern. **#7247** — the communication context hard-coded authenticated: true for every host-Active channel extension, and carried zero per-caller credential truth for tools-only extensions (the GitHub repro). The context provider now resolves per-caller truth through the same runtime credential selector the auth gate uses (via ExtensionCredentialSetupService + channel-connection ports wired in composition), renders channels with real per-caller authenticated, adds a bounded "installed but not authenticated for this user … offer to connect" line for pending-auth extensions, and fails closed to Unknown (claims nothing in either direction)
nearai/ironclaw PR #7469 reports: Stacked on #7468 — review that first. This is the consumer that PR deliberately left unbuilt. Why the reduction exists Raw per-token distributions cannot reach Trace Commons. The ingest limit is 2 MiB and top-5 logprobs for a typical trace is several times that, so the reduction has to happen where the raw data already lives, and only four numbers travel. That is the recommendation in TraceCommons/trace-commons-server#253, and the envelope side of it is TraceCommons/trace-commons-server#255. It is also the privacy-preserving order. The distributions are conditioned on the entire context; the aggregates are not invertible into it. What this adds Reading the sidecar back** — read_records and read_token_probabilities, the latter yielding exp(logprob) per emitted token. Malformed lines are skipped rather than failing the read: the file is append-only and written best-effort, so a truncated final line after a hard kill is expected rather than exceptional. A test writes a truncated line and asserts the earlier records survive. Logprobs that do not exponentiate into a probability are **dropped rather than clamped** — repairing one would bias the
nearai/ironclaw PR #7426 reports: Summary Add production-wired scripted memory_roundtrip, memory_grow, and memory_mixed workloads across 4 KiB, 32 KiB, 128 KiB, and 1 MiB documents. Keep large plans inside provider and agent-loop limits with exact-size singleton chunks, stateful compaction recovery, bounded contention retries, provider-directed retry delays, and durable read-back verdicts. Add nightly libSQL coverage, PostgreSQL four-size parity coverage, per-script artifacts, zero-tolerance failure gates, and runner-scoped workflow contract tests. This PR contains stress harness, CI, tests, and documentation only. The generic production fix for oversized native-memory search results is #7436 and must land first. Change Type [ ] Bug fix [x] New feature [ ] Refactor [x] Documentation [x] CI/Infrastructure [ ] Security [ ] Dependencies Linked Issue Related #7360 Validation [x] cargo fmt --all -- --check [ ] Workspace-wide clippy [x] cargo build [x] Relevant tests pass: ironclaw_stress — 170 passed; workflow contract sabotage suite — 88 passed [ ] Crate integration feature (not applicable: the stress package exposes no required integration feature for this path) [x] Manual testing: combined with #7436, the exact libSQL nightly matrix completed 32/32 with
Why it matters
Agent trust is spent when fluent output outruns runtime evidence. Confidence summaries and memory tests help only if the final answer preserves uncertainty instead of converting absence into a claim. The operator test is whether visible output, retained state and authority still describe the same event after retries, background work or restart.
Current
The primary record was open when captured on 2026-08-11. The tagged-release baseline was ironclaw-v1.1.1-rc.1 published 2026-08-10T13:58:58Z. Repository metadata, full source bodies, current pull requests and issues, releases, Google News, Hacker News, Lobsters, Metamesh and the rendered ClawCharts row were inspected. ClawCharts selected the subject; it did not prove the claim.
Evidence
The primary URL is https://github.com/nearai/ironclaw/pull/7474. Supporting records are https://github.com/nearai/ironclaw/pull/7469 and https://github.com/nearai/ironclaw/pull/7426. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts and reproductions remain attributed to their authors unless identified as independently rerun.
Source boundary
Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.
Operator take
Attach evidence state to model-visible facts, make unknown a valid result, and test that backend changes preserve both memory content and the caveats attached to it. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently.
Caveat
Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.
Source inspected; source state, environment and release boundary remain explicit.