IronClaw gives automations structured execution contracts

nearai/ironclaw PR #7548 is the inspected primary source: “feat(automations): add structured execution contracts.” The related records below were inspected as supporting context rather than independent confirmation.

The facts

- nearai/ironclaw PR #7548 was created 2026-08-12T16:03:28Z and was open at inspection; its title is “feat(automations): add structured execution contracts.” - nearai/ironclaw PR #7551 was created 2026-08-12T17:10:32Z and was open at inspection; its title is “fix(loop-host): repair unavailable capability calls without aborting runs.” - nearai/ironclaw PR #7556 was created 2026-08-12T21:24:28Z and was open at inspection; its title is “Add Railway sandbox workspace file bridge.” - The repository reported 12605 stars, 1490 open issues, default branch main, and last push 2026-08-13T01:04:07Z. - The latest tagged-release baseline checked was ironclaw-v1.2.0-rc.3 published 2026-08-12T23:01:21Z.

What changed

nearai/ironclaw PR #7548 reports: Summary Add a versioned structured execution contract for scheduled automations: goal, success criteria, output instructions, no-result behavior, allowed capabilities, and required skills. Require execution_contract for every newly created automation; the model-visible and runtime create surfaces no longer accept the legacy raw prompt field. Preserve existing raw-prompt automations: stored rows with execution_spec_json = NULL remain readable and continue executing their frozen prompt without backfill. Validate model-visible capabilities and runtime-selectable skills before persistence, then propagate the resulting neutral execution policy only through the sealed trusted-trigger path. Persist the optional contract in libSQL and PostgreSQL and enforce capability narrowing plus fail-closed required-skill activation before the first model call. Change Type [x] Bug fix [x] New feature [ ] Refactor [x] Documentation [ ] CI/Infrastructure [x] Security [ ] Dependencies Linked Issue Closes #7532 Related #6879 Validation [x] cargo fmt --all [x] cargo clippy -p ironclaw_host_runtime --all-targets --all-features -- -D warnings [x] cargo test -p ironclaw_architecture_tests [x] Relevant unit, capability, integration, replay, fixture, and legacy-execution tests pass. [ ] Full workspace clippy was not rerun; the strict affected-crate lane

nearai/ironclaw PR #7551 reports: Summary Remove the prompt-text unavailable-capability guard. User prose is not an authoritative capability surface and must not suppress otherwise valid provider calls. Treat an actual provider call outside the listedd or resolvable capability surface as one-shot repairable model output. Keep repair atomic: no call from the rejected batch is registered or executed; the provider receives model-visible feedback and may retry with an available capability or answer directly. Change Type [x] Bug fix [ ] New feature [ ] Refactor [ ] Documentation [ ] CI/Infrastructure [x] Security [ ] Dependencies Linked Issue Related #7163 Validation [x] cargo fmt --all -- --check [x] Scoped clippy: cargo clippy -p ironclaw_loop_host --all-targets --all-features -- -D warnings [ ] cargo build (covered by the crate test and clippy builds) [x] Relevant tests pass: cargo test -p ironclaw_loop_host [ ] Database/runtime integration feature tests (not applicable: no database or runtime backend changed) [x] Manual investigation: correlated the Railway failure with the terminal OutsideCapabilitySurface path and reproduced it deterministically at the provider-to-capability registration seam [ ] Two Track C approvals and

nearai/ironclaw PR #7556 reports: Summary add builtin.sandbox_workspace_copy for copying one regular file between the IronClaw runtime workspace and a Railway sandbox workspace expose the file bridge only when the Railway sandbox transport is configured; local Docker retains the existing shell-only behavior teach the Railway shell prompt about the separate workspaces and when to copy inputs/results Why Railway boots the sandbox shell in a separate VM workspace. Files uploaded to or produced in IronClaw's scoped runtime workspace are therefore unavailable to sandbox commands such as PDF parsers. The inverse is also true for files produced by those commands. This introduces a narrow, typed bridge instead of exposing Railway credentials or a general host filesystem API to the model. Behavior and safety supports ironclaw_to_sandbox and sandbox_to_ironclaw copies one regular file per call; no move, delete, directory, recursive sync, or glob operations limits files to 10 MiB defaults to no-clobber; replacement requires overwrite: true confines remote paths below /workspace, rejects traversal, symlinks, oversized paths, and oversized path components before provisioning verifies byte counts and SHA-256 digests before reporting success publishes uploads atomically

Why it matters

Automations are difficult to recover when inputs, outputs and capability failures are only text. A file bridge adds another custody boundary that needs the same contract discipline. The operator test is whether visible output, retained state and authority still describe the same event after retries, background work or restart.

Current

The primary record was open when captured on 2026-08-13. The tagged-release baseline was ironclaw-v1.2.0-rc.3 published 2026-08-12T23:01:21Z. Repository metadata, full source bodies, current pull requests and issues, releases, Google News, Hacker News, Lobsters, Metamesh and the rendered ClawCharts row were inspected. ClawCharts selected the subject; it did not prove the claim.

Evidence

The primary URL is https://github.com/nearai/ironclaw/pull/7548. Supporting records are https://github.com/nearai/ironclaw/pull/7551 and https://github.com/nearai/ironclaw/pull/7556. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts and reproductions remain attributed to their authors unless identified as independently rerun.

Source boundary

Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.

Operator take

Version execution contracts, distinguish unavailable capability from failed work, and bind every bridged file to one sandbox, run and retention policy. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently.

Caveat

Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.

Source inspected; source state, environment and release boundary remain explicit.