IronClaw moves capability receipts onto gate and terminal edges

nearai/ironclaw PR #7678 is the inspected primary source: “perf(capabilities): persist invocation state at gate and terminal edges.” The related records below were inspected as supporting context rather than independent confirmation.

The facts

- nearai/ironclaw PR #7678 was created 2026-08-15T10:21:46Z and was open at inspection; its title is “perf(capabilities): persist invocation state at gate and terminal edges.” - nearai/ironclaw issue #7673 was created 2026-08-15T03:48:43Z and was open at inspection; its title is “BudgetLedger accounting refinements: truncated-launch reconciliation and charge durability.” - nearai/ironclaw PR #7677 was created 2026-08-15T07:24:32Z and was open at inspection; its title is “perf(threads): fold message lookup indexes into message rows.” - The repository reported 12602 stars, 1496 open issues, default branch main, and last push 2026-08-16T00:49:14Z. - The latest tagged-release baseline checked was ironclaw-v1.2.0 published 2026-08-13T23:30:51Z.

What changed

nearai/ironclaw PR #7678 reports: Summary Keep fresh capability invocation state worker-local instead of journaling queued and claimed transitions. Atomically materialize capability invocations at completed, failed, approval-blocked, or auth-blocked edges. Preserve lease-fenced cross-worker resume after a durable gate suspension. Retain fail-closed BeforeSideEffect checkpoint evidence and prove recovery does not redispatch uncertain tool calls. Change Type [ ] Bug fix [x] New feature [ ] Refactor [ ] Documentation [ ] CI/Infrastructure [ ] Security [ ] Dependencies Linked Issue Closes #7598 Validation [x] cargo fmt --all -- --check [x] cargo clippy --all --benches --tests --examples --all-features -- -D warnings [ ] cargo build [x] Relevant tests pass: process, capability, host-runtime, turn, architecture, and lease-wedge suites listed below [ ] cargo test -p --features integration if database-backed or runtime-integration behavior changed (not applicable: no crate-level integration feature owns this process-journal path) [ ] Manual testing: not applicable; behavior is a durable runtime contract exercised through Rust integration tests [ ] If a coding agent was used and supports it, review-pr or pr-shepherd --fix was run before requesting review (not available in this worktree; no-mistakes is not initialized) Test Strategy User behavior: Capability calls return the same results and gate interactions. The change is internal write-pressure reduction; users should observe no new states or retry behavior. Risk

nearai/ironclaw issue #7673 reports: From #7634 review (threads 3787976845, 3787976849). Two bounded gaps in the BudgetLedger chokepoint, both erring conservative (over-count → earlier stop; never cap-exceed): 1. Truncated launch windows double-charge: CapabilityStage charges try_charge_invocations(visible_calls.len()) before invoke_batch; a truncated launch window can leave charged-but-unlaunched calls that get charged again when relaunched on a resumed pass. Fix direction: reconcile the charge against actually-launched outcomes after invoke_batch, or add a narrow refund seam on the ledger for the unlaunched tail — either way with a two-pass (truncate → resume) regression test at the caller. 2. Charges are memory-only between checkpoints: a crash between a charge and the next durable checkpoint reloads the lower count on resume (at-most-once accounting). The design doc assigns crash recovery to the turn layer, so this may be an accepted boundary — decide explicitly (durable per-attempt reservation vs documented at-most-once) rather than leaving it implicit; per-dispatch checkpointing has real IO/latency cost.

nearai/ironclaw PR #7677 reports: Summary Store exact message lookup keys as indexed projections on the message entry instead of writing 1-3 sibling entry rows per message. Preserve exact lookup behavior for assistant runs, tool results, provider calls, first-user titles, and capability previews, with legacy sibling-row fallback for existing data. Add a v2 transcript projection migration and durable-backend coverage that asserts lookups resolve while no new /indexes/ entry rows are written. Change Type [ ] Bug fix [ ] New feature [x] Refactor [x] Documentation [ ] CI/Infrastructure [ ] Security [ ] Dependencies Linked Issue Closes #7605 Related #7591 Validation [x] cargo fmt --all -- --check [ ] cargo clippy --all --benches --tests --examples --all-features -- -D warnings (focused owning-crate clippy passed; full-workspace clippy was not run) [ ] cargo build (not run separately; test and clippy builds succeeded) [x] Relevant tests pass: cargo test -p ironclaw_threads; libSQL backend matrix lookup case [ ] cargo test -p --features integration if database-backed or runtime-integration behavior changed (not applicable: ironclaw_threads has no applicable integration feature; the shared root backend matrix is used) [ ] Manual testing: Not applicable; behavior is exercised through filesystem contracts and the production-wired integration harness. [ ] If a coding agent was used and supports it, review-pr or pr-shepherd --fix was run

Why it matters

Persistence optimization is safe only if the remaining edges preserve authority and accounting truth. A cheaper ledger that loses truncated launches is merely an efficient lie. The operator test is whether the system remains bounded and its receipts still describe the action after failure, retry or restart.

Current

The primary record was open when captured on 2026-08-16. The tagged-release baseline was ironclaw-v1.2.0 published 2026-08-13T23:30:51Z. Repository metadata, full source bodies, current pull requests and issues, releases, Google News, Hacker News, Lobsters, Metamesh and the rendered ClawCharts row were inspected. ClawCharts selected the subject; it did not prove the claim.

Evidence

The primary URL is https://github.com/nearai/ironclaw/pull/7678. Supporting records are https://github.com/nearai/ironclaw/issues/7673 and https://github.com/nearai/ironclaw/pull/7677. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts and reproductions remain attributed to their authors unless identified as independently rerun.

Source boundary

Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.

Operator take

Define the minimal durable state machine, reconcile interrupted launches before charging, and test crash recovery at every gate and terminal edge. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently.

Caveat

Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.

Source inspected; source state, environment and release boundary remain explicit.