IronClaw redraws sandbox egress and background-run custody

nearai/ironclaw issue #7825 is the inspected primary source: “Sandbox egress auth: native iron-proxy recipes with host credential broker (retire GitHub-specific carve-out).” The related records below were inspected as supporting context rather than independent confirmation.

The facts

- nearai/ironclaw issue #7825 was created 2026-08-22T22:12:05Z and was open at inspection; its title is “Sandbox egress auth: native iron-proxy recipes with host credential broker (retire GitHub-specific carve-out).” - nearai/ironclaw issue #7824 was created 2026-08-22T20:12:26Z and was open at inspection; its title is “Context projection: Pi-style compaction barrier, structured summaries, overflow recovery.” - nearai/ironclaw PR #7818 was created 2026-08-22T05:45:53Z and was open at inspection; its title is “feat(subagent): background mode — receipt spawns, per-child delivery, activation, healing sweeps (slices 2b+2c).” - The repository reported 12599 stars, 1527 open issues, default branch main, and last push 2026-08-22T23:04:09Z. - The latest tagged-release baseline checked was ironclaw-v1.3.0 published 2026-08-19T23:17:37Z.

What changed

nearai/ironclaw issue #7825 reports: Context PR #7810 mediates GitHub CLI credentials through the sandbox proxy: builtin.shell recognizes a direct gh invocation, maps its authorized requirement to a GH_TOKEN placeholder, stages the secret one-shot, and the per-user iron-proxy sidecar substitutes the real token only for api.github.com. The lower transport (StagedCredentialProcessPort, SandboxCommandCredentialBinding, managed-egress credential files) is provider-neutral, but the **selection layer is GitHub-specific by design carve-out**: authorize.rs recognizes builtin.shell + gh + github_runtime_token + api.github.com shell_core::github_direct_argv() accepts only gh shell.rs maps only the GitHub requirement to GH_TOKEN managed_egress.rs renders exactly one proxy operation: static header replacement, hardcoded methods: [all] / paths: ["/*"], one secret file per credential, hand-concatenated YAML Supporting aws, gcloud, kubectl, or any HMAC-signed API today means more Rust branches per provider. That does not scale, and it under-uses the proxy: the pinned ironsh/iron-proxy image natively implements secrets (inject/replace), oauth_token (client_credentials, jwt_bearer, refresh_token), aws_auth (SigV4 re-signing with region/service gating), gcp_auth (service-account token minting + metadata stubbing), and hmac_sign. Design: native proxy recipes + host credential broker Adopt the Centaur-style model — extension packages carry **native iron-proxy transform recipes** — with one difference: the proxy never reads a durable secret backend. IronClaw remains the credential broker and supplies only an **invocation-scoped credential bundle**. Ownership split IronClaw implements ONLY: capability authorization, credential-handle resolution, invocation-scoped bundle delivery, recipe validation/composition, proxy lifecycle. iron-proxy implements ALL authentication semantics. No

nearai/ironclaw issue #7824 reports: Problem — measured, not hypothetical IronClaw replays the full thread history into every model request. On PinchBench (147 tasks, DeepSeek-V4-Flash via OpenRouter): run 949991b5 (PR #7491, 54.4%): **227.7M input tokens, $10.31** vs the old-shell baseline 72a540b0 (60.5%): **55.1M, $2.52**. Even in the 47-task stratum where shell/bash behavior is identical between runs, cost is **2.0×** (median per-task ratio 1.63×) at *equal* scores — pure context-replay overhead. The top 12 loop-heavy tasks (47–124 LLM calls each) consume **41% of all input tokens**: tokens grow quadratically with call count because every call re-sends everything. Average request: 57.5k input tokens; a 317-byte wc -l answer rides in on a 57k-token request. Long-running agents make this unbounded. The question (per Pi's Durable AgentHarness note): after 50 hours, does the agent still know what it did — affordably? Design to adopt (from Pi's harness spec + compaction docs) Reference: earendil-works/pi — packages/agent/docs/harness.md (§2.5 context projection, §3.9 summary generation), packages/coding-agent/docs/compaction.md. 1. **Compaction entry as context barrier.** Prompt context = newest-first branch scan stopping at the first compaction entry: its summary + a small retained tail + everything after. Nothing earlier is ever read into a request. Error/aborted assistant responses are dropped by rule. 2. **Threshold-triggered structured compaction.** Fires at a checkpoint when contextTokens > window − reserve (Pi defaults: reserve 16k, keep-recent 20k). Cuts at turn boundaries

nearai/ironclaw PR #7818 reports: Summary Slices **2b + 2c** of R2 background subagents — the producer half that turns on the surface #7788 (slice 2a) landed inert. One PR by explicit decision; commits are ordered so every 2b change precedes 2c, making a later split mechanical. Read this first — deployment gate:** this branch is the **first writer** of two persisted shapes whose readers shipped in 2a with **no tolerant reader**: LoopInput::SubagentSettled (persisted verbatim inside the durable run-queue document, which deserializes whole — an old binary meeting one fails the run's entire queue) and the ProcessDependencyState delivery substates (journal rows). **Do not deploy this before #7788 is rolled out fleet-wide** (that PR's rollback plan says the same from the other side). With 2a everywhere, rollback of this PR is a plain revert — all new shapes stop being written and existing readers ignore them. What changes, by layer **ironclaw_loop_host (spawn port, 2b):** codec + JSON schema accept mode: "background" (run_in_background: true is an alias; the contradictory combination is rejected); the wire-mirror enum and background_subagents_disabled() are deleted. finish_spawn threads the real mode: background spawns return the immediate receipt via the previously-caller-less resolution::spawned_child_run (slot closes, no gate) and write their edge with gate:subagent-bg-{child_run_id} / journal group_ref = "bg:{parent_thread_id}" — the deterministic recovery key. Model-facing description moved to prompts/spawn_subagent_description.md with the background wording ("results appear as tagged

Why it matters

Remote credentials, compressed context and child execution all cross trust boundaries. Each needs an explicit custody record instead of inherited ambient state. The operator test is whether the system remains bounded and its receipts still describe the action after failure, retry or restart.

Current

The primary record was open when captured on 2026-08-23. The tagged-release baseline was ironclaw-v1.3.0 published 2026-08-19T23:17:37Z. Repository metadata, full source bodies, current pull requests and issues, releases, Google News, Hacker News, Lobsters, Metamesh and the rendered ClawCharts row were inspected. ClawCharts selected the subject; it did not prove the claim.

Evidence

The primary URL is https://github.com/nearai/ironclaw/issues/7825. Supporting records are https://github.com/nearai/ironclaw/issues/7824 and https://github.com/nearai/ironclaw/pull/7818. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts and reproductions remain attributed to their authors unless identified as independently rerun.

Source boundary

Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.

Operator take

Broker credentials outside the sandbox, mark compaction boundaries in durable summaries, and give every background child a spawn receipt, delivery target and bounded recovery owner. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently.

Caveat

Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.

Source inspected; source state, environment and release boundary remain explicit.