Code

fix(webui): anchor optimistic user messages so they stop rendering below the agent's output

fix(builtin.time): add relative-offset arithmetic and replace opaque input_error() with typed input issues

Add time port in backup-cli

ci: audit workflow definitions for security issues

WS6: the rows still open after Wave 4 (measurements for the next slice)

tracing: 121 sites use `target = "…"` (a field) instead of `target: "…"` (the metadata target), so those events are invisible to the filter they name

Pre-existing defects in the trace contribution pipeline surfaced by the #7139 consolidation review (29 threads)

Coverage-gate residue from PR #7062: async-fn attribution and unit-tier-only scoped-workspace lines

Triggered channel failure notices use static summaries while WebUI gets a model-explained turn (parity follow-up to #6896)

live-canary: shard artifacts are 700MB-1.5GB; exclude regenerable/intermediate paths from upload

Launcher image hashes: no off-chain visibility into expiry or expired entries

Three pre-existing defects in the trace contribution pipeline (surfaced by the #7124 split review)

check-hermetic-env.sh grandfathers pre-existing unguarded env mutation; a pure file move is what re-surfaces it

docker/reborn/entrypoint.sh gates its legacy-Slack migration on a dead env var, so following the docs skips the migration

Investigate agents stuck thinking and not responding

WS6: measurements for the next slice — RebornRuntime re-export wall (§6.10) and typed `ChannelExtensionBinding.extension_id`

Evaluate dedicated identity/session and payments service for cloud API

Extractors report "no text found" as Failed rather than Empty, so the model is told the wrong thing

Latency-trace field is computed even when latency tracing is off (coding tool JSON byte count)

WS6: measurements for the extractors (§6.4.10) + observability (§6.2.5) slice

WS6: retire the surviving `local_runtime` misnomer (191 occurrences, 6 public API symbols — not the 1-line residue the docs claim)

products-tier: ironclaw_extension_manager still holds a direct ironclaw_secrets edge (§8.2)

§11.2.7: seventeen cross-crate include_str! sites remain, owned by three lanes that are not the WS2 row

WS8: three callerless public builder methods on HostRuntimeServices

Reborn PR test planner hard-fails on Dockerfile, .githooks/, .claude/, crates/AGENTS.md, test-tools/ and two scripts/ gates

Stale guidance: .claude/commands/add-tool.md targets the deleted tools-src/ tree

check-version-bumps.sh silently skips the WIT_TOOL_VERSION cross-check on macOS (BSD sed has no \+)

Coverage is dark for the entire crates/extensions/ family — CRATE_RE still requires a crate directly under crates/

builtin.skill_install: inline multi-file installs are unreachable, and url installs silently drop files/source/source_url

Docker fail-closed test gate is wired to nothing (IRONCLAW_REQUIRE_DOCKER_TESTS never set)