Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@crates/ironclaw_host_runtime/assets/memory_native/schemas/memory/document-read.input.v1.json`:
- Around line 7-10: Tighten the document-read.input.v1.json schema so the path
field is restricted to scoped relative paths only, not just any non-empty
string. Update the schema around the path property to enforce a relative,
non-absolute form and reject traversal patterns like leading slashes or
parent-directory segments, keeping the change localized to the document-read
input schema definition.

In `@crates/ironclaw_host_runtime/src/memory_binding.rs`:
- Around line 343-349: The override lookup in `memory_binding.rs` is comparing
`extension_id` with raw string equality, so case-only differences like
`acme.honcho` vs `Acme.Honcho` are missed. Update the `has_override` check
inside `requires_certified_bindings()` to normalize both sides to lowercase
using `.to_ascii_lowercase()` before comparing extension names, while keeping
the existing profile and deployment matching logic unchanged.
- Around line 138-144: The redaction logic in redacted_summary uses byte slicing
on extension_id, which can panic for non-ASCII input. Update redacted_summary to
truncate safely by characters/graphemes instead of &ext[..12], preserving the
existing redacted_ext behavior while avoiding any direct byte-index slicing on
external strings.

In `@crates/ironclaw_host_runtime/src/memory_context.rs`:
- Around line 88-96: The host-runtime memory admission path in
`admit_memory_context_snippet` / `admit_memory_context_snippets` currently
trusts provider-returned scope too early, so revalidate each snippet against
`request.scope` and `request.actor` before calling
`admit_memory_context_snippet` or hashing/wrapping it. Add a scope check in the
snippet loop to reject any tenant/user/agent/project mismatch, then only admit
snippets that match the request’s scope and actor. Keep the existing byte limit
and admission flow unchanged for valid snippets.

In `@crates/ironclaw_host_runtime/tests/memory_native_schema_validation.rs`:
- Around line 52-68: The current test only validates
`context_retrieve_input_schema_accepts_valid_and_rejects_invalid`, so add
instance-level valid/invalid assertions for the new document-store and
interaction schemas as well. Use the existing `load_schema` and
`jsonschema::validator_for` pattern in this test module to cover
`document-read`, `document-write`, and `interaction-record`, including checks
for required fields, enum values, numeric bounds, and rejection of unexpected
properties. Keep the fixtures alongside the existing schema validation tests so
regressions in those contracts fail in the same suite.

In `@crates/ironclaw_memory/src/service.rs`:
- Around line 345-353: `MemoryServiceContextSnippet` is carrying identity
components as raw strings across the service boundary, so replace those fields
with the validated identifier newtypes used by the domain (for example
`TenantId`, `UserId`, `AgentId`, `ProjectId`) or add a typed wrapper before
hashing in `MemoryServiceContextSnippet`/`memory_context.rs`. Update any
constructors, serialization, and call sites so the context can only be built
from validated IDs, preserving the strong contract and preventing malformed or
swapped scope components from changing the snippet reference.

In `@crates/ironclaw_reborn_composition/src/factory.rs`:
- Around line 2914-2921: The document_store_binding() helper is silently falling
back to MemoryProviderBinding::Native when a supplied MemoryBindingPolicy cannot
resolve the document-store capability or has no matching binding. Change
document_store_binding(policy: Option<&MemoryBindingPolicy>) to return
Result<MemoryProviderBinding, RebornBuildError>, propagate
CapabilityProfileId::new(MEMORY_DOCUMENT_STORE_PROFILE_ID)? instead of dropping
the error, and make the Some(policy) / missing-binding path fail closed with an
error rather than defaulting to Native. Keep only the None policy case as the
native default, and update the call sites to use ? where document_store_binding
is consumed.

In `@crates/ironclaw_reborn_composition/src/runtime.rs`:
- Around line 3037-3042: The profile source selection in runtime.rs is still
hardwired to the native filesystem path inside the user_profile_source branch,
which bypasses the resolved memory binding. Update the logic around
local_runtime and MemoryBackedUserProfileSourceAdapter to use the same
binding-aware Arc<dyn MemoryService> that memory capabilities use, constructing
MemoryBackedUserProfileSource with that service instead of from_filesystem; if
no valid binding is available, fall back to EmptyUserProfileSource so profile
reads fail closed rather than opening context/profile.json.

---

Outside diff comments:
In `@crates/ironclaw_architecture/tests/reborn_dependency_boundaries.rs`:
- Around line 1712-1727: The contract comment in the `BoundaryRule` for
`ironclaw_reborn_cli` still describes the rule as a forbidden-deps list, but the
enforcement now uses an allowlist. Update the wording near the `allowed` field
so it clearly says anything not in `allowed` is rejected, while keeping the same
intent about protecting `ironclaw_reborn_composition`-mediated access to
internal Reborn types.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/ironclaw_host_runtime/src/memory_context.rs`:
- Around line 420-464: Add a caller-level regression in
ProductionMemoryPromptContextService::load_memory_snippets to verify that
snippets with the correct tenant/user but mismatched agent_id or project_id are
filtered out before being returned. Keep the existing
admit_memory_context_snippet helper tests, but add an integration-style test in
the memory_prompt_context test suite that exercises the provider path and
asserts the bad snippet is dropped while matching scope data still passes
through.

In `@crates/ironclaw_reborn_composition/src/factory.rs`:
- Around line 2928-2948: The missing document-store binding case is only covered
at the helper level, so add a factory-level regression in the build path around
build_reborn_services in factory.rs. Exercise a resolved MemoryBindingPolicy
that omits memory.document_store.v1, then assert the build fails with
RebornBuildError::InvalidConfig from document_store_binding. Use the existing
factory/build symbols to keep the test anchored to the caller and ensure the
invariant is validated end-to-end.

---

Outside diff comments:
In `@crates/ironclaw_reborn_composition/src/runtime.rs`:
- Around line 3018-3042: The leading workspace-filesystem contract comment is
stale and no longer matches the binding-aware implementation. Update the header
comment near the profile-source setup in runtime.rs so it describes the current
`memory_document_store_binding`-gated path and the use of
`extension_filesystem`, and remove or soften any claim that profile reads always
go through the workspace filesystem. Keep the surrounding references to
`MemoryBackedUserProfileSource`, `EmptyUserProfileSource`, and
`identity_context_source` aligned with the actual control flow.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@crates/ironclaw_reborn_composition/src/runtime.rs`:
- Around line 3018-3021: The comment above the profile resolution flow is stale
and still documents the old `context/profile.json` workspace-filesystem
contract; update it to match the current `MemoryServiceResolver` and
`MemoryService::profile_read` path. Rewrite the text near the profile-source
logic so it describes the current in-memory service-based resolution and the
graceful `None` fallback without mentioning the deprecated provider or file
path.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/ironclaw_host_runtime/assets/memory_native/manifest.toml`:
- Line 20: The manifest has duplicated capability table headers in the
memory_native bundle, which creates empty capability entries before the real
ones. Remove the extra repeated [[capabilities]] headers so each capability
block in manifest.toml maps to only one table, and verify the populated entries
remain under the existing capability sections.

In
`@crates/ironclaw_host_runtime/assets/memory_native/schemas/memory/document-write.input.v1.json`:
- Around line 4-40: The document-write schema currently allows invalid mixed or
incomplete requests because it only uses a strict object shape without enforcing
write-mode invariants. Update the schema in document-write.input.v1.json to add
explicit required fields and conditional branches (for plain writes, patch-mode
writes using old_string/new_string/replace_all, and the bootstrap clear path) so
the accepted shapes are mutually exclusive and invalid payloads like empty
objects or mixed modes are rejected at the schema boundary. Use the existing
target, content, append, old_string, new_string, replace_all, and bootstrap
fields as the anchors for these rules.

In
`@crates/ironclaw_host_runtime/assets/memory_native/schemas/memory/document-write.output.v1.json`:
- Around line 4-16: The document-write output schema does not actually
discriminate fields by status, so outcome-specific properties can appear or be
missing incorrectly. Update the schema in document-write.output.v1.json to use
status-based validation with oneOf or if/then/else so cleared, patched, and
written each require only their own fields and forbid the others. Keep the
existing status, path, and additionalProperties constraints, and make the rules
explicit around the status enum plus the message, replacements, and append
properties.

In
`@crates/ironclaw_host_runtime/assets/memory_native/schemas/memory/search.input.v1.json`:
- Around line 4-29: The memory search schema currently advertises alias fields
in search.input.v1.json, but the required constraint still forces query, so
q/text/pattern payloads fail validation. Update the schema so the search
contract accepts at least one of the canonical query inputs (for example via
oneOf/anyOf around query, q, text, and pattern) and clearly define how conflicts
are handled, or remove the alias fields entirely if they are not supported.

In
`@crates/ironclaw_host_runtime/assets/memory_native/schemas/memory/search.output.v1.json`:
- Around line 10-17: The search output schema still allows free-form values for
path, which can expose absolute or parent-relative paths to the model. Tighten
the memory/search.output.v1.json schema so the path field uses the same
scoped-relative restriction as the read schema, and keep the existing search
result shape in sync by updating the path property definition in the search
result schema.

In
`@crates/ironclaw_host_runtime/assets/memory_native/schemas/memory/tree.output.v1.json`:
- Around line 2-4: The tree schema currently uses the untyped items field in
memory/tree.output.v1.json, which removes validation for array elements
entirely. Update the schema so the array items are constrained to the actual
node shape used by the memory tree, ideally with a typed object or union that
distinguishes document vs directory entries, and keep the schema aligned with
the runtime types referenced by the tree output contract.

In `@crates/ironclaw_reborn_composition/src/local_dev_capability_policy.toml`:
- Around line 117-126: Remove the default network grant from the live
ironclaw.memory.native capability entries in local_dev_capability_policy.toml so
the native memory search/write grants match the filesystem-only trust model.
Update the relevant grants for ironclaw.memory.native.search and
ironclaw.memory.native.write to keep only the dispatch/filesystem authority
already reflected in factory.rs and runtime/local_dev.rs, and ensure no network
= "default" remains for these always-on memory tools.

---

Duplicate comments:
In
`@crates/ironclaw_host_runtime/assets/memory_native/schemas/memory/document-read.input.v1.json`:
- Around line 4-7: The document read input schema still allows unsafe path
values; tighten the `path` field in the `memory/document-read.input.v1.json`
schema to match the scoped relative-path contract. Update the `path` definition
used by the read tool so it rejects absolute paths and `../` traversal,
mirroring the same pattern guard used in the manifest and other memory schemas.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/ironclaw_memory/src/service.rs`:
- Around line 74-84: The `target` fallback in `service.rs` is currently
unreachable on the schema-validated path because `document-write.input.v1.json`
still only allows a string. Update the schema and the
`parse_write_command`/input parsing logic together so `target: null` is either
accepted intentionally or removed from the compatibility handling, and then add
a regression test covering the intended `target` behavior through the
schema-driven flow.

In `@tests/support/reborn/harness.rs`:
- Around line 2078-2094: The native-memory trust tuple added for
core_builtin_tools_from_runtime is still missing from
HostRuntimeCapabilityHarness::qa_smoke_tools(), where the MEMORY_* capability
IDs are still wired to builtin with no additional_provider_trust. Extract the
new trust tuple into a shared helper and reuse it in both harness constructors
so qa_smoke_tools() also trusts
ExtensionId::new(NATIVE_MEMORY_FIRST_PARTY_PROVIDER) with the same
DispatchCapability, ReadFilesystem, and WriteFilesystem effects. This keeps
create_capability_port() authorization aligned with the split provider model and
prevents QA-smoke memory grants from failing closed as untrusted.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/ironclaw_architecture/tests/reborn_dependency_boundaries.rs`:
- Around line 1599-1611: The `ironclaw_memory_mem0` boundary entry only enforces
its allowed dependencies and does not actually prevent `ironclaw_host_runtime`
from naming this crate. Add an explicit boundary rule for
`ironclaw_host_runtime` in `reborn_dependency_boundaries.rs` that excludes
`ironclaw_memory_mem0`, or revise the nearby comment to describe the restriction
as intended rather than enforced. Use the existing `BoundaryRule` entries in the
test file to keep the new rule consistent with the other crate boundary
definitions.

In `@crates/ironclaw_memory_mem0/src/service.rs`:
- Around line 186-205: The mem0 read and profile paths only consume the first
list page, so results beyond page 1 are missed. Update the list-fetch logic in
the relevant service methods in service.rs to keep following mem0 pagination
using the page/next fields until all memories are collected, then rebuild the
document/profile from the full set. Apply this to the code paths that perform
the list call and reconstruct results so reads and profile_read do not stop at
the first page.

In `@crates/ironclaw_memory_mem0/src/transport.rs`:
- Around line 201-205: The mem0 body parsing in the transport boundary currently
hides malformed JSON by using `serde_json::from_str(&text).unwrap_or_default()`,
which silently swallows parse errors. Update the body handling in `transport.rs`
to either propagate the `serde_json::from_str` failure from this external IO
boundary or replace it with an explicitly documented tolerated fallback marked
with a `silent-ok` rationale and a log that records only the parse error; keep
the `body` construction in the same `let body = if text.trim().is_empty()` flow.
- Around line 157-160: The reqwest client built in Mem0HttpTransport::new is
missing a timeout, so add a bounded client timeout directly in the
reqwest::Client::builder chain before build() and keep the existing error
mapping intact. Use the existing client construction path in transport.rs to
ensure all mem0 HTTP requests inherit the limit rather than relying on upstream
callers.

In `@crates/ironclaw_memory_mem0/src/url_check.rs`:
- Around line 28-57: Reject non-path URL components in check_base_url: the
current reqwest::Url validation in url_check.rs still allows credentials, query
strings, and fragments in Mem0 base URLs. Update check_base_url to fail closed
when parsed.username()/parsed.password() are present, or when parsed.query() or
parsed.fragment() is set, and return Mem0Error::InvalidUrl with a clear reason.
Keep the existing scheme/host/IP checks intact while enforcing this stricter
boundary on base URLs.

In `@crates/ironclaw_reborn_composition/src/factory.rs`:
- Around line 3284-3287: The startup path is currently failing open when the
selected memory provider cannot be constructed, so update the
`build_memory_service_resolver()` flow used in `factory.rs` to fail closed
instead of returning a resolver without the third-party provider. Make the
resolver construction or the surrounding production validation return a
`Result`, and map missing or rejected provider handles from
`MemoryProviderDeps::for_third_party(...)` to `RebornBuildError::InvalidConfig`
before reporting ready. Apply the same fix to both call sites that build
`memory_resolver`, so production and migration-dry-run profiles refuse startup
when the selected memory provider is unavailable.

In `@crates/ironclaw_reborn_composition/src/lib.rs`:
- Around line 231-234: The crate root is re-exporting internal provider factory
seams instead of only facade-shaped composition APIs. Remove the public exposure
of MemoryProviderDeps, Mem0ConnectionConfig, and create_document_store_provider
from the lib.rs re-export, and keep them private or pub(crate) within
memory_provider_factory; if tests need access, gate that access behind
test-support rather than the production crate root. Keep
build_memory_service_resolver as the only surfaced composition entrypoint if it
is the intended facade.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/ironclaw_memory_mem0/src/service.rs`:
- Around line 122-142: The fallback in fetch_latest_profile_object is silently
discarding malformed profile JSON and turning it into an empty object, which can
cause profile_set to overwrite existing fields. Update this method to
distinguish “no prior profile” from “parse failed” by propagating serde_json
parse errors as MemoryServiceError instead of using unwrap_or_default. Keep the
empty-object fallback only for genuinely missing profile data from
latest_profile_text/response_items, and ensure any intentional silent fallback
is explicitly justified with a silent-ok comment if retained.

In `@crates/ironclaw_reborn_config/src/config_file.rs`:
- Around line 122-131: Validate memory.mem0_base_url alongside the other
operator-supplied string fields in the config validation path, not just bindings
and overrides. Update the validation logic in config_file.rs so the
mem0_base_url value is trimmed and checked for inline-secret/private-URL
patterns the same way the existing operator-supplied strings are handled, and
reject whitespace-only or credential-bearing URLs before provider startup. Use
the existing config validation helpers and the mem0_base_url field on the config
struct as the main points to update.

---

Outside diff comments:
In `@crates/ironclaw_memory_mem0/src/service.rs`:
- Around line 236-246: The reconstructed document in the mem0 read path is
joined in backend list order, but that order is not guaranteed to be
chronological. Update the logic in the response processing block that builds
`parts` from `response_items(&response.body)` so the matched memories are sorted
deterministically before `join("\n")`, using the available metadata/timestamp
fields from the item payload. Apply the same ordering assumption consistently
with the note in the later mem0/Qdrant listing logic so repeated writes to the
same `target` read back in a stable order.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@crates/ironclaw_reborn_cli/src/runtime/mod.rs`:
- Around line 693-702: The mem0 environment lookup is treating unreadable values
as missing, which causes silent fallback for MEMORY_MEM0_BASE_URL and drops
MEMORY_MEM0_API_KEY auth data. Update optional_nonempty_env (or add a dedicated
helper used here in runtime/mod.rs) to distinguish NotPresent from NotUnicode
and return an error for unreadable env vars instead of converting them to None.
Then have the Mem0ConnectionConfig construction for memory_provider_connection
propagate that error so invalid settings fail loudly rather than falling back to
config or empty credentials.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@crates/ironclaw_host_runtime/assets/memory_native/prompts/memory-native/read.md`:
- Around line 1-3: The `read` prompt is incorrectly implying it can return
profile facts, but profile data is accessed through
`MemoryService::profile_read` and not the path-based document `read(path)`
surface. Update the `read.md` wording to describe only persistent document
content for notes/logs/etc., and remove “profile facts” so the prompt stays
aligned with `user_profile_source.rs` and the `MemoryService::profile_read` /
`builtin.profile_set` contract.

In
`@crates/ironclaw_host_runtime/assets/memory_native/schemas/memory/document-read.output.v1.json`:
- Around line 4-8: The output schema for the memory document read response
currently leaves word_count optional, even though NativeMemoryService::read()
and the mem0 read() path always populate it through MemoryServiceReadResponse.
Update the document-read.output.v1.json schema so word_count is included in the
required fields alongside path and content, and keep the field definition
aligned with the existing schema entry to enforce the tool contract.

In
`@crates/ironclaw_host_runtime/assets/memory_native/schemas/memory/document-write.output.v1.json`:
- Around line 10-13: The schema descriptions in the document-write output no
longer match the shared document-store contract, so update the
native/profile-level schema to reflect the actual statuses returned by the write
flow. In the document-write output schema and the profile registration in
memory_profiles, revise the field docs for
message/replacements/append/content_length so they describe all valid write
outcomes from the service.rs write path, or split the native-specific and shared
contracts if the meanings differ. Use the document-write.output.v1 schema and
the memory.document_store.v1 profile as the key places to align.

In
`@crates/ironclaw_host_runtime/assets/memory_native/schemas/memory/search.input.v1.json`:
- Around line 4-18: Tighten the search request schema in the memory search input
JSON so empty strings and ambiguous alias combinations are rejected at the
boundary. Update the schema around the query-related fields (`query`, `q`,
`text`, `pattern`) to require non-empty values and enforce exactly one alias
key, or else clearly define canonical precedence directly in the schema. Use the
existing search input schema definition to make the validation unambiguous
before downstream normalization.

In `@crates/ironclaw_host_runtime/src/user_profile_source.rs`:
- Around line 50-57: The `from_filesystem` helper in `UserProfileSource` is
bypassing the configured document-store binding by always constructing
`NativeMemoryService` directly. Update this path to use the already-resolved
`Arc<dyn MemoryService>` from `memory_provider`’s fail-closed selection logic,
or rename/restrict `from_filesystem` so it is explicitly native-only and cannot
be used as a generic memory-capability source. Ensure `UserProfileSource::new`
receives the bound `MemoryService` so profile reads and writes stay on the same
backend as `profile_set`.

In `@crates/ironclaw_host_runtime/tests/first_party_builtin_tools.rs`:
- Around line 8612-8617: The native-memory trust wiring in this test harness is
incomplete: trust_policy() is still granting ironclaw.memory.native the full
builtin_effects() ceiling, and provider_trust() only maps builtin, so
CapabilityCatalog::visible_capabilities can omit native providers and hide
least-privilege regressions. Update the trust helpers in
first_party_builtin_tools.rs so native memory has its own trust entry and a
narrower policy derived from its manifest’s declared filesystem effects, and
ensure provider_trust() includes ironclaw.memory.native alongside builtin so
surface tests expose native descriptors correctly.

In `@crates/ironclaw_memory_mem0/src/error.rs`:
- Around line 21-22: The `InvalidUrl` error in `error.rs` is leaking the
configured mem0 URL through its `Display` message. Update the `thiserror`
variant so `InvalidUrl` keeps the `reason` but omits or redacts the raw `url`
value, and make sure any caller constructing or logging this error no longer
exposes the configured URL on public error surfaces.

In `@crates/ironclaw_memory_mem0/src/service.rs`:
- Around line 181-218: The `MemoryService::write` path is silently treating
non-append writes as adds by always calling `Mem0HttpRequest::post(ADD_PATH,
...)` and returning `append: true`. Update `write` to explicitly reject any
request where `request.append` is false, alongside the existing unsupported
patch/empty-content checks, and return an operation/unsupported error instead of
proceeding. Keep the behavior aligned with the other fail-closed branches in
`write`, using the `MemoryServiceWriteRequest` fields and
`MemoryServiceError::operation_from` / `Mem0Error::Unsupported` for the
unsupported case.
- Around line 236-246: The document reconstruction in the mem0 service is using
raw response order, which can scramble multiple fragments for the same target.
Update the logic in response_items/item_metadata_str/item_text handling to sort
the matching items by created_at before building the final content, and use a
stable fallback ordering for items without timestamps so append order is
preserved. Keep the existing filtering by TARGET_KEY and join only after the
ordered list is produced, so the round-trip behavior promised by the module docs
is enforced.

In `@crates/ironclaw_reborn_composition/src/memory_provider_factory.rs`:
- Around line 119-123: The selected mem0 binding can currently be left active
even when no provider was created, because create_document_store_provider and
the resolver wiring in build_memory_service_resolver collapse unsupported ids,
missing config, and transport failures into None. Make this path fallible
instead: return an error when the chosen MemoryProviderBinding cannot be
realized, and propagate that error out of build_memory_service_resolver so
startup fails with context rather than registering a half-initialized resolver.
Use the existing create_document_store_provider and
MemoryProviderBinding/MemoryService symbols to locate the affected flow, and
avoid warn-and-continue behavior that leaves a selected binding without a
provider.

In `@docs/reborn/contracts/memory-profiles.md`:
- Around line 96-100: Update the Non-goals section so it no longer states there
is no Honcho/mem0 provider implementation, since the new mem0 crate and
composition wiring/tests already bind memory.document_store.v1 to mem0. Reword
that bullet to reflect the actual intent, such as that mem0 is not the default
or not certified, and keep the other non-goals unchanged.

---

Duplicate comments:
In `@crates/ironclaw_host_runtime/src/memory_binding.rs`:
- Around line 347-353: The override lookup in memory_binding’s
certified-bindings path compares extension_id byte-for-byte, so case-only
differences can prevent a valid admin override from matching. Normalize both the
bound extension_id and each override.extension_id to lowercase with
to_ascii_lowercase() before the any(...) check in the
requires_certified_bindings block, keeping the existing profile_id and
deployment_profile matching logic unchanged.

In `@crates/ironclaw_memory_mem0/src/transport.rs`:
- Around line 223-227: The mem0 response parsing in transport.rs is hiding
malformed JSON by falling back to Value::Null in the body construction. Update
the response handling around the serde_json::from_str path to either propagate
the parse error from the transport boundary or, if null is truly acceptable, add
an inline // silent-ok: reason comment naming the parse operation and emit a
debug log with the parse failure. Keep the change localized to the body parsing
logic so empty bodies and malformed bodies are no longer indistinguishable.

In `@crates/ironclaw_reborn_cli/src/runtime/mod.rs`:
- Around line 693-704: The config fallback for Mem0 base URL is bypassing the
same validation applied to env values, so fix the config-layer handling in the
`config_file` path and ensure `[memory].mem0_base_url` is trimmed, non-empty
validated, and rejected if it contains inline secrets before it reaches
`Mem0ConnectionConfig`. Keep `optional_nonempty_env` as-is for env vars, but
update the config parsing/validation logic so `memory.mem0_base_url` is
normalized and checked centrally, then let `runtime/mod.rs` continue wiring it
into `with_memory_provider_connection` unchanged.

In `@crates/ironclaw_reborn_composition/src/factory.rs`:
- Around line 3284-3287: The resolver setup in `build_memory_service_resolver`
is allowing startup to succeed even when the selected third-party memory
provider cannot be constructed, so update the `memory_resolver` path to fail
closed by propagating a `Result` or validating the selected handle and
converting missing/invalid production config into
`RebornBuildError::InvalidConfig`. Apply the same production validation to the
Postgres branch as well, and use the existing
`MemoryProviderDeps::for_third_party` and `build_memory_service_resolver` flow
as the entry points for the fix so the unsupported/missing provider is rejected
before readiness is reported.

In `@crates/ironclaw_reborn_composition/src/lib.rs`:
- Around line 231-234: The crate root is re-exporting provider-factory
test/wiring seams that should stay private. Remove the public re-exports of
MemoryProviderDeps, Mem0ConnectionConfig, and create_document_store_provider
from the lib.rs facade, keep them pub(crate) inside memory_provider_factory, and
expose any test-only access through test-support instead; keep
build_memory_service_resolver as the only public composition entrypoint.

In `@crates/ironclaw_reborn_composition/src/local_dev_capability_policy.toml`:
- Around line 117-144: The live native-memory grants in the local dev policy are
over-permissive by still setting network = "default" on the
ironclaw.memory.native.search, ironclaw.memory.native.write,
ironclaw.memory.native.read, and ironclaw.memory.native.tree entries. Remove the
network setting from these native-memory grant blocks in
local_dev_capability_policy.toml so they match the filesystem-only trust model
used by factory.rs and fail closed for network access.

In `@crates/ironclaw_reborn_config/src/config_file.rs`:
- Around line 945-980: The `memory` validation block in `config_file.rs`
validates `profile_bindings` and `admin_overrides` but skips `mem0_base_url`,
allowing whitespace-only or secret-like values to bypass the same
trim/inline-secret checks. Update the `if let Some(memory) = &self.memory`
section to validate `memory.mem0_base_url` with the existing
`check_non_empty_trimmed` and `reject_inline_secret` helpers before validating
the bindings/overrides, using the same `memory.mem0_base_url` field path pattern
as the other fields.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/ironclaw_host_api/src/host_port.rs`:
- Around line 21-25: The docstring on the host port contract overstates a live
guarantee by claiming it backs native-memory persistence; soften this language
to describe intended use rather than an enforced cross-layer contract. Update
the comment on the host port type in host_port.rs so it aligns with the current
provider behavior documented by native_memory_declares_no_host_ports() in
memory_native_extension.rs, and avoid wording that implies native-memory storage
is currently required or guaranteed. Keep the description focused on the
validation/contract role of the port and the fact that concrete adapters live in
host/runtime service crates.

In
`@crates/ironclaw_host_runtime/assets/memory_native/schemas/memory/tree.input.v1.json`:
- Around line 4-8: The `path` field in `tree.input.v1.json` is still too
permissive and allows absolute, traversal, and backslash-based paths instead of
failing closed at the schema boundary. Tighten the JSON schema for `path` so it
only accepts scoped relative segments (with `""` as the sole root sentinel), and
update the `path` property definition to reject `/abs`, `../escape`, and
backslash variants before they reach the runtime.

In `@crates/ironclaw_host_runtime/src/memory_binding.rs`:
- Around line 271-288: The binding selection logic in the profile loop should
normalize the configured `extension_id` before comparing it against
`NATIVE_MEMORY_EXTENSION_ID` and `MEMORY_DISABLED_BINDING_SENTINEL`, since raw
case-sensitive checks can misclassify user input. Update the matching in
`memory_binding.rs` around `configured.get(profile)` so comparisons use a
lowercased form of the config value, while keeping `resolve_third_party`,
`native_binding`, and the disabled-production path behavior unchanged.

In `@crates/ironclaw_host_runtime/src/memory_provider.rs`:
- Around line 33-59: The resolver currently downcasts validated extension
identifiers to raw strings in DocumentStoreResolution::ThirdParty and
MemoryServiceResolver::third_party_document_store, which can let registration
and lookup drift. Update the resolver to carry ExtensionId through the enum and
registry, and adjust the related resolution/registration paths in
MemoryServiceResolver so lookup keys and binding results stay type-safe and
cannot vary by invalid or case-variant strings.

In `@crates/ironclaw_host_runtime/tests/memory_native_schema_validation.rs`:
- Around line 38-56: The current test only validates that schema files compile,
but it does not exercise the live native-schema lookup path used at runtime. Add
a caller-level test that drives each native capability through
CapabilityCatalog::surface_descriptor so resolve_native_memory_input_schema_ref
is actually used, and make the test fail if any manifest.toml schema ref does
not match the hard-coded arms. Keep the existing compilation check, but extend
the suite with a real call-site validation around native_memory_manifest and
CapabilityCatalog to catch ref drift where the runtime would.

In `@crates/ironclaw_memory_mem0/src/transport.rs`:
- Around line 157-188: Reject URLs containing userinfo before constructing
Mem0HttpTransport: update check_base_url() to fail when the parsed base URL
includes a non-empty username or password, so Mem0HttpTransport::new never
stores sensitive inline credentials in base_url or exposes them through Debug.
Keep the validation centralized in the base-URL check and return a
Mem0Error::Client with a clear reason when userinfo is present.

In `@crates/ironclaw_memory_mem0/src/url_check.rs`:
- Around line 28-57: The Mem0 URL validation is currently too permissive and
still allows hosted cloud endpoints like api.mem0.ai, which should be rejected
up front. Update check_base_url and the related accepts_normal_endpoints logic
to fail closed for known hosted/non-self-hosted Mem0 endpoints, and ensure
Mem0Error::InvalidUrl is returned immediately with a clear reason so invalid
configs are blocked before any request is made.

In `@crates/ironclaw_reborn_composition/src/memory_provider_factory.rs`:
- Around line 47-50: The mem0 base URL contract is inconsistent between the
`MemoryProviderFactory` docs and the actual `base_url` handling. Update the
`base_url` field documentation and any related comments around
`MemoryProviderFactory`/CLI wiring so it clearly states there is no implicit
localhost default and mem0 is not auto-enabled when `base_url` is absent. Keep
the behavior in the factory logic unchanged and align the docs with the
fail-closed path used when `base_url` is missing.

---

Duplicate comments:
In `@crates/ironclaw_memory_mem0/src/service.rs`:
- Around line 198-218: The write path in `MemoryService::write` ignores
`request.append`, so replace-style writes still go through the additive `POST
/memories` flow and return `append: true`. Update the guards near the existing
patch/clear handling to fail closed for non-append writes by returning an
unsupported operation error when `append` is false and no patch args are
present, instead of silently treating the request as an add.
- Around line 226-242: The read path in the memory service only processes the
first LIST_PATH response, so `read`, `tree`, and `profile_read` can miss entries
beyond page 1. Update the logic in `MemoryService::read` to keep following
pagination metadata from the `/memories` response (for example via
`page`/`next`) until all pages are exhausted, then rebuild the document/profile
from the full accumulated result set using the existing `response_items`,
`item_metadata_str`, and `item_text` helpers.
- Around line 140-142: The profile loading path in service.rs is silently
treating malformed profile JSON as an empty map by chaining latest_profile_text,
serde_json::from_str, and unwrap_or_default. Update the logic in the profile
retrieval flow to distinguish “no existing profile text” from “parse failed”:
return/propagate an error when deserialization fails instead of defaulting to
empty, or add an explicit silent-ok rationale if that behavior is truly
intended. Use the existing latest_profile_text and profile_set flow as the place
to fix this so malformed profiles are not overwritten.
- Around line 238-246: The read path currently rebuilds content by joining
matching fragments in the raw mem0 list order, which can return writes out of
sequence. Update the logic in the service read flow that builds `parts` from
`response_items(&response.body)` to order matching items by `created_at` first,
with a stable original-index fallback for ties or missing timestamps, before
calling `join`. Keep the filter on `TARGET_KEY` and the text extraction via
`item_text`, but ensure the final `content` is assembled from the sorted
fragments so round-tripping multiple writes to the same target remains
deterministic.

In `@crates/ironclaw_reborn_config/src/config_file.rs`:
- Around line 945-980: The memory validation block in config_file.rs checks
profile_bindings and admin_overrides but still skips memory.mem0_base_url,
allowing invalid or secret-bearing values to pass through. Update the existing
validation in the memory section to run mem0_base_url through
check_non_empty_trimmed alongside the other string fields, keeping the same
trim/empty guard pattern used for profile_id, extension_id, and
deployment_profile.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/ironclaw_reborn_cli/src/runtime/mod.rs`:
- Around line 779-783: The Google OAuth env lookup in
resolve_google_oauth_config is swallowing malformed values by converting
optional_nonempty_env(name).ok().flatten() to None, which can silently change
auth setup. Update the resolver path to propagate the env read error instead of
discarding it, preserving the existing startup-fail behavior for non-UTF-8 or
otherwise invalid OAuth overrides. If product truly wants to ignore malformed
OAuth env vars, add the required silent-ok exception annotation on this path;
otherwise keep the error flow loud by default.

In `@crates/ironclaw_reborn_config/src/config_file.rs`:
- Around line 985-986: `mem0_base_url` is only being checked for secret
patterns, so whitespace-only or padded URLs can still slip through and fail
later; update the `memory.mem0_base_url` validation in `config_file.rs` to use
the same `check_non_empty_trimmed` guard as the other memory fields, then keep
the existing `check(...)` secret scan after trimming. Add or extend the
whitespace regression tests around the `parse_text`/config validation path to
cover both blank and surrounding-whitespace `mem0_base_url` values.

---

Outside diff comments:
In `@crates/ironclaw_memory_mem0/src/url_check.rs`:
- Around line 34-52: The parsed URL rejection path in url validation still emits
the original secret-bearing URL before the credentials guard runs. Update url
handling in url_check.rs so a redacted display string is created immediately
after parsing and reused for every Mem0Error::InvalidUrl case, including the
scheme check and the embedded-credentials check in the url validation logic.
Keep the redaction centralized around redact_userinfo and add a regression test
alongside rejects_embedded_credentials that covers a non-http/https URL with
userinfo to ensure no raw secrets appear in errors.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@crates/ironclaw_memory_mem0/src/service.rs`:
- Around line 266-276: The read/profile parsing path is treating malformed 2xx
mem0 list bodies as empty results, which can silently rebuild bad state; update
the affected logic in service.rs around the response_items-based handling in
read/tree/profile_read/profile_set to use a strict parser for list/profile
bodies instead of defaulting to no results. Map any unrecognized or malformed
2xx response shape to an operation error, and ensure the error propagates with ?
through the MemoryServiceError flow so the caller sees a failure rather than an
empty profile or overwritten blob.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/ironclaw_host_runtime/assets/memory_native/manifest.toml`:
- Line 5: The package description in the manifest overstates the contract by
implying all model-facing memory tools implement memory.document_store.v1, but
only the read/write tools actually do. Narrow the description to just read and
write in the memory_native manifest so it matches the explicit implements
declarations and does not promise a cross-provider guarantee for search or tree.

In
`@crates/ironclaw_host_runtime/assets/memory_native/prompts/memory-native/write.md`:
- Around line 1-4: The write prompt is still advertising replace-style behavior,
which conflicts with the supported tool semantics. Update the instructions in
write.md for the memory write tool to mention only supported create/append/patch
actions via target, append, and old_string/new_string, and remove any wording
that implies a replace or append=false mode can be used. Keep the guidance
aligned with the memory-native prompt so the model avoids selecting unsupported
write behavior.

In
`@crates/ironclaw_host_runtime/assets/memory_native/schemas/memory/document-write.input.v1.json`:
- Around line 8-12: The `target` field in the document-write input schema
currently allows any string, so it can accept absolute, traversal, or
backslash-based paths instead of only reserved names or safe relative memory
document paths. Tighten the schema for the `target` property in
`memory/document-write.input.v1.json` to fail closed at validation time by
restricting it to the documented reserved values or a safe relative-path
pattern, and exclude unsafe path forms. Keep the existing `description` and
`default`, but make the `target` contract explicit so invalid paths are rejected
before downstream handling.

In `@crates/ironclaw_host_runtime/src/extension_contracts.rs`:
- Around line 38-40: Soften the cross-layer guarantee in the comment on the
memory ports in extension_contracts.rs: the current wording implies
host.storage.sql_transaction.first_party and host.events.audit definitively back
ironclaw.memory.native, but memory_native_extension.rs treats the native
manifest as filesystem-backed and does not declare host ports. Update the
comment near the extension contract to describe this as intended/expected wiring
for the bundled native memory path rather than an enforced guarantee, and keep
the reference to issue `#3537` if helpful for context.

In `@crates/ironclaw_memory_mem0/src/service.rs`:
- Around line 143-145: The `profile_set` flow is treating any empty result from
`response_items()` as a valid empty profile, which can silently mask malformed
mem0 list responses and overwrite existing fields. Update the logic around
`latest_profile_text()` and `response_items()` so that a recognized empty list
still returns `Map::new()`, but an unrecognized successful response envelope is
surfaced as an error instead of being treated as “no prior profile.”

In `@crates/ironclaw_memory_mem0/src/transport.rs`:
- Around line 79-81: The transport error doc comment in `Mem0TransportError` is
too strong for the current behavior of `execute()`, since non-JSON bodies are
converted to `Value::Null` instead of surfacing a transport failure. Update the
docs near `Mem0TransportError` and the `execute()` path to either describe the
fallback behavior as intentional or change the parsing flow so non-JSON
responses actually raise `Mem0TransportError`; make sure the wording matches the
real contract.

In `@crates/ironclaw_memory/src/service.rs`:
- Around line 74-85: Validate and fail closed on document targets before any
provider-specific dispatch. Move the scoped-relative containment check out of
the native-only path and into the shared parser/helper used by the service
entrypoints so `write`, `read`, and `tree` all reject non-scoped, local, or
traversal-style targets consistently even when `memory.document_store.v1` is
rebound to mem0. Keep the target validation alongside the existing
`input.get("target")` parsing in `service.rs`, and ensure both provider adapters
consume only already-validated targets.

---

Duplicate comments:
In `@crates/ironclaw_host_runtime/tests/memory_prompt_context.rs`:
- Around line 126-172: The end-to-end test currently covers tenant/user scope
filtering but not caller-level agent_id and project_id mismatches. Extend the
real load_memory_snippets path in memory_prompt_context.rs using make_service
and MockMemoryService to add separate cases where the provider returns snippets
with the wrong agent_id and wrong project_id, then assert the host drops those
snippets while still keeping an in-scope one. Reference the existing
provider_supplied_cross_scope_snippets_are_dropped_by_the_host test,
MemoryServiceContextSnippet, and test_request so the new coverage exercises the
same admit pipeline instead of only helper-level checks.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@crates/ironclaw_host_runtime/assets/memory_native/schemas/memory/document-write.input.v1.json`:
- Line 10: The target field description in the document-write schema is too
native-specific because it claims all writes are resolved under the scoped
/memory mount, which is only true in the native binding. Update the schema text
in the document-write input definition to keep it backend-neutral, preserving
the validation rules for reserved names and relative paths while removing or
generalizing the /memory filesystem guarantee so it also fits the mem0-backed
flow.

In `@crates/ironclaw_memory/src/service.rs`:
- Around line 553-564: Reject empty and whitespace-only targets in the shared
containment guard so the provider-neutral check fails closed for blank input.
Update reject_out_of_scope_target in service.rs to treat "" and "   " as invalid
alongside absolute paths, traversal, and backslashes, and ensure the mem0
adapter cannot pass such values through unchanged. Add regression tests covering
blank target cases in the relevant shared validation path and adapter-facing
behavior.

---

Outside diff comments:
In `@crates/ironclaw_memory_mem0/src/error.rs`:
- Around line 37-40: The Api error docs are now stale: they still promise
unrecognized list/search bodies degrade to “no results,” but
UnrecognizedResponse makes those 2xx bodies fail loud. Update the doc comments
in error.rs for Api and the related list/search behavior to describe the new
strict parsing behavior, or soften the guarantee so it no longer claims tolerant
fallback.

---

Duplicate comments:
In `@crates/ironclaw_memory_mem0/src/transport.rs`:
- Around line 83-86: The doc comment in transport.rs is overstating the
cross-layer behavior by claiming the service tolerates null or unrecognized
bodies. Update the comment near the transport response handling to describe only
transport-level behavior: `execute()` may downgrade non-JSON responses to
`Value::Null`, but higher-level parsing in `response_items()` can still turn
null/unrecognized list bodies into `Mem0Error::UnrecognizedResponse`. Keep the
wording aligned with the actual behavior of `execute` and `response_items`.