updated

- MESH_CLUSTER.md: full documentation for autonomous AI mesh network
- LAZY_TOOLS.md: lazy tool loading for smaller LLMs
- mesh-architecture.svg: colorful network topology diagram
- task-routing.svg: scoring algorithm visualization
- pq-handshake.svg: ML-KEM-768 key exchange sequence diagram
- HTML docs with dark theme styling
- Renamed ironclaw references to optimclaw in .env.example and README

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

.claude/commands/add-sse-event.md

@@ -5,7 +5,7 @@ argument-hint: <event_name> [description]
 model: opus
 ---
 
-Add a new SSE event called `$ARGUMENTS` to the IronClaw web gateway. This involves changes across 5 files in a specific order. Follow each step exactly.
+Add a new SSE event called `$ARGUMENTS` to the OptimClaw web gateway. This involves changes across 5 files in a specific order. Follow each step exactly.
 
 ## Step 1: Add `StatusUpdate` variant
 

.claude/commands/add-tool.md

@@ -5,7 +5,7 @@ argument-hint: <tool_name> [description]
 model: opus
 ---
 
-Scaffold a new tool called `$ARGUMENTS` for the IronClaw agent. First, determine the tool type and then follow the appropriate path.
+Scaffold a new tool called `$ARGUMENTS` for the OptimClaw agent. First, determine the tool type and then follow the appropriate path.
 
 ## Step 0: Determine tool type
 
@@ -43,7 +43,7 @@ Follow this exact pattern (adjust name and description):
 name = "<name>-tool"
 version = "0.1.0"
 edition = "2021"
-description = "<Description> tool for IronClaw (WASM component)"
+description = "<Description> tool for OptimClaw (WASM component)"
 license = "MIT OR Apache-2.0"
 publish = false
 

.claude/commands/fix-issue.md

@@ -62,7 +62,7 @@ Enter planning mode to design the implementation. The plan MUST cover:
    - Happy path (expected input produces expected output)
    - Error paths (invalid input, missing data, permission denied)
    - Edge cases (empty collections, boundary values, concurrent access)
-5. **IronClaw-specific concerns**:
+5. **OptimClaw-specific concerns**:
    - If the change touches persistence, both database backends must be updated (`postgres.rs` and `libsql_backend.rs`)
    - New `Database` trait methods need implementations in both backends
    - No `.unwrap()` or `.expect()` in production code
@@ -80,7 +80,7 @@ After the plan is approved:
 
 1. Implement each change from the plan.
 2. Write all planned tests.
-3. Run IronClaw's full quality gate:
+3. Run OptimClaw's full quality gate:
    - `cargo fmt`
    - `cargo clippy --all --benches --tests --examples --all-features` (zero warnings)
    - `cargo test --lib` (all tests pass)

.claude/commands/pr-shepherd.md

@@ -96,7 +96,7 @@ Wait for user confirmation (unless `--fix` flag set), then proceed to Phase 3.
 
 Read EVERY changed file in full (not just diff hunks). For PRs touching >20 files, prioritize: service logic > handlers > types > tests > docs. Batch reads in parallel via Agent tool.
 
-### IronClaw-specific checks (always)
+### OptimClaw-specific checks (always)
 - No `.unwrap()` or `.expect()` in production code
 - Prefer `crate::` for cross-module imports (`super::` OK in tests/intra-module)
 - Error types use `thiserror`
@@ -167,7 +167,7 @@ gh pr checkout {number}
 1. All approved review comment fixes (from Phase 2a)
 2. All approved review findings (from Phase 2b)
 
-Follow IronClaw conventions:
+Follow OptimClaw conventions:
 - `thiserror` for errors
 - `crate::` imports
 - No `.unwrap()` in production
@@ -180,7 +180,7 @@ After all fixes implemented, proceed to Phase 4.
 
 ## Phase 4: Quality Gate
 
-Run the full IronClaw shipping checklist:
+Run the full OptimClaw shipping checklist:
 
 ```bash
 cargo fmt

.claude/commands/respond-pr.md

@@ -60,7 +60,7 @@ Wait for user confirmation before proceeding to implementation.
 After user confirms:
 
 1. Implement each fix in the plan.
-2. Run IronClaw's quality gate to verify nothing breaks:
+2. Run OptimClaw's quality gate to verify nothing breaks:
    - `cargo fmt`
    - `cargo clippy --all --benches --tests --examples --all-features`
    - `cargo test --lib`
@@ -77,5 +77,5 @@ For each comment addressed, reply on the PR with a short message stating what wa
 - Group duplicate comments (same issue reported by multiple bots) and reply to all of them.
 - Do not make changes beyond what the review comments ask for. Stay focused.
 - If a comment suggests a change you disagree with, present your reasoning to the user during the planning phase rather than silently ignoring it.
-- Follow IronClaw conventions: no `.unwrap()` in production code, use `crate::` imports, `thiserror` errors.
+- Follow OptimClaw conventions: no `.unwrap()` in production code, use `crate::` imports, `thiserror` errors.
 - If changes touch persistence, verify both database backends are updated.

.claude/commands/review-crate.md

@@ -1,5 +1,5 @@
 ---
-description: Deep audit of the IronClaw crate for vulnerabilities, bugs, unfinished work, inconsistencies, and oversights
+description: Deep audit of the OptimClaw crate for vulnerabilities, bugs, unfinished work, inconsistencies, and oversights
 disable-model-invocation: true
 allowed-tools: Bash(cargo fmt:*), Bash(cargo clippy:*), Bash(cargo test:*), Bash(cargo audit:*), Bash(git diff:*), Bash(git log:*), Bash(git show:*), Bash(wc:*), Read, Grep, Glob, Task
 argument-hint: "[path/to/crate]"
@@ -93,7 +93,7 @@ Search for `.unwrap()`, `.expect(`, `panic!`, `unreachable!` in non-test code. F
 - Is there a code path that reaches this with None/Err?
 - Should it be replaced with proper error handling (`?`, `.ok()`, `.unwrap_or_default()`)?
 
-IronClaw convention: `.unwrap()` and `.expect()` are banned in production code. Any occurrence outside `#[cfg(test)]` blocks is a **High severity** finding.
+OptimClaw convention: `.unwrap()` and `.expect()` are banned in production code. Any occurrence outside `#[cfg(test)]` blocks is a **High severity** finding.
 
 ### 5c. SQL and injection vectors
 
@@ -102,7 +102,7 @@ Search for string formatting used in SQL queries, shell commands, or HTML:
 - String interpolation in query construction vs parameterized queries
 - User input flowing into file paths (`Path::new`, `std::fs::`)
 
-IronClaw has two database backends (PostgreSQL and libSQL). Check both for injection vectors.
+OptimClaw has two database backends (PostgreSQL and libSQL). Check both for injection vectors.
 
 ### 5d. Cryptographic issues
 
@@ -125,7 +125,7 @@ If the crate uses crypto:
 - Are errors swallowed silently? (`let _ = ...`, `.ok()` discarding errors that matter)
 - Do error types carry enough context to debug in production?
 - Are there error type mismatches? (returning generic `anyhow::Error` where a typed error would prevent confusion)
-- Is `thiserror` used consistently for error types (IronClaw convention)?
+- Is `thiserror` used consistently for error types (OptimClaw convention)?
 
 ## Step 6: Check for inconsistencies
 
@@ -156,7 +156,7 @@ Look for:
 
 ### 6e. Import style
 
-IronClaw convention: use `crate::` imports, not `super::`. Flag any `super::` imports in non-test code.
+OptimClaw convention: use `crate::` imports, not `super::`. Flag any `super::` imports in non-test code.
 
 ## Step 7: Inspect for change oversights
 
@@ -172,7 +172,7 @@ IronClaw convention: use `crate::` imports, not `super::`. Flag any `super::` im
 - Are there `impl` blocks that look incomplete?
 - Are `Default` implementations sensible?
 
-IronClaw key traits: `Database` (~60 methods), `Channel`, `Tool`, `LlmProvider`, `SuccessEvaluator`, `EmbeddingProvider`. If any new methods were added to `Database`, verify both `postgres.rs` and `libsql_backend.rs` implement them.
+OptimClaw key traits: `Database` (~60 methods), `Channel`, `Tool`, `LlmProvider`, `SuccessEvaluator`, `EmbeddingProvider`. If any new methods were added to `Database`, verify both `postgres.rs` and `libsql_backend.rs` implement them.
 
 ### 7c. Test coverage gaps
 

.claude/commands/review-pr.md

@@ -49,9 +49,9 @@ If the PR touches more than 20 files, still read all of them, but process in thi
 
 Go through the changes with each of these lenses. For every finding, note the file, line range, severity, and a concrete description.
 
-### IronClaw-specific checks
+### OptimClaw-specific checks
 
-In addition to the general lenses below, check IronClaw conventions (see CLAUDE.md):
+In addition to the general lenses below, check OptimClaw conventions (see CLAUDE.md):
 - No `.unwrap()` or `.expect()` in production code (tests are fine)
 - Use `crate::` imports, not `super::`
 - Error types use `thiserror` in `error.rs`

.claude/commands/ship.md

@@ -3,7 +3,7 @@ description: Run the full Rust quality gate (fmt, clippy, tests) before shipping
 allowed-tools: Bash(cargo fmt:*), Bash(cargo clippy:*), Bash(cargo test:*)
 ---
 
-Run the IronClaw shipping checklist. This is the mandatory quality gate before any change is considered done.
+Run the OptimClaw shipping checklist. This is the mandatory quality gate before any change is considered done.
 
 ## Steps
 

.claude/commands/trace.md

@@ -1,15 +1,15 @@
 ---
-description: Trace a data flow or bug through the IronClaw codebase end-to-end
+description: Trace a data flow or bug through the OptimClaw codebase end-to-end
 allowed-tools: Read, Glob, Grep, Bash(cargo test:*)
 argument-hint: <symptom or feature name>
 model: sonnet
 ---
 
-Trace the flow of `$ARGUMENTS` through the IronClaw codebase. Your job is to map every file and function involved, identify where data transforms or could break, and report the full chain.
+Trace the flow of `$ARGUMENTS` through the OptimClaw codebase. Your job is to map every file and function involved, identify where data transforms or could break, and report the full chain.
 
 ## Architecture Reference
 
-IronClaw has three main data flow paths. Identify which one(s) are relevant and trace through them:
+OptimClaw has three main data flow paths. Identify which one(s) are relevant and trace through them:
 
 ### Message Flow (user input to LLM response)
 ```

.claude/rules/skills.md

@@ -11,8 +11,8 @@ SKILL.md files extend the agent's prompt with domain-specific instructions. Each
 
 | Trust Level | Source | Tool Access |
 |-------------|--------|-------------|
-| **Trusted** | User-placed in `~/.ironclaw/skills/` or workspace `skills/` | All tools available to the agent |
-| **Installed** | Downloaded from ClawHub registry (`~/.ironclaw/installed_skills/`) | Read-only tools only (no shell, file write, HTTP) |
+| **Trusted** | User-placed in `~/.optimclaw/skills/` or workspace `skills/` | All tools available to the agent |
+| **Installed** | Downloaded from ClawHub registry (`~/.optimclaw/installed_skills/`) | Read-only tools only (no shell, file write, HTTP) |
 
 ## SKILL.md Format
 

.claude/rules/tools.md

@@ -7,7 +7,7 @@ paths:
 
 **Keep tool-specific logic out of the main agent codebase.** The main agent provides generic infrastructure; tools are self-contained units that declare requirements through `<name>.capabilities.json` sidecar files (in dev mode: `tools-src/<name>/<name>-tool.capabilities.json`).
 
-Tools can be WASM (sandboxed, credential-injected, single binary) or MCP servers (ecosystem, any language, no sandbox). Both are first-class via `ironclaw tool install`.
+Tools can be WASM (sandboxed, credential-injected, single binary) or MCP servers (ecosystem, any language, no sandbox). Both are first-class via `optimclaw tool install`.
 
 See `src/tools/README.md` for full architecture, adding new tools, auth JSON examples, and WASM vs MCP decision guide.
 

.env.example

@@ -1,10 +1,10 @@
 # Database Configuration
-DATABASE_URL=postgres://localhost/ironclaw
+DATABASE_URL=postgres://localhost/optimclaw
 DATABASE_POOL_SIZE=10
 
 # LLM Provider
 # LLM_BACKEND=nearai           # default
-# Possible values: nearai, ollama, openai_compatible, openai, anthropic, tinfoil
+# Possible values: nearai, ollama, openai_compatible, openai, anthropic, github_copilot, tinfoil, openai_codex, gemini_oauth
 # LLM_REQUEST_TIMEOUT_SECS=120  # Increase for local LLMs (Ollama, vLLM, LM Studio)
 
 # === Anthropic Direct ===
@@ -24,18 +24,29 @@ DATABASE_POOL_SIZE=10
 # LLM_USE_CODEX_AUTH=true
 # CODEX_AUTH_PATH=~/.codex/auth.json
 
+# === GitHub Copilot ===
+# Uses the OAuth token from your Copilot IDE sign-in (for example
+# ~/.config/github-copilot/apps.json on Linux/macOS), or run `optimclaw onboard`
+# and choose the GitHub device login flow.
+# LLM_BACKEND=github_copilot
+# GITHUB_COPILOT_TOKEN=gho_...
+# GITHUB_COPILOT_MODEL=gpt-4o
+# OptimClaw injects standard VS Code Copilot headers automatically.
+# Optional advanced headers for custom overrides:
+# GITHUB_COPILOT_EXTRA_HEADERS=Copilot-Integration-Id:vscode-chat
+
 # === NEAR AI (Chat Completions API) ===
 # Two auth modes:
 #   1. Session token (default): Uses browser OAuth (GitHub/Google) on first run.
-#      Session token stored in ~/.ironclaw/session.json automatically.
+#      Session token stored in ~/.optimclaw/session.json automatically.
 #      Base URL defaults to https://private.near.ai
 #   2. API key: Set NEARAI_API_KEY to use API key auth from cloud.near.ai.
 #      Base URL defaults to https://cloud-api.near.ai
-NEARAI_MODEL=zai-org/GLM-5-FP8
+NEARAI_MODEL=Qwen/Qwen3.5-122B-A10B
 NEARAI_BASE_URL=https://private.near.ai
 NEARAI_AUTH_URL=https://private.near.ai
 # NEARAI_SESSION_TOKEN=sess_...                  # hosting providers: set this
-# NEARAI_SESSION_PATH=~/.ironclaw/session.json   # optional, default shown
+# NEARAI_SESSION_PATH=~/.optimclaw/session.json   # optional, default shown
 # NEARAI_API_KEY=...                             # API key from cloud.near.ai
 
 # Local LLM Providers (Ollama, LM Studio, vLLM, LiteLLM)
@@ -52,7 +63,7 @@ NEARAI_AUTH_URL=https://private.near.ai
 # LLM_API_KEY=sk-...                        # optional for local servers
 # Custom HTTP headers for OpenAI-compatible providers
 # Format: comma-separated key:value pairs
-# LLM_EXTRA_HEADERS=HTTP-Referer:https://github.com/nearai/ironclaw,X-Title:ironclaw
+# LLM_EXTRA_HEADERS=HTTP-Referer:https://github.com/nearai/optimclaw,X-Title:optimclaw
 
 # === OpenRouter (300+ models via OpenAI-compatible) ===
 # LLM_MODEL=anthropic/claude-sonnet-4       # see openrouter.ai/models for IDs
@@ -92,6 +103,30 @@ NEARAI_AUTH_URL=https://private.near.ai
 #   long  = 1-hour TTL, 2.0× (200%) write surcharge
 # ANTHROPIC_CACHE_RETENTION=short
 
+# === OpenAI Codex (ChatGPT subscription, OAuth) ===
+# LLM_BACKEND=openai_codex
+# OPENAI_CODEX_MODEL=gpt-5.3-codex              # default
+# OPENAI_CODEX_CLIENT_ID=app_EMoamEEZ73f0CkXaXp7hrann  # override (rare)
+# OPENAI_CODEX_AUTH_URL=https://auth.openai.com  # override (rare)
+# OPENAI_CODEX_API_URL=https://chatgpt.com/backend-api/codex  # override (rare)
+
+# === Google Gemini (OAuth, Gemini CLI compatible) ===
+# LLM_BACKEND=gemini_oauth
+# GEMINI_MODEL=gemini-2.5-flash                  # default
+# GEMINI_CREDENTIALS_PATH=~/.gemini/oauth_creds.json  # default
+# GEMINI_API_KEY=...                             # optional: use API key instead of OAuth
+# GEMINI_API_KEY_AUTH_MECHANISM=query             # "query" (default) or "header"
+# GEMINI_SAFETY_BLOCK_NONE=true                  # disable safety filters (default: false)
+# GEMINI_CLI_CUSTOM_HEADERS=Key:Value,Key2:Value2
+# GEMINI_TOP_P=0.95
+# GEMINI_TOP_K=40
+# GEMINI_SEED=42
+# GEMINI_PRESENCE_PENALTY=0.0
+# GEMINI_FREQUENCY_PENALTY=0.0
+# GEMINI_RESPONSE_MIME_TYPE=application/json
+# GEMINI_RESPONSE_JSON_SCHEMA={"type":"object"}
+# GEMINI_CACHED_CONTENT=cachedContents/abc123
+
 # For full provider setup guide see docs/LLM_PROVIDERS.md
 
 # Channel Configuration
@@ -110,7 +145,7 @@ HTTP_HOST=0.0.0.0
 HTTP_PORT=8080
 HTTP_WEBHOOK_SECRET=your-webhook-secret
 # Webhook authentication uses HMAC-SHA256 signature verification.
-# Callers must send an X-IronClaw-Signature header with format: sha256=<hex_digest>
+# Callers must send an X-OptimClaw-Signature header with format: sha256=<hex_digest>
 # where the digest is HMAC-SHA256(HTTP_WEBHOOK_SECRET, raw_request_body) in lowercase hex.
 #
 # Example (bash):
@@ -118,7 +153,7 @@ HTTP_WEBHOOK_SECRET=your-webhook-secret
 #   SIG=$(echo -n "$BODY" | openssl dgst -sha256 -hmac "$HTTP_WEBHOOK_SECRET" | cut -d' ' -f2)
 #   curl -X POST http://localhost:8080/webhook \
 #     -H "Content-Type: application/json" \
-#     -H "X-IronClaw-Signature: sha256=$SIG" \
+#     -H "X-OptimClaw-Signature: sha256=$SIG" \
 #     -d "$BODY"
 #
 # DEPRECATED: Passing "secret" in the JSON body still works but will be removed in a future release.
@@ -135,7 +170,7 @@ HTTP_WEBHOOK_SECRET=your-webhook-secret
 # SIGNAL_IGNORE_STORIES=true
 
 # Agent Settings
-AGENT_NAME=ironclaw
+AGENT_NAME=optimclaw
 AGENT_MAX_PARALLEL_JOBS=5
 AGENT_JOB_TIMEOUT_SECS=3600
 AGENT_STUCK_THRESHOLD_SECS=300
@@ -170,7 +205,7 @@ HEARTBEAT_NOTIFY_USER=default
 #                                        # commands directly on the host. Without this
 #                                        # set to "true", full_access is downgraded to
 #                                        # workspace_write.
-# SANDBOX_IMAGE=ironclaw-worker:latest
+# SANDBOX_IMAGE=optimclaw-worker:latest
 # SANDBOX_TIMEOUT_SECS=120
 # SANDBOX_MEMORY_LIMIT_MB=2048
 
@@ -179,11 +214,11 @@ SAFETY_MAX_OUTPUT_LENGTH=100000
 SAFETY_INJECTION_CHECK_ENABLED=true
 
 # Restart Feature (Docker containers only)
-# Set IRONCLAW_IN_DOCKER=true in the container entrypoint to enable the restart feature.
+# Set OPTIMCLAW_IN_DOCKER=true in the container entrypoint to enable the restart feature.
 # Without this, the restart tool and /restart command will be disabled.
-# IRONCLAW_IN_DOCKER=false
-# IRONCLAW_RESTART_DELAY=5          # default wait before exit (seconds, range: 1-30)
-# IRONCLAW_MAX_FAILURES=10          # max consecutive failures before container exits
+# OPTIMCLAW_IN_DOCKER=false
+# OPTIMCLAW_RESTART_DELAY=5          # default wait before exit (seconds, range: 1-30)
+# OPTIMCLAW_MAX_FAILURES=10          # max consecutive failures before container exits
 
 # Logging
-RUST_LOG=ironclaw=debug,tower_http=debug
+RUST_LOG=optimclaw=debug,tower_http=debug

.github/pull_request_template.md

@@ -6,7 +6,7 @@
 
 ## Change Type
 
-<!-- Check one -->
+<!-- Check all that apply. Refactor-only PRs are for core team or maintainer-requested work. -->
 
 - [ ] Bug fix
 - [ ] New feature
@@ -18,16 +18,19 @@
 
 ## Linked Issue
 
-<!-- Closes #N, or "None" -->
+<!-- Closes #N, Fixes #N, Related #N, or "None". New feature PRs must link an approved issue. -->
 
 ## Validation
 
 <!-- How did you verify this works? -->
 
-- [ ] `cargo fmt`
-- [ ] `cargo clippy --all --benches --tests --examples --all-features`
+- [ ] `cargo fmt --all -- --check`
+- [ ] `cargo clippy --all --benches --tests --examples --all-features -- -D warnings`
+- [ ] `cargo build`
 - [ ] Relevant tests pass: <!-- list specific tests -->
+- [ ] `cargo test --features integration` if database-backed or integration behavior changed
 - [ ] Manual testing: <!-- describe what you tested -->
+- [ ] If a coding agent was used and supports it, `review-pr` or `pr-shepherd --fix` was run before requesting review
 
 ## Security Impact
 
@@ -45,6 +48,10 @@
 
 <!-- How to revert if this causes problems? For Track C changes, this is mandatory. -->
 
+## Review Follow-Through
+
+<!-- Review conversations are author-owned. Summarize any known follow-up or areas where reviewer judgment is still needed. -->
+
 ---
 
-**Review track**: <!-- A (docs/tests/chore) | B (feature/refactor) | C (security/runtime/DB/CI) -->
+**Review track**: <!-- A (docs/tests/chore) | B (feature/maintainer-requested refactor) | C (security/runtime/DB/CI) -->

.github/workflows/claude-review.yml

@@ -28,7 +28,7 @@ jobs:
         uses: anthropics/claude-code-action@v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          allowed_bots: "ironclaw-ci[bot]"
+          allowed_bots: "optimclaw-ci[bot]"
           claude_args: "--max-turns 50 --model claude-haiku-4-5-20251001 --allowedTools 'Read,Glob,Grep,Agent,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr list:*),Bash(gh issue view:*),Bash(gh issue list:*),Bash(gh search:*),Bash(git blame:*),Bash(git log:*),Bash(git diff:*)'"
           prompt: |
             Code review this pull request. Follow these steps precisely:

.github/workflows/coverage.yml

@@ -6,11 +6,11 @@
 # What it does:
 # - Runs unit and integration tests with coverage instrumentation
 # - Runs E2E tests with coverage instrumentation
-# - Uploads coverage reports to Codecov (https://codecov.io/gh/nearai/ironclaw)
+# - Uploads coverage reports to Codecov (https://codecov.io/gh/nearai/optimclaw)
 #
 # Viewing coverage reports:
 # - PRs automatically get coverage comments showing changes in coverage
-# - Visit https://codecov.io/gh/nearai/ironclaw for detailed coverage reports
+# - Visit https://codecov.io/gh/nearai/optimclaw for detailed coverage reports
 # - Coverage reports are generated for three configurations:
 #   1. all-features: Full feature set
 #   2. default: Default features
@@ -58,7 +58,7 @@ jobs:
         env:
           POSTGRES_USER: postgres
           POSTGRES_PASSWORD: postgres
-          POSTGRES_DB: ironclaw_test
+          POSTGRES_DB: optimclaw_test
         ports:
           - 5432:5432
         options: >-
@@ -103,11 +103,11 @@ jobs:
           PGHOST: localhost
           PGUSER: postgres
           PGPASSWORD: postgres
-          PGDATABASE: ironclaw_test
+          PGDATABASE: optimclaw_test
 
       - name: Set DATABASE_URL for postgres configs
         if: matrix.has_postgres
-        run: echo "DATABASE_URL=postgres://postgres:postgres@localhost/ironclaw_test" >> "$GITHUB_ENV"
+        run: echo "DATABASE_URL=postgres://postgres:postgres@localhost/optimclaw_test" >> "$GITHUB_ENV"
 
       - name: Generate coverage
         run: cargo llvm-cov ${{ matrix.flags }} --workspace --lcov --output-path lcov.info
@@ -176,7 +176,7 @@ jobs:
         run: |
           pytest tests/e2e/ -v --timeout=120
         env:
-          RUST_LOG: ironclaw=info
+          RUST_LOG: optimclaw=info
           RUST_BACKTRACE: "1"
 
       - name: Verify profraw files exist

.github/workflows/e2e.yml

@@ -14,7 +14,7 @@ on:
 jobs:
   # ── Step 1: compile once ──────────────────────────────────────────────────
   build:
-    name: Build ironclaw (libsql)
+    name: Build optimclaw (libsql)
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
@@ -35,8 +35,8 @@ jobs:
       - name: Upload binary
         uses: actions/upload-artifact@v4
         with:
-          name: ironclaw-e2e-binary
-          path: target/debug/ironclaw
+          name: optimclaw-e2e-binary
+          path: target/debug/optimclaw
           retention-days: 1
 
   # ── Step 2: run test slices in parallel ───────────────────────────────────
@@ -54,7 +54,7 @@ jobs:
           - group: features
             files: "tests/e2e/scenarios/test_skills.py tests/e2e/scenarios/test_tool_approval.py tests/e2e/scenarios/test_webhook.py"
           - group: extensions
-            files: "tests/e2e/scenarios/test_extensions.py tests/e2e/scenarios/test_extension_oauth.py tests/e2e/scenarios/test_telegram_token_validation.py tests/e2e/scenarios/test_telegram_hot_activation.py tests/e2e/scenarios/test_wasm_lifecycle.py tests/e2e/scenarios/test_tool_execution.py tests/e2e/scenarios/test_pairing.py tests/e2e/scenarios/test_mcp_auth_flow.py tests/e2e/scenarios/test_oauth_credential_fallback.py tests/e2e/scenarios/test_routine_oauth_credential_injection.py"
+            files: "tests/e2e/scenarios/test_extensions.py tests/e2e/scenarios/test_extension_oauth.py tests/e2e/scenarios/test_oauth_url_parameters.py tests/e2e/scenarios/test_telegram_token_validation.py tests/e2e/scenarios/test_telegram_hot_activation.py tests/e2e/scenarios/test_wasm_lifecycle.py tests/e2e/scenarios/test_tool_execution.py tests/e2e/scenarios/test_pairing.py tests/e2e/scenarios/test_mcp_auth_flow.py tests/e2e/scenarios/test_oauth_credential_fallback.py tests/e2e/scenarios/test_routine_oauth_credential_injection.py"
           - group: routines
             files: "tests/e2e/scenarios/test_owner_scope.py tests/e2e/scenarios/test_routine_event_batch.py"
     steps:
@@ -63,11 +63,11 @@ jobs:
       - name: Download binary
         uses: actions/download-artifact@v4
         with:
-          name: ironclaw-e2e-binary
+          name: optimclaw-e2e-binary
           path: target/debug/
 
       - name: Make binary executable
-        run: chmod +x target/debug/ironclaw
+        run: chmod +x target/debug/optimclaw
 
       - uses: actions/setup-python@v5
         with:

.github/workflows/regression-test-check.yml

@@ -43,12 +43,42 @@ jobs:
             fi
           fi
 
-          if [ "$IS_FIX" = false ]; then
-            echo "Not a fix PR — skipping regression test check."
+          # --- 1b. Does this PR touch high-risk state machine or resilience code? ---
+          CHANGED_FILES=$(git diff --name-only "${BASE_REF}...${HEAD_REF}")
+
+          TOUCHES_HIGH_RISK=false
+          HIGH_RISK_PATTERNS=(
+            "src/context/state.rs"
+            "src/agent/session.rs"
+            "src/llm/circuit_breaker.rs"
+            "src/llm/retry.rs"
+            "src/llm/failover.rs"
+            "src/agent/self_repair.rs"
+            "src/agent/agentic_loop.rs"
+            "src/tools/execute.rs"
+            "crates/optimclaw_safety/src/"
+          )
+
+          for pattern in "${HIGH_RISK_PATTERNS[@]}"; do
+            if echo "$CHANGED_FILES" | grep -q "$pattern"; then
+              TOUCHES_HIGH_RISK=true
+              echo "High-risk file matched: $pattern"
+              break
+            fi
+          done
+
+          # Skip only if NEITHER condition holds — no double-firing on fix PRs
+          if [ "$IS_FIX" = false ] && [ "$TOUCHES_HIGH_RISK" = false ]; then
+            echo "Not a fix PR and no high-risk files changed — skipping."
             exit 0
           fi
 
-          echo "Fix PR detected."
+          if [ "$IS_FIX" = true ]; then
+            echo "Fix PR detected."
+          fi
+          if [ "$TOUCHES_HIGH_RISK" = true ]; then
+            echo "High-risk state machine or resilience code modified."
+          fi
 
           # --- 2. Skip label or commit message marker ---
           if grep -qF ',skip-regression-check,' <<< ",$PR_LABELS,"; then
@@ -63,8 +93,6 @@ jobs:
           fi
 
           # --- 3. Exempt static-only / docs-only changes ---
-          CHANGED_FILES=$(git diff --name-only "${BASE_REF}...${HEAD_REF}")
-
           if [ -z "$CHANGED_FILES" ]; then
             echo "No changed files — skipping."
             exit 0
@@ -93,6 +121,7 @@ jobs:
           fi
 
           # Whole-function context: detect edits inside existing test functions.
+          # Uses -W (whole function) which works when git recognises function boundaries.
           if git diff "${BASE_REF}...${HEAD_REF}" -W -- '*.rs' | awk '
             /^@@/           { if (has_test && has_add) { found=1; exit } has_test=0; has_add=0 }
             /^ .*#\[test\]/ || /^ .*#\[tokio::test\]/ || /^ .*#\[cfg\(test\)\]/ || /^ .*mod tests/ { has_test=1 }
@@ -104,11 +133,52 @@ jobs:
             exit 0
           fi
 
+          # Line-level check: detect changes inside #[cfg(test)] mod blocks.
+          # git -W relies on function boundary detection which misses Rust mod blocks,
+          # so this fallback checks whether changed line numbers fall within test modules.
+          # We specifically match #[cfg(test)] that is followed by `mod` (same or next
+          # line) to avoid false positives from standalone #[cfg(test)] items like
+          # individual statics or functions.
+          CHANGED_RS=$(echo "$CHANGED_FILES" | grep '\.rs$' || true)
+          if [ -n "$CHANGED_RS" ]; then
+            while IFS= read -r rs_file; do
+              [ -f "$rs_file" ] || continue
+
+              # Find the line where #[cfg(test)] precedes a `mod` declaration.
+              # Handles both `#[cfg(test)] mod tests` (same line) and the two-line form.
+              TEST_MOD_START=$(awk '
+                /^[[:space:]]*#\[cfg\(test\)\].*mod / { print NR; exit }
+                /^[[:space:]]*#\[cfg\(test\)\][[:space:]]*$/ { pending=NR; next }
+                pending && /^[[:space:]]*mod / { print pending; exit }
+                { pending=0 }
+              ' "$rs_file")
+              [ -n "$TEST_MOD_START" ] || continue
+
+              # Get changed line numbers in this file from the diff hunk headers.
+              # Each @@ line looks like: @@ -old,count +new,count @@
+              while IFS= read -r hunk_line; do
+                line_no=$(echo "$hunk_line" | sed -E 's/^@@ -[0-9,]+ \+([0-9]+).*/\1/')
+                [ -n "$line_no" ] || continue
+                if [ "$line_no" -ge "$TEST_MOD_START" ]; then
+                  echo "Test changes found: $rs_file has changes at line $line_no inside #[cfg(test)] mod block (starts at line $TEST_MOD_START)."
+                  exit 0
+                fi
+              done < <(git diff "${BASE_REF}...${HEAD_REF}" -U0 -- "$rs_file" | grep -E '^@@')
+            done <<< "$CHANGED_RS"
+          fi
+
           if grep -qE '^tests/' <<< "$CHANGED_FILES"; then
             echo "Test file changes found under tests/."
             exit 0
           fi
 
           # --- 5. No tests found ---
-          echo "::warning::This PR looks like a bug fix but contains no test changes. Every fix should include a regression test. Add a #[test] or #[tokio::test], or apply the 'skip-regression-check' label if not feasible."
+          if [ "$IS_FIX" = true ]; then
+            echo "::warning::This PR looks like a bug fix but contains no test changes."
+          fi
+          if [ "$TOUCHES_HIGH_RISK" = true ]; then
+            echo "::warning::This PR modifies high-risk state machine or resilience code but includes no test changes."
+          fi
+          echo "::warning::Please add tests exercising the changed behavior, or apply the 'skip-regression-check' label if not feasible."
           exit 1
+

.github/workflows/release.yml

@@ -166,7 +166,7 @@ jobs:
               continue
             fi
             name=$(echo "$filename" | sed "s/^${kind}-//" | sed 's/-[0-9].*-wasm32-wasip2\.tar\.gz$//')
-            url="https://github.com/nearai/ironclaw/releases/download/${RELEASE_TAG}/${filename}"
+            url="https://github.com/nearai/optimclaw/releases/download/${RELEASE_TAG}/${filename}"
 
             manifest="registry/${kind}s/${name}.json"
             if [ -f "$manifest" ]; then
@@ -496,7 +496,7 @@ jobs:
               continue
             fi
             name=$(echo "$filename" | sed "s/^${kind}-//" | sed 's/-[0-9].*-wasm32-wasip2\.tar\.gz$//')
-            url="https://github.com/nearai/ironclaw/releases/download/${RELEASE_TAG}/${filename}"
+            url="https://github.com/nearai/optimclaw/releases/download/${RELEASE_TAG}/${filename}"
 
             manifest="registry/${kind}s/${name}.json"
             if [ -f "$manifest" ]; then

.github/workflows/test.yml

@@ -12,6 +12,7 @@ jobs:
   tests:
     name: Tests (${{ matrix.name }})
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     strategy:
       fail-fast: false
       matrix:
@@ -40,11 +41,14 @@ jobs:
       - name: Build WASM channels (for integration tests)
         run: ./scripts/build-wasm-extensions.sh --channels
       - name: Run Tests
-        run: cargo test ${{ matrix.flags }} -- --nocapture
+        run: |
+          timeout --signal=INT --kill-after=30s 40m \
+            cargo test ${{ matrix.flags }} -- --nocapture
 
   heavy-integration-tests:
     name: Heavy Integration Tests
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
@@ -58,9 +62,13 @@ jobs:
       - name: Build Telegram WASM channel
         run: cargo build --manifest-path channels-src/telegram/Cargo.toml --target wasm32-wasip2 --release
       - name: Run thread scheduling integration tests
-        run: cargo test --no-default-features --features libsql,integration --test e2e_thread_scheduling -- --nocapture
+        run: |
+          timeout --signal=INT --kill-after=30s 15m \
+            cargo test --no-default-features --features libsql,integration --test e2e_thread_scheduling -- --nocapture
       - name: Run Telegram thread-scope regression test
-        run: cargo test --features integration --test telegram_auth_integration test_private_messages_use_chat_id_as_thread_scope -- --exact
+        run: |
+          timeout --signal=INT --kill-after=30s 10m \
+            cargo test --features integration --test telegram_auth_integration test_private_messages_use_chat_id_as_thread_scope -- --exact
 
   telegram-tests:
     name: Telegram Channel Tests
@@ -68,6 +76,7 @@ jobs:
       github.event_name != 'pull_request' ||
       github.base_ref != 'staging'
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
@@ -75,7 +84,9 @@ jobs:
         uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - name: Run Telegram Channel Tests
-        run: cargo test --manifest-path channels-src/telegram/Cargo.toml -- --nocapture
+        run: |
+          timeout --signal=INT --kill-after=30s 10m \
+            cargo test --manifest-path channels-src/telegram/Cargo.toml -- --nocapture
 
   windows-build:
     name: Windows Build (${{ matrix.name }})
@@ -110,6 +121,7 @@ jobs:
       github.event_name != 'pull_request' ||
       github.base_ref != 'staging'
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
@@ -125,7 +137,9 @@ jobs:
       - name: Build all WASM extensions against current WIT
         run: ./scripts/build-wasm-extensions.sh
       - name: Instantiation test (host linker compatibility)
-        run: cargo test --all-features wit_compat -- --nocapture
+        run: |
+          timeout --signal=INT --kill-after=30s 20m \
+            cargo test --all-features wit_compat -- --nocapture
 
   bench-compile:
     name: Benchmark Compilation
@@ -151,7 +165,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v6
       - name: Build Docker image
-        run: docker build -t ironclaw-test:ci .
+        run: docker build -t optimclaw-test:ci .
 
   version-check:
     name: Version Bump Check

AGENTS.md

@@ -1,6 +1,94 @@
 # Agent Rules
 
-## Feature Parity Update Policy
+## Purpose and Precedence
 
+- `AGENTS.md` is the quick-start contract for coding agents. It is not the full architecture spec.
+- Read the relevant subsystem spec before changing a complex area. When a repo spec exists, treat it as authoritative.
+Start with these deeper docs as needed:
+- `CLAUDE.md`
+- `src/agent/CLAUDE.md`
+- `src/channels/web/CLAUDE.md`
+- `src/db/CLAUDE.md`
+- `src/llm/CLAUDE.md`
+- `src/setup/README.md`
+- `src/tools/README.md`
+- `src/workspace/README.md`
+- `src/NETWORK_SECURITY.md`
+- `tests/e2e/CLAUDE.md`
+
+## Architecture Mental Model
+
+- Channels normalize external input into `IncomingMessage`; `ChannelManager` merges all active channel streams.
+- `Agent` owns session/thread/turn handling, submission parsing, the LLM/tool loop, approvals, routines, and background runtime behavior.
+- `AppBuilder` is the composition root that wires database, secrets, LLMs, tools, workspace, extensions, skills, hooks, and cost controls before the agent starts.
+- The web gateway is a browser-facing API/UI layered on top of the same agent/session/tool systems, not a separate product path.
+
+## Where to Work
+
+- Agent/runtime behavior: `src/agent/`
+- Web gateway/API/SSE/WebSocket: `src/channels/web/`
+- Persistence and DB abstractions: `src/db/`
+- Setup/onboarding/configuration flow: `src/setup/`
+- LLM providers and routing: `src/llm/`
+- Workspace, memory, embeddings, search: `src/workspace/`
+- Extensions, tools, channels, MCP, WASM: `src/extensions/`, `src/tools/`, `src/channels/`
+
+## Ownership and Composition Rules
+
+- Keep `src/main.rs` and `src/app.rs` orchestration-focused. Do not move module-owned logic into entrypoints.
+- Module-specific initialization should live in the owning module behind a public factory/helper, not be reimplemented ad hoc.
+- Keep feature-flag branching inside the module that owns the abstraction whenever possible.
+- Prefer extending existing traits and registries over hardcoding one-off integration paths.
+
+## Repo-Wide Coding Rules
+
+- Avoid `.unwrap()` and `.expect()` in production; prefer proper error handling. They are fine in tests, and in production only for truly infallible invariants (e.g., literals/regexes) with a safety comment.
+- Keep clippy clean with zero warnings.
+- Prefer `crate::` imports for cross-module references.
+- Use strong types and enums over stringly-typed control flow when the shape is known.
+
+## Database, Setup, and Config Rules
+
+- New persistence behavior must support both PostgreSQL and libSQL.
+- Add new DB operations to the shared DB trait first, then implement both backends.
+- Treat bootstrap config, DB-backed settings, and encrypted secrets as distinct layers; do not collapse them casually.
+- If onboarding or setup behavior changes, update `src/setup/README.md` in the same branch.
+- Do not break config precedence, bootstrap env loading, DB-backed config reload, or post-secrets LLM re-resolution.
+
+## Security and Runtime Invariants
+
+- Review any change touching listeners, routes, auth, secrets, sandboxing, approvals, or outbound HTTP with a security mindset.
+- Do not weaken bearer-token auth, webhook auth, CORS/origin checks, body limits, rate limits, allowlists, or secret-handling guarantees.
+- Treat Docker containers and external services as untrusted.
+- Session/thread/turn state matters. Submission parsing happens before normal chat handling.
+- Skills are selected deterministically. Tool approval and auth flows are special paths and must not be mixed into normal chat history carelessly.
+- Persistent memory is the workspace system, not just transcript storage; preserve file-like semantics, chunking/search behavior, and identity/system-prompt loading.
+
+## Tools, Channels, and Extensions
+
+- Use a built-in Rust tool for core internal capabilities tightly coupled to the runtime.
+- Use WASM tools or WASM channels for sandboxed extensions and plugin-style integrations.
+- Use MCP for external server integrations when the capability belongs outside the main binary.
+- Preserve extension lifecycle expectations: install, authenticate/configure, activate, remove.
+
+## Docs, Parity, and Testing
+
+- If behavior changes, update the relevant docs/specs in the same branch.
 - If you change implementation status for any feature tracked in `FEATURE_PARITY.md`, update that file in the same branch.
 - Do not open a PR that changes feature behavior without checking `FEATURE_PARITY.md` for needed status updates (`❌`, `🚧`, `✅`, notes, and priorities).
+- Add the narrowest tests that validate the change: unit tests for local logic, integration tests for runtime/DB/routing behavior, and E2E or trace coverage for gateway, approvals, extensions, or other user-visible flows.
+
+## Risk and Change Discipline
+
+- Keep changes scoped; avoid broad refactors unless the task truly requires them.
+- Security, database schema, runtime, worker, CI, and secrets changes are high-risk. Call out rollback risks, compatibility concerns, and hidden side effects.
+- Preserve existing defaults unless the task explicitly changes them.
+- Avoid unrelated file churn and generated-file edits unless required.
+- Respect a dirty worktree and never revert user changes you did not make.
+
+## Before Finishing
+
+- Confirm whether behavior changes require updates to `FEATURE_PARITY.md`, specs, API docs, or `CHANGELOG.md`.
+- Run the most targeted tests/checks that cover the change.
+- Re-check security-sensitive paths when touching auth, secrets, network listeners, sandboxing, or approvals.
+- Keep the final diff scoped to the task.

CLAUDE.md

@@ -1,6 +1,6 @@
-# IronClaw Development Guide
+# OptimClaw Development Guide
 
-**IronClaw** is a secure personal AI assistant — user-first security, self-expanding tools, defense in depth, multi-channel access with proactive background execution.
+**OptimClaw** is a secure personal AI assistant — user-first security, self-expanding tools, defense in depth, multi-channel access with proactive background execution.
 
 ## Build & Test
 
@@ -9,7 +9,7 @@ cargo fmt                                                    # format
 cargo clippy --all --benches --tests --examples --all-features  # lint (zero warnings)
 cargo test                                                   # unit tests
 cargo test --features integration                            # + PostgreSQL tests
-RUST_LOG=ironclaw=debug cargo run                            # run with logging
+RUST_LOG=optimclaw=debug cargo run                            # run with logging
 ```
 
 E2E tests: see `tests/e2e/CLAUDE.md`.
@@ -35,20 +35,20 @@ All I/O is async with tokio. Use `Arc<T>` for shared state, `RwLock` for concurr
 
 ## Extracted Crates
 
-Safety logic lives in `crates/ironclaw_safety/`. The `src/safety/mod.rs` shim re-exports everything for backward compatibility, but **new code should import from `ironclaw_safety` directly** (e.g. `use ironclaw_safety::SafetyLayer`). When touching a file that still uses `crate::safety::*`, migrate its imports to `ironclaw_safety::*`.
+Safety logic lives in `crates/optimclaw_safety/`. The `src/safety/mod.rs` shim re-exports everything for backward compatibility, but **new code should import from `optimclaw_safety` directly** (e.g. `use optimclaw_safety::SafetyLayer`). When touching a file that still uses `crate::safety::*`, migrate its imports to `optimclaw_safety::*`.
 
 ## Project Structure
 
 ```
 crates/
-└── ironclaw_safety/    # Extracted: prompt injection, validation, leak detection, policy
+└── optimclaw_safety/    # Extracted: prompt injection, validation, leak detection, policy
 
 src/
 ├── lib.rs              # Library root, module declarations
 ├── main.rs             # Entry point, CLI args, startup
 ├── app.rs              # App startup orchestration (channel wiring, DB init)
-├── bootstrap.rs        # Base directory resolution (~/.ironclaw), early .env loading
-├── settings.rs         # User settings persistence (~/.ironclaw/settings.json)
+├── bootstrap.rs        # Base directory resolution (~/.optimclaw), early .env loading
+├── settings.rs         # User settings persistence (~/.optimclaw/settings.json)
 ├── service.rs          # OS service management (launchd/systemd daemon install)
 ├── tracing_fmt.rs      # Custom tracing formatter
 ├── util.rs             # Shared utilities
@@ -111,7 +111,7 @@ src/
 │   ├── claude_bridge.rs # Claude Code bridge (spawns claude CLI)
 │   └── proxy_llm.rs    # LlmProvider that proxies through orchestrator
 │
-├── safety/             # Re-export shim for crates/ironclaw_safety (see Extracted Crates)
+├── safety/             # Re-export shim for crates/optimclaw_safety (see Extracted Crates)
 │
 ├── llm/                # Multi-provider LLM integration — see src/llm/CLAUDE.md
 │
@@ -158,6 +158,8 @@ src/
 │
 ├── secrets/            # Secrets management (AES-256-GCM, OS keychain for master key)
 │
+├── profile.rs          # Psychographic profile types, 9-dimension analysis framework
+│
 ├── setup/              # 7-step onboarding wizard — see src/setup/README.md
 │
 ├── skills/             # SKILL.md prompt extension system — see .claude/rules/skills.md
@@ -204,7 +206,7 @@ Pending -> InProgress -> Completed -> Submitted -> Accepted
 
 SKILL.md files extend the agent's prompt with domain-specific instructions. See `.claude/rules/skills.md` for full details.
 
-- **Trust model**: Trusted (user-placed in `~/.ironclaw/skills/` or workspace `skills/`, full tool access) vs Installed (registry, read-only tools)
+- **Trust model**: Trusted (user-placed in `~/.optimclaw/skills/` or workspace `skills/`, full tool access) vs Installed (registry, read-only tools)
 - **Selection pipeline**: gating (check bin/env/config requirements) -> scoring (keywords/patterns/tags) -> budget (fit within `SKILLS_MAX_TOKENS`) -> attenuation (trust-based tool ceiling)
 - **Skill tools**: `skill_list`, `skill_search`, `skill_install`, `skill_remove`
 
@@ -226,9 +228,9 @@ Persistent memory with hybrid search (FTS + vector via RRF). Four tools: `memory
 ## Debugging
 
 ```bash
-RUST_LOG=ironclaw=trace cargo run           # verbose
-RUST_LOG=ironclaw::agent=debug cargo run    # agent module only
-RUST_LOG=ironclaw=debug,tower_http=debug cargo run  # + HTTP request logging
+RUST_LOG=optimclaw=trace cargo run           # verbose
+RUST_LOG=optimclaw::agent=debug cargo run    # agent module only
+RUST_LOG=optimclaw=debug,tower_http=debug cargo run  # + HTTP request logging
 ```
 
 ## Current Limitations

CONTRIBUTING.md

@@ -3,13 +3,49 @@
 ## Getting Started
 
 ```bash
-git clone https://github.com/nearai/ironclaw.git
-cd ironclaw
+git clone https://github.com/nearai/optimclaw.git
+cd optimclaw
 ./scripts/dev-setup.sh
 ```
 
 This installs the Rust toolchain, WASM targets, git hooks, and runs initial checks.
 
+## How to Contribute
+
+- Bug fixes, docs improvements, and focused cleanup tied to a concrete problem are welcome.
+- Search existing issues and PRs before opening a new one to avoid duplicates.
+- Keep changes scoped. One bug, one feature, or one documentation improvement per PR.
+
+### Creating Issues
+
+Open an issue when you are reporting a bug, proposing a feature, or documenting a gap in behavior.
+
+For bug reports, include:
+
+- What you expected to happen
+- What actually happened
+- Clear reproduction steps
+- Relevant logs, screenshots, or error output
+- Environment details when they matter (OS, database backend, feature flags, commit/branch)
+
+For feature requests:
+
+- Open an issue first before writing code
+- Explain the problem being solved, not just the implementation idea
+- Wait for maintainer feedback before investing in a large PR
+
+We require an issue for new features so maintainers can prioritize the work and confirm it fits the roadmap before anyone spends time implementing it.
+
+### Fixing Bugs
+
+- Small, targeted bug-fix PRs are welcome
+- If there is already an issue, link it in your PR
+- If the bug is non-trivial, security-sensitive, or changes behavior across subsystems, open or confirm an issue first so the approach can be aligned before implementation
+
+### Refactor-Only PRs
+
+Refactor-only PRs are not accepted from contributors outside the core team. If a refactor is necessary to land a bug fix or approved feature, keep it minimal and clearly tied to that change.
+
 ## Development Workflow
 
 ```bash
@@ -19,6 +55,45 @@ cargo test                                                   # unit tests
 cargo test --features integration                            # + PostgreSQL tests
 ```
 
+These commands are for day-to-day iteration while you are developing locally. The pre-submission checks below are intentionally stricter and use CI-style flags so you can catch formatting drift and clippy warnings before requesting review.
+
+## Before You Open a PR
+
+Run the local validation checks required before requesting a review. These are stricter than the commands for iterative development:
+
+```bash
+cargo fmt --all -- --check
+cargo clippy --all --benches --tests --examples --all-features -- -D warnings
+cargo build
+cargo test
+```
+
+Also run this when your change touches database-backed or integration behavior:
+
+```bash
+cargo test --features integration
+```
+
+Before asking for review:
+
+- Build and exercise the changed path locally, not just the narrowest unit test
+- Keep the PR focused and avoid mixing unrelated concerns
+- Fill out the PR template with a clear summary, validation notes, and impact assessment
+- If your change affects tracked behavior, update `FEATURE_PARITY.md` in the same branch
+- If onboarding or setup behavior changes, update the relevant setup docs in the same branch
+- If you are using a coding agent and it supports them, run `review-pr` or `pr-shepherd --fix` before opening or updating the PR
+- `codex review --base origin/main` is also encouraged before requesting review
+
+## Review Follow-Through
+
+Review conversations are author-owned.
+
+- Address each review comment with a code change or a clear explanation
+- Resolve conversations you have handled; leave them open only when reviewer judgment is still needed
+- Do not leave review cleanup for maintainers when the follow-through belongs to the author
+
+If a PR is stale for more than 48 hours after review feedback is posted, maintainers may take over the follow-up work and land the changes needed to accomplish the original PR or issue intent.
+
 ## Code Style
 
 - Zero clippy warnings policy
@@ -46,14 +121,14 @@ All PRs follow a risk-based review process:
 | Track | Scope | Requirements |
 |-------|-------|-------------|
 | **A** | Docs, tests, chore, dependency bumps | 1 approval + CI green |
-| **B** | Features, refactors, new tools/channels | 1 approval + CI green + test evidence |
+| **B** | Features, maintainer-requested refactors, new tools/channels | 1 approval + CI green + test evidence |
 | **C** | Security (`src/safety/`, `src/secrets/`), runtime (`src/agent/`, `src/worker/`), database schema, CI workflows | 2 approvals + rollback plan documented |
 
 Select the appropriate track in the PR template based on what your changes touch.
 
 ## Database Changes
 
-IronClaw uses dual-backend persistence (PostgreSQL + libSQL). All new persistence features must support both backends. See `src/db/CLAUDE.md`.
+OptimClaw uses dual-backend persistence (PostgreSQL + libSQL). All new persistence features must support both backends. See `src/db/CLAUDE.md`.
 
 ## Adding Dependencies
 

COVERAGE_PLAN.md

@@ -1,6 +1,6 @@
-# IronClaw Coverage Plan: 63.3% to 95%
+# OptimClaw Coverage Plan: 63.3% to 95%
 
-> Generated 2025-03-06 from [Codecov](https://app.codecov.io/gh/nearai/ironclaw/tree/main/src)
+> Generated 2025-03-06 from [Codecov](https://app.codecov.io/gh/nearai/optimclaw/tree/main/src)
 
 ## Current State
 

Cargo.lock

@@ -157,7 +157,7 @@ version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
 dependencies = [
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -168,7 +168,7 @@ checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
 dependencies = [
  "anstyle",
  "once_cell_polyfill",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1510,7 +1510,7 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "980c2afde4af43d6a05c5be738f9eae595cff86dce1f38f88b95058a98c027f3"
 dependencies = [
- "crossterm 0.29.0",
+ "crossterm",
 ]
 
 [[package]]
@@ -1731,7 +1731,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "04a63daf06a168535c74ab97cdba3ed4fa5d4f32cb36e437dcceb83d66854b7c"
 dependencies = [
  "crokey-proc_macros",
- "crossterm 0.29.0",
+ "crossterm",
  "once_cell",
  "serde",
  "strict",
@@ -1743,7 +1743,7 @@ version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "847f11a14855fc490bd5d059821895c53e77eeb3c2b73ee3dded7ce77c93b231"
 dependencies = [
- "crossterm 0.29.0",
+ "crossterm",
  "proc-macro2",
  "quote",
  "strict",
@@ -1817,22 +1817,6 @@ version = "0.8.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
 
-[[package]]
-name = "crossterm"
-version = "0.28.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "829d955a0bb380ef178a640b91779e3987da38c9aea133b20614cfed8cdea9c6"
-dependencies = [
- "bitflags 2.11.0",
- "crossterm_winapi",
- "mio",
- "parking_lot",
- "rustix 0.38.44",
- "signal-hook",
- "signal-hook-mio",
- "winapi",
-]
-
 [[package]]
 name = "crossterm"
 version = "0.29.0"
@@ -2152,7 +2136,7 @@ dependencies = [
  "libc",
  "option-ext",
  "redox_users 0.5.2",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2339,7 +2323,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2492,21 +2476,6 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
 
-[[package]]
-name = "foreign-types"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
-dependencies = [
- "foreign-types-shared",
-]
-
-[[package]]
-name = "foreign-types-shared"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
-
 [[package]]
 name = "form_urlencoded"
 version = "1.2.2"
@@ -2918,6 +2887,17 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "hostname"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "617aaa3557aef3810a6369d0a99fac8a080891b68bd9f9812a1eeda0c0730cbd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "windows-link",
+]
+
 [[package]]
 name = "html-escape"
 version = "0.2.13"
@@ -3149,6 +3129,7 @@ dependencies = [
  "tokio",
  "tokio-rustls 0.26.4",
  "tower-service",
+ "webpki-roots 1.0.6",
 ]
 
 [[package]]
@@ -3163,22 +3144,6 @@ dependencies = [
  "tokio-io-timeout",
 ]
 
-[[package]]
-name = "hyper-tls"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
-dependencies = [
- "bytes",
- "http-body-util",
- "hyper 1.8.1",
- "hyper-util",
- "native-tls",
- "tokio",
- "tokio-native-tls",
- "tower-service",
-]
-
 [[package]]
 name = "hyper-util"
 version = "0.1.20"
@@ -3434,115 +3399,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "ironclaw"
-version = "0.19.0"
-dependencies = [
- "aes-gcm",
- "aho-corasick",
- "anyhow",
- "async-trait",
- "aws-config",
- "aws-sdk-bedrockruntime",
- "aws-smithy-types",
- "axum 0.8.8",
- "base64 0.22.1",
- "blake3",
- "bollard",
- "bytes",
- "chrono",
- "chrono-tz",
- "clap",
- "clap_complete",
- "criterion",
- "cron",
- "crossterm 0.28.1",
- "deadpool-postgres",
- "dirs 6.0.0",
- "dotenvy",
- "ed25519-dalek",
- "eventsource-stream",
- "flate2",
- "fs4",
- "futures",
- "hex",
- "hkdf",
- "hmac",
- "html-to-markdown-rs",
- "http-body-util",
- "hyper 1.8.1",
- "hyper-util",
- "iana-time-zone",
- "insta",
- "ironclaw_safety",
- "json5",
- "libsql",
- "lru",
- "mime_guess",
- "open",
- "pdf-extract",
- "pgvector",
- "postgres-types",
- "pretty_assertions",
- "rand 0.8.5",
- "readabilityrs",
- "refinery",
- "regex",
- "reqwest",
- "rig-core",
- "rust_decimal",
- "rust_decimal_macros",
- "rustls 0.23.37",
- "rustls-native-certs 0.8.3",
- "rustyline",
- "secrecy",
- "secret-service",
- "security-framework 3.7.0",
- "semver",
- "serde",
- "serde_json",
- "serde_yml",
- "sha2",
- "subtle",
- "tar",
- "tempfile",
- "termimad",
- "testcontainers-modules",
- "thiserror 2.0.18",
- "tokio",
- "tokio-postgres",
- "tokio-postgres-rustls",
- "tokio-stream",
- "tokio-test",
- "tokio-tungstenite 0.26.2",
- "toml",
- "tower 0.5.3",
- "tower-http 0.6.8",
- "tracing",
- "tracing-subscriber",
- "tracing-test",
- "url",
- "urlencoding",
- "uuid",
- "wasmparser 0.220.1",
- "wasmtime",
- "wasmtime-wasi",
- "zbus",
- "zip",
-]
-
-[[package]]
-name = "ironclaw_safety"
-version = "0.1.0"
-dependencies = [
- "aho-corasick",
- "regex",
- "serde_json",
- "thiserror 2.0.18",
- "tracing",
- "url",
-]
-
 [[package]]
 name = "is-docker"
 version = "0.2.0"
@@ -4124,23 +3980,6 @@ dependencies = [
  "rand 0.8.5",
 ]
 
-[[package]]
-name = "native-tls"
-version = "0.2.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "465500e14ea162429d264d44189adc38b199b62b1c21eea9f69e4b73cb03bbf2"
-dependencies = [
- "libc",
- "log",
- "openssl",
- "openssl-probe 0.2.1",
- "openssl-sys",
- "schannel",
- "security-framework 3.7.0",
- "security-framework-sys",
- "tempfile",
-]
-
 [[package]]
 name = "new_debug_unreachable"
 version = "1.0.6"
@@ -4197,7 +4036,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -4363,32 +4202,6 @@ dependencies = [
  "pathdiff",
 ]
 
-[[package]]
-name = "openssl"
-version = "0.10.76"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "951c002c75e16ea2c65b8c7e4d3d51d5530d8dfa7d060b4776828c88cfb18ecf"
-dependencies = [
- "bitflags 2.11.0",
- "cfg-if",
- "foreign-types",
- "libc",
- "once_cell",
- "openssl-macros",
- "openssl-sys",
-]
-
-[[package]]
-name = "openssl-macros"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "openssl-probe"
 version = "0.1.6"
@@ -4402,15 +4215,129 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
 
 [[package]]
-name = "openssl-sys"
-version = "0.9.112"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57d55af3b3e226502be1526dfdba67ab0e9c96fc293004e79576b2b9edb0dbdb"
+name = "optimclaw"
+version = "0.22.0"
 dependencies = [
- "cc",
- "libc",
- "pkg-config",
- "vcpkg",
+ "aes-gcm",
+ "aho-corasick",
+ "anyhow",
+ "async-trait",
+ "aws-config",
+ "aws-sdk-bedrockruntime",
+ "aws-smithy-types",
+ "axum 0.8.8",
+ "base64 0.22.1",
+ "blake3",
+ "bollard",
+ "bytes",
+ "chrono",
+ "chrono-tz",
+ "clap",
+ "clap_complete",
+ "criterion",
+ "cron",
+ "crossterm",
+ "deadpool-postgres",
+ "dirs 6.0.0",
+ "dotenvy",
+ "ed25519-dalek",
+ "eventsource-stream",
+ "flate2",
+ "fs4",
+ "futures",
+ "hex",
+ "hkdf",
+ "hmac",
+ "hostname",
+ "html-to-markdown-rs",
+ "http-body-util",
+ "hyper 1.8.1",
+ "hyper-util",
+ "iana-time-zone",
+ "insta",
+ "json5",
+ "libsql",
+ "lru",
+ "mime_guess",
+ "open",
+ "optimclaw_common",
+ "optimclaw_safety",
+ "pdf-extract",
+ "pgvector",
+ "postgres-types",
+ "pqcrypto-kyber",
+ "pqcrypto-traits",
+ "pretty_assertions",
+ "pty-process",
+ "quinn",
+ "rand 0.8.5",
+ "rcgen",
+ "readabilityrs",
+ "refinery",
+ "regex",
+ "reqwest",
+ "rig-core",
+ "rust_decimal",
+ "rust_decimal_macros",
+ "rustls 0.23.37",
+ "rustls-native-certs 0.8.3",
+ "rustyline",
+ "secrecy",
+ "secret-service",
+ "security-framework 3.7.0",
+ "semver",
+ "serde",
+ "serde_json",
+ "serde_yml",
+ "sha2",
+ "subtle",
+ "sys-info",
+ "tar",
+ "tempfile",
+ "termimad",
+ "testcontainers-modules",
+ "thiserror 2.0.18",
+ "tokio",
+ "tokio-postgres",
+ "tokio-postgres-rustls",
+ "tokio-stream",
+ "tokio-test",
+ "tokio-tungstenite 0.26.2",
+ "toml",
+ "tower 0.5.3",
+ "tower-http 0.6.8",
+ "tracing",
+ "tracing-subscriber",
+ "tracing-test",
+ "url",
+ "urlencoding",
+ "uuid",
+ "wasmparser 0.220.1",
+ "wasmtime",
+ "wasmtime-wasi",
+ "webpki-roots 0.26.11",
+ "zbus",
+ "zip",
+]
+
+[[package]]
+name = "optimclaw_common"
+version = "0.1.0"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "optimclaw_safety"
+version = "0.2.0"
+dependencies = [
+ "aho-corasick",
+ "regex",
+ "serde_json",
+ "thiserror 2.0.18",
+ "tracing",
+ "url",
 ]
 
 [[package]]
@@ -4531,6 +4458,16 @@ version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "19b17cddbe7ec3f8bc800887bab5e717348c95ea2ca0b1bf0837fb964dc67099"
 
+[[package]]
+name = "pem"
+version = "3.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d30c53c26bc5b31a98cd02d20f25a7c8567146caf63ed593a9d87b2775291be"
+dependencies = [
+ "base64 0.22.1",
+ "serde_core",
+]
+
 [[package]]
 name = "percent-encoding"
 version = "2.3.2"
@@ -4900,6 +4837,37 @@ dependencies = [
  "zerocopy 0.8.42",
 ]
 
+[[package]]
+name = "pqcrypto-internals"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4a326caf27cbf2ac291ca7fd56300497ba9e76a8cc6a7d95b7a18b57f22b61d"
+dependencies = [
+ "cc",
+ "dunce",
+ "getrandom 0.3.4",
+ "libc",
+]
+
+[[package]]
+name = "pqcrypto-kyber"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15c00293cf898859d0c771455388054fd69ab712263c73fdc7f287a39b1ba000"
+dependencies = [
+ "cc",
+ "glob",
+ "libc",
+ "pqcrypto-internals",
+ "pqcrypto-traits",
+]
+
+[[package]]
+name = "pqcrypto-traits"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94e851c7654eed9e68d7d27164c454961a616cf8c203d500607ef22c737b51bb"
+
 [[package]]
 name = "precomputed-hash"
 version = "0.1.1"
@@ -4997,6 +4965,16 @@ dependencies = [
  "syn 1.0.109",
 ]
 
+[[package]]
+name = "pty-process"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "71cec9e2670207c5ebb9e477763c74436af3b9091dd550b9fb3c1bec7f3ea266"
+dependencies = [
+ "rustix 1.1.4",
+ "tokio",
+]
+
 [[package]]
 name = "pulley-interpreter"
 version = "28.0.1"
@@ -5185,6 +5163,19 @@ dependencies = [
  "crossbeam-utils",
 ]
 
+[[package]]
+name = "rcgen"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75e669e5202259b5314d1ea5397316ad400819437857b90861765f24c4cf80a2"
+dependencies = [
+ "pem",
+ "ring",
+ "rustls-pki-types",
+ "time",
+ "yasna",
+]
+
 [[package]]
 name = "readabilityrs"
 version = "0.1.2"
@@ -5392,13 +5383,11 @@ dependencies = [
  "http-body-util",
  "hyper 1.8.1",
  "hyper-rustls 0.27.7",
- "hyper-tls",
  "hyper-util",
  "js-sys",
  "log",
  "mime",
  "mime_guess",
- "native-tls",
  "percent-encoding",
  "pin-project-lite",
  "quinn",
@@ -5410,7 +5399,6 @@ dependencies = [
  "serde_urlencoded",
  "sync_wrapper 1.0.2",
  "tokio",
- "tokio-native-tls",
  "tokio-rustls 0.26.4",
  "tokio-util",
  "tower 0.5.3",
@@ -5421,6 +5409,7 @@ dependencies = [
  "wasm-bindgen-futures",
  "wasm-streams",
  "web-sys",
+ "webpki-roots 1.0.6",
 ]
 
 [[package]]
@@ -5575,7 +5564,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -5624,7 +5613,7 @@ dependencies = [
  "once_cell",
  "ring",
  "rustls-pki-types",
- "rustls-webpki 0.103.9",
+ "rustls-webpki 0.103.10",
  "subtle",
  "zeroize",
 ]
@@ -5696,9 +5685,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.9"
+version = "0.103.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7df23109aa6c1567d1c575b9952556388da57401e4ace1d15f79eedad0d8f53"
+checksum = "df33b2b81ac578cabaf06b89b0631153a3f416b0a886e8a7a1707fb51abbd1ef"
 dependencies = [
  "aws-lc-rs",
  "ring",
@@ -6257,7 +6246,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e"
 dependencies = [
  "libc",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -6412,6 +6401,16 @@ dependencies = [
  "syn 2.0.117",
 ]
 
+[[package]]
+name = "sys-info"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b3a0d0aba8bf96a0e1ddfdc352fc53b3df7f39318c71854910c3c4b024ae52c"
+dependencies = [
+ "cc",
+ "libc",
+]
+
 [[package]]
 name = "system-configuration"
 version = "0.7.0"
@@ -6457,9 +6456,9 @@ checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"
 
 [[package]]
 name = "tar"
-version = "0.4.44"
+version = "0.4.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d863878d212c87a19c1a610eb53bb01fe12951c0501cf5a0d65f724914a667a"
+checksum = "22692a6476a21fa75fdfc11d452fda482af402c008cdbaf3476414e122040973"
 dependencies = [
  "filetime",
  "libc",
@@ -6479,10 +6478,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.3.4",
+ "getrandom 0.4.2",
  "once_cell",
  "rustix 1.1.4",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -6753,16 +6752,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "tokio-native-tls"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbae76ab933c85776efabc971569dd6119c580d8f5d448769dec1764bf796ef2"
-dependencies = [
- "native-tls",
- "tokio",
-]
-
 [[package]]
 name = "tokio-postgres"
 version = "0.7.16"
@@ -6881,7 +6870,11 @@ checksum = "7a9daff607c6d2bf6c16fd681ccb7eecc83e4e2cdc1ca067ffaadfca5de7f084"
 dependencies = [
  "futures-util",
  "log",
+ "rustls 0.23.37",
+ "rustls-native-certs 0.8.3",
+ "rustls-pki-types",
  "tokio",
+ "tokio-rustls 0.26.4",
  "tungstenite 0.26.2",
 ]
 
@@ -7095,6 +7088,7 @@ dependencies = [
  "futures-util",
  "http 1.4.0",
  "http-body 1.0.1",
+ "http-body-util",
  "iri-string",
  "pin-project-lite",
  "tower 0.5.3",
@@ -7241,6 +7235,8 @@ dependencies = [
  "httparse",
  "log",
  "rand 0.9.2",
+ "rustls 0.23.37",
+ "rustls-pki-types",
  "sha1",
  "thiserror 2.0.18",
  "utf-8",
@@ -7292,7 +7288,7 @@ checksum = "f2f6fb2847f6742cd76af783a2a2c49e9375d0a111c7bef6f71cd9e738c72d6e"
 dependencies = [
  "memoffset",
  "tempfile",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -7445,12 +7441,6 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
 
-[[package]]
-name = "vcpkg"
-version = "0.2.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
-
 [[package]]
 name = "version_check"
 version = "0.9.5"
@@ -8148,7 +8138,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.48.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -8671,6 +8661,15 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cfe53a6657fd280eaa890a3bc59152892ffa3e30101319d168b781ed6529b049"
 
+[[package]]
+name = "yasna"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e17bb3549cc1321ae1296b9cdc2698e2b6cb1992adfa19a8c72e5b7a738f44cd"
+dependencies = [
+ "time",
+]
+
 [[package]]
 name = "yoke"
 version = "0.8.1"

Cargo.toml

@@ -1,5 +1,5 @@
 [workspace]
-members = [".", "crates/ironclaw_safety"]
+members = [".", "crates/optimclaw_common", "crates/optimclaw_safety"]
 exclude = [
     "channels-src/discord",
     "channels-src/telegram",
@@ -15,19 +15,19 @@ exclude = [
     "tools-src/slack",
     "tools-src/telegram",
     "fuzz",
-    "crates/ironclaw_safety/fuzz",
+    "crates/optimclaw_safety/fuzz",
 ]
 
 [package]
-name = "ironclaw"
-version = "0.19.0"
+name = "optimclaw"
+version = "0.22.0"
 edition = "2024"
 rust-version = "1.92"
 description = "Secure personal AI assistant that protects your data and expands its capabilities on the fly"
 authors = ["NEAR AI <[email protected]>"]
 license = "MIT OR Apache-2.0"
-homepage = "https://github.com/nearai/ironclaw"
-repository = "https://github.com/nearai/ironclaw"
+homepage = "https://github.com/nearai/optimclaw"
+repository = "https://github.com/nearai/optimclaw"
 
 [package.metadata.wix]
 upgrade-guid = "D0156E61-BA37-451E-8AB9-1A2ECCCFA48F"
@@ -40,6 +40,7 @@ eula = false
 tokio = { version = "1", features = ["full"] }
 tokio-stream = { version = "0.1", features = ["sync"] }
 futures = "0.3"
+tokio-tungstenite = { version = "0.26", features = ["rustls-tls-native-roots"] }
 eventsource-stream = "0.2"
 
 # HTTP client
@@ -57,6 +58,7 @@ refinery = { version = "0.8", features = ["tokio-postgres"], optional = true }
 tokio-postgres-rustls = { version = "0.13", optional = true }
 rustls = { version = "0.23", optional = true, default-features = false }
 rustls-native-certs = { version = "0.8", optional = true }
+webpki-roots = { version = "0.26", optional = true }
 
 # Database - libSQL/Turso (optional embedded database)
 libsql = { version = "0.6", optional = true, default-features = false, features = ["core", "replication", "remote", "tls"] }
@@ -88,20 +90,23 @@ async-trait = "0.1"
 clap = { version = "4", features = ["derive", "env"] }
 
 # Terminal
-crossterm = "0.28"
+crossterm = "0.29"
 rustyline = { version = "17", features = ["custom-bindings", "derive", "with-file-history"] }
 termimad = "0.34"
 
 # Channel integrations
 axum = { version = "0.8", features = ["ws"] }
 tower = "0.5"
-tower-http = { version = "0.6", features = ["trace", "cors", "set-header"] }
+tower-http = { version = "0.6", features = ["trace", "cors", "set-header", "catch-panic"] }
 
 # Cron scheduling for routines
 cron = "0.13"
 
+# Shared types
+optimclaw_common = { path = "crates/optimclaw_common", version = "0.1.0" }
+
 # Safety/sanitization
-ironclaw_safety = { path = "crates/ironclaw_safety", version = "0.1.0" }
+optimclaw_safety = { path = "crates/optimclaw_safety", version = "0.2.0" }
 regex = "1"
 aho-corasick = "1"
 
@@ -144,7 +149,7 @@ rand = "0.8"
 subtle = "2"  # Constant-time comparisons for token validation
 
 # Multi-provider LLM support
-rig-core = "0.30"
+rig-core = { version = "0.30", default-features = false, features = ["reqwest-rustls"] }
 
 # AWS Bedrock (native Converse API, opt-in via --features bedrock)
 aws-config = { version = "1", features = ["behavior-version-latest"], optional = true }
@@ -181,10 +186,22 @@ hex = "0.4.3"
 # OpenClaw import (feature gated)
 json5 = { version = "0.4", optional = true }
 
+# Mesh cluster (feature gated)
+pqcrypto-kyber = { version = "0.8", optional = true }
+pqcrypto-traits = { version = "0.3", optional = true }
+sys-info = { version = "0.9", optional = true }
+hostname = { version = "0.4", optional = true }
+quinn = { version = "0.11", default-features = false, features = ["runtime-tokio", "rustls-ring"], optional = true }
+rcgen = { version = "0.13", optional = true }
+
 # macOS keychain
 [target.'cfg(target_os = "macos")'.dependencies]
 security-framework = "3"
 
+# PTY allocation for Claude CLI stdout buffering fix (Unix only)
+[target.'cfg(unix)'.dependencies]
+pty-process = { version = "0.5", features = ["async"] }
+
 # Linux secret-service (GNOME Keyring, KWallet)
 [target.'cfg(target_os = "linux")'.dependencies]
 secret-service = { version = "4", features = ["rt-tokio-crypto-rust"] }
@@ -193,7 +210,6 @@ zbus = "4"
 [dev-dependencies]
 tokio-test = "0.4"
 tracing-test = "0.2"
-tokio-tungstenite = "0.26"
 testcontainers-modules = { version = "0.11", features = ["postgres"] }
 pretty_assertions = "1"
 tempfile = "3"
@@ -216,6 +232,7 @@ postgres = [
     "dep:tokio-postgres-rustls",
     "dep:rustls",
     "dep:rustls-native-certs",
+    "dep:webpki-roots",
     "dep:postgres-types",
     "dep:refinery",
     "dep:pgvector",
@@ -228,6 +245,7 @@ integration = []
 html-to-markdown = ["dep:html-to-markdown-rs", "dep:readabilityrs"]
 bedrock = ["dep:aws-config", "dep:aws-sdk-bedrockruntime", "dep:aws-smithy-types"]
 import = ["dep:json5", "libsql"]
+cluster = ["dep:pqcrypto-kyber", "dep:pqcrypto-traits", "dep:sys-info", "dep:hostname", "dep:quinn", "dep:rcgen", "dep:rustls"]
 
 [[test]]
 name = "e2e_thread_scheduling"
@@ -243,8 +261,7 @@ strip = true          # Remove debug symbols from release binaries
 # The profile that 'cargo dist' will build with
 [profile.dist]
 inherits = "release"
-lto = "fat"           # Full cross-crate LTO (slow build, better codegen)
-codegen-units = 1     # Single codegen unit for maximum optimization
+lto = "thin"
 
 # Config for 'dist'
 [workspace.metadata.dist]
@@ -262,8 +279,10 @@ publish-jobs = []
 targets = [
     "aarch64-apple-darwin",
     "aarch64-unknown-linux-gnu",
+    "aarch64-unknown-linux-musl",
     "x86_64-apple-darwin",
     "x86_64-unknown-linux-gnu",
+    "x86_64-unknown-linux-musl",
     "x86_64-pc-windows-msvc",
 ]
 # The archive format to use for windows builds (defaults .zip)
@@ -281,7 +300,9 @@ cache-builds = true
 
 [workspace.metadata.dist.github-custom-runners]
 aarch64-unknown-linux-gnu = "ubuntu-24.04-arm"
+aarch64-unknown-linux-musl = "ubuntu-24.04-arm"
 x86_64-unknown-linux-gnu = "ubuntu-22.04"
+x86_64-unknown-linux-musl = "ubuntu-22.04"
 x86_64-pc-windows-msvc = "windows-2022"
 x86_64-apple-darwin = "macos-15-intel"
 aarch64-apple-darwin = "macos-14"

Dockerfile

@@ -1,45 +1,71 @@
 # Multi-stage Dockerfile for the IronClaw agent (cloud deployment).
 #
+# Uses cargo-chef for dependency caching — only rebuilds deps when
+# Cargo.toml/Cargo.lock change, not on every source edit.
+#
 # Build:
 #   docker build --platform linux/amd64 -t ironclaw:latest .
 #
 # Run:
 #   docker run --env-file .env -p 3000:3000 ironclaw:latest
 
-# Stage 1: Build
-FROM rust:1.92-slim-bookworm AS builder
+# Stage 1: Install cargo-chef
+FROM rust:1.92-slim-bookworm AS chef
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
     pkg-config libssl-dev cmake gcc g++ \
     && rm -rf /var/lib/apt/lists/* \
     && rustup target add wasm32-wasip2 \
-    && cargo install wasm-tools
+    && cargo install cargo-chef wasm-tools
 
 WORKDIR /app
 
-# Copy manifests first for layer caching
+# Stage 2: Generate the dependency recipe (changes only when Cargo.toml/lock change)
+FROM chef AS planner
+
 COPY Cargo.toml Cargo.lock ./
 COPY crates/ crates/
-
-# Copy source, build script, tests, and supporting directories
 COPY build.rs build.rs
 COPY src/ src/
 COPY tests/ tests/
+COPY benches/ benches/
 COPY migrations/ migrations/
 COPY registry/ registry/
 COPY channels-src/ channels-src/
 COPY wit/ wit/
 COPY providers.json providers.json
-# [[bench]] entries in Cargo.toml require bench sources to exist for cargo to parse the manifest
+
+RUN cargo chef prepare --recipe-path recipe.json
+
+# Stage 3: Build dependencies (cached unless Cargo.toml/lock change)
+FROM chef AS deps
+
+COPY --from=planner /app/recipe.json recipe.json
+RUN cargo chef cook --release --recipe-path recipe.json
+
+# Stage 4: Build the actual binary (only recompiles ironclaw source)
+FROM deps AS builder
+
+COPY Cargo.toml Cargo.lock ./
+COPY crates/ crates/
+COPY build.rs build.rs
+COPY src/ src/
+COPY tests/ tests/
 COPY benches/ benches/
+COPY migrations/ migrations/
+COPY registry/ registry/
+COPY channels-src/ channels-src/
+COPY wit/ wit/
+COPY providers.json providers.json
 
 RUN cargo build --release --bin ironclaw
 
-# Stage 2: Runtime
+# Stage 5: Runtime
 FROM debian:bookworm-slim
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
     ca-certificates libssl3 \
+    && update-ca-certificates \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=builder /app/target/release/ironclaw /usr/local/bin/ironclaw

FEATURE_PARITY.md

@@ -1,8 +1,9 @@
-# IronClaw ↔ OpenClaw Feature Parity Matrix
+# OptimClaw ↔ OpenClaw Feature Parity Matrix
 
-This document tracks feature parity between IronClaw (Rust implementation) and OpenClaw (TypeScript reference implementation). Use this to coordinate work across developers.
+This document tracks feature parity between OptimClaw (Rust implementation) and OpenClaw (TypeScript reference implementation). Use this to coordinate work across developers.
 
 **Legend:**
+
 - ✅ Implemented
 - 🚧 Partial (in progress or incomplete)
 - ❌ Not implemented
@@ -16,7 +17,7 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 
 ## 1. Architecture
 
-| Feature | OpenClaw | IronClaw | Notes |
+| Feature | OpenClaw | OptimClaw | Notes |
 |---------|----------|----------|-------|
 | Hub-and-spoke architecture | ✅ | ✅ | Web gateway as central hub |
 | WebSocket control plane | ✅ | ✅ | Gateway with WebSocket + SSE |
@@ -31,7 +32,7 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 
 ## 2. Gateway System
 
-| Feature | OpenClaw | IronClaw | Notes |
+| Feature | OpenClaw | OptimClaw | Notes |
 |---------|----------|----------|-------|
 | Gateway control plane | ✅ | ✅ | Web gateway with 40+ API endpoints |
 | HTTP endpoints for Control UI | ✅ | ✅ | Web dashboard with chat, memory, jobs, logs, extensions |
@@ -61,15 +62,15 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 
 ## 3. Messaging Channels
 
-| Channel | OpenClaw | IronClaw | Priority | Notes |
+| Channel | OpenClaw | OptimClaw | Priority | Notes |
 |---------|----------|----------|----------|-------|
 | CLI/TUI | ✅ | ✅ | - | Ratatui-based TUI |
 | HTTP webhook | ✅ | ✅ | - | axum with secret validation |
 | REPL (simple) | ✅ | ✅ | - | For testing |
-| WASM channels | ❌ | ✅ | - | IronClaw innovation; host resolves owner scope vs sender identity |
+| WASM channels | ❌ | ✅ | - | OptimClaw innovation; host resolves owner scope vs sender identity |
 | WhatsApp | ✅ | ❌ | P1 | Baileys (Web), same-phone mode with echo detection |
 | Telegram | ✅ | ✅ | - | WASM channel(MTProto), DM pairing, caption, /start, bot_username, DM topics, setup-time owner auto-verification, owner-scoped persistence |
-| Discord | ✅ | ❌ | P2 | discord.js, thread parent binding inheritance |
+| Discord | ✅ | 🚧 | P2 | Gateway `MESSAGE_CREATE` intake restored via websocket queue + WASM poll; Gateway DMs now respect pairing; thread parent binding inheritance and reply/thread parity still incomplete |
 | Signal | ✅ | ✅ | P2 | signal-cli daemonPC, SSE listener HTTP/JSON-R, user/group allowlists, DM pairing |
 | Slack | ✅ | ✅ | - | WASM tool |
 | iMessage | ✅ | ❌ | P3 | BlueBubbles or Linq recommended |
@@ -87,7 +88,7 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 
 ### Telegram-Specific Features (since Feb 2025)
 
-| Feature | OpenClaw | IronClaw | Notes |
+| Feature | OpenClaw | OptimClaw | Notes |
 |---------|----------|----------|-------|
 | Forum topic creation | ✅ | ❌ | Create topics in forum groups |
 | channel_post support | ✅ | ❌ | Bot-to-bot communication |
@@ -99,7 +100,7 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 
 ### Discord-Specific Features (since Feb 2025)
 
-| Feature | OpenClaw | IronClaw | Notes |
+| Feature | OpenClaw | OptimClaw | Notes |
 |---------|----------|----------|-------|
 | Forwarded attachment downloads | ✅ | ❌ | Fetch media from forwarded messages |
 | Faster reaction state machine | ✅ | ❌ | Watchdog + debounce |
@@ -107,7 +108,7 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 
 ### Slack-Specific Features (since Feb 2025)
 
-| Feature | OpenClaw | IronClaw | Notes |
+| Feature | OpenClaw | OptimClaw | Notes |
 |---------|----------|----------|-------|
 | Streaming draft replies | ✅ | ❌ | Partial replies via draft message updates |
 | Configurable stream modes | ✅ | ❌ | Per-channel stream behavior |
@@ -116,23 +117,23 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 
 ### Mattermost-Specific Features (since Mar 2026)
 
-| Feature | OpenClaw | IronClaw | Notes |
+| Feature | OpenClaw | OptimClaw | Notes |
 |---------|----------|----------|-------|
 | Interactive buttons | ✅ | ❌ | Clickable message buttons with signed callback flow |
 | Interactive model picker | ✅ | ❌ | In-channel provider/model chooser |
 
 ### Feishu/Lark-Specific Features (since Mar 2026)
 
-| Feature | OpenClaw | IronClaw | Notes |
+| Feature | OpenClaw | OptimClaw | Notes |
 |---------|----------|----------|-------|
 | Doc/table actions | ✅ | ❌ | `feishu_doc` supports tables, positional insert, color_text, image upload, and file upload |
 | Rich-text embedded media extraction | ✅ | ❌ | Pull video/media attachments from post messages |
 
 ### Channel Features
 
-| Feature | OpenClaw | IronClaw | Notes |
+| Feature | OpenClaw | OptimClaw | Notes |
 |---------|----------|----------|-------|
-| DM pairing codes | ✅ | ✅ | `ironclaw pairing list/approve`, host APIs |
+| DM pairing codes | ✅ | ✅ | `optimclaw pairing list/approve`, host APIs |
 | Allowlist/blocklist | ✅ | 🚧 | `allow_from` + pairing store + hardened command/group allowlists |
 | Self-message bypass | ✅ | ❌ | Own messages skip pairing |
 | Mention-based activation | ✅ | ✅ | bot_username + respond_to_all_group_messages |
@@ -150,7 +151,7 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 
 ## 4. CLI Commands
 
-| Command | OpenClaw | IronClaw | Priority | Notes |
+| Command | OpenClaw | OptimClaw | Priority | Notes |
 |---------|----------|----------|----------|-------|
 | `run` (agent) | ✅ | ✅ | - | Default command |
 | `tool install/list/remove` | ✅ | ✅ | - | WASM tools |
@@ -160,7 +161,7 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 | `config` | ✅ | ✅ | - | Read/write config plus validate/path helpers |
 | `backup` | ✅ | ❌ | P3 | Create/verify local backup archives |
 | `channels` | ✅ | 🚧 | P2 | `list` implemented; `enable`/`disable`/`status` deferred pending config source unification |
-| `models` | ✅ | 🚧 | - | Model selector in TUI |
+| `models` | ✅ | 🚧 | P1 | `models list [<provider>]` (`--verbose`, `--json`; fetches live model list when provider specified), `models status` (`--json`), `models set <model>`, `models set-provider <provider> [--model model]` (alias normalization, config.toml + .env persistence). Remaining: `set` doesn't validate model against live list. |
 | `status` | ✅ | ✅ | - | System status (enriched session details) |
 | `agents` | ✅ | ❌ | P3 | Multi-agent management |
 | `sessions` | ✅ | ❌ | P3 | Session listing (shows subagent models) |
@@ -169,7 +170,7 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 | `pairing` | ✅ | ✅ | - | list/approve, account selector |
 | `nodes` | ✅ | ❌ | P3 | Device management, remove/clear flows |
 | `plugins` | ✅ | ❌ | P3 | Plugin management |
-| `hooks` | ✅ | ✅ | P2 | Lifecycle hooks |
+| `hooks` | ✅ | ✅ | P2 | `hooks list` (bundled + plugin discovery, `--verbose`, `--json`) |
 | `cron` | ✅ | 🚧 | P2 | list/create/edit/enable/disable/delete/history; TODO: `cron run`, model/thinking fields |
 | `webhooks` | ✅ | ❌ | P3 | Webhook config |
 | `message send` | ✅ | ❌ | P2 | Send to channels |
@@ -188,9 +189,9 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 
 ## 5. Agent System
 
-| Feature | OpenClaw | IronClaw | Notes |
+| Feature | OpenClaw | OptimClaw | Notes |
 |---------|----------|----------|-------|
-| Pi agent runtime | ✅ | ➖ | IronClaw uses custom runtime |
+| Pi agent runtime | ✅ | ➖ | OptimClaw uses custom runtime |
 | RPC-based execution | ✅ | ✅ | Orchestrator/worker pattern |
 | Multi-provider failover | ✅ | ✅ | `FailoverProvider` tries providers sequentially on retryable errors |
 | Per-sender sessions | ✅ | ✅ | |
@@ -204,7 +205,7 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 | Skills (modular capabilities) | ✅ | ✅ | Prompt-based skills with trust gating, attenuation, activation criteria, catalog, selector |
 | Skill routing blocks | ✅ | 🚧 | ActivationCriteria (keywords, patterns, tags) but no "Use when / Don't use when" blocks |
 | Skill path compaction | ✅ | ❌ | ~ prefix to reduce prompt tokens |
-| Thinking modes (off/minimal/low/medium/high/xhigh/adaptive) | ✅ | ❌ | Configurable reasoning depth |
+| Thinking modes (off/minimal/low/medium/high/xhigh/adaptive) | ✅ | 🚧 | thinkingConfig for Gemini models (thinkingBudget/thinkingLevel); no per-level control yet |
 | Per-model thinkingDefault override | ✅ | ❌ | Override thinking level per model; Anthropic Claude 4.6 defaults to adaptive |
 | Block-level streaming | ✅ | ❌ | |
 | Tool-level streaming | ✅ | ❌ | |
@@ -231,17 +232,22 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 
 ## 6. Model & Provider Support
 
-| Provider | OpenClaw | IronClaw | Priority | Notes |
+| Provider | OpenClaw | OptimClaw | Priority | Notes |
 |----------|----------|----------|----------|-------|
 | NEAR AI | ✅ | ✅ | - | Primary provider |
 | Anthropic (Claude) | ✅ | 🚧 | - | Via NEAR AI proxy; Opus 4.5, Sonnet 4, Sonnet 4.6, adaptive thinking default |
 | OpenAI | ✅ | 🚧 | - | Via NEAR AI proxy; GPT-5.4 + Codex OAuth |
-| AWS Bedrock | ✅ | ❌ | P3 | |
-| Google Gemini | ✅ | ❌ | P3 | |
-| NVIDIA API | ✅ | ❌ | P3 | New provider |
+| AWS Bedrock | ✅ | ✅ | - | Native Converse API via aws-sdk-bedrockruntime (requires `--features bedrock`) |
+| Google Gemini | ✅ | ✅ | - | OAuth (PKCE + S256), function calling, thinkingConfig, generationConfig |
+| io.net | ✅ | ✅ | P3 | Via `ionet` adapter |
+| Mistral | ✅ | ✅ | P3 | Via `mistral` adapter |
+| Yandex AI Studio | ✅ | ✅ | P3 | Via `yandex` adapter |
+| Cloudflare Workers AI | ✅ | ✅ | P3 | Via `cloudflare` adapter |
+| NVIDIA API | ✅ | ✅ | P3 | Via `nvidia` adapter and `providers.json` |
 | OpenRouter | ✅ | ✅ | - | Via OpenAI-compatible provider (RigAdapter) |
-| Tinfoil | ❌ | ✅ | - | Private inference provider (IronClaw-only) |
+| Tinfoil | ❌ | ✅ | - | Private inference provider (OptimClaw-only) |
 | OpenAI-compatible | ❌ | ✅ | - | Generic OpenAI-compatible endpoint (RigAdapter) |
+| GitHub Copilot | ✅ | ✅ | - | Dedicated provider with OAuth token exchange (`GithubCopilotProvider`) |
 | Ollama (local) | ✅ | ✅ | - | via `rig::providers::ollama` (full support) |
 | Perplexity | ✅ | ❌ | P3 | Freshness parameter for web_search |
 | MiniMax | ✅ | ❌ | P3 | Regional endpoint selection |
@@ -251,7 +257,7 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 
 ### Model Features
 
-| Feature | OpenClaw | IronClaw | Notes |
+| Feature | OpenClaw | OptimClaw | Notes |
 |---------|----------|----------|-------|
 | Auto-discovery | ✅ | ❌ | |
 | Failover chains | ✅ | ✅ | `FailoverProvider` with configurable `fallback_model` |
@@ -267,7 +273,7 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 
 ## 7. Media Handling
 
-| Feature | OpenClaw | IronClaw | Priority | Notes |
+| Feature | OpenClaw | OptimClaw | Priority | Notes |
 |---------|----------|----------|----------|-------|
 | Image processing (Sharp) | ✅ | ❌ | P2 | Resize, format convert |
 | Configurable image resize dims | ✅ | ❌ | P2 | Per-agent dimension config |
@@ -290,12 +296,12 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 
 ## 8. Plugin & Extension System
 
-| Feature | OpenClaw | IronClaw | Notes |
+| Feature | OpenClaw | OptimClaw | Notes |
 |---------|----------|----------|-------|
 | Dynamic loading | ✅ | ✅ | WASM modules |
 | Manifest validation | ✅ | ✅ | WASM metadata |
 | HTTP path registration | ✅ | ❌ | Plugin routes |
-| Workspace-relative install | ✅ | ✅ | ~/.ironclaw/tools/ |
+| Workspace-relative install | ✅ | ✅ | ~/.optimclaw/tools/ |
 | Channel plugins | ✅ | ✅ | WASM channels |
 | Auth plugins | ✅ | ❌ | |
 | Memory plugins | ✅ | ❌ | Custom backends + selectable memory slot |
@@ -315,7 +321,7 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 
 ## 9. Configuration System
 
-| Feature | OpenClaw | IronClaw | Notes |
+| Feature | OpenClaw | OptimClaw | Notes |
 |---------|----------|----------|-------|
 | Primary config file | ✅ `~/.openclaw/openclaw.json` | ✅ `.env` | Different formats |
 | JSON5 support | ✅ | ❌ | Comments, trailing commas |
@@ -324,7 +330,7 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 | Config validation/schema | ✅ | ✅ | Type-safe Config struct + `openclaw config validate` |
 | Hot-reload | ✅ | ❌ | |
 | Legacy migration | ✅ | ➖ | |
-| State directory | ✅ `~/.openclaw-state/` | ✅ `~/.ironclaw/` | |
+| State directory | ✅ `~/.openclaw-state/` | ✅ `~/.optimclaw/` | |
 | Credentials directory | ✅ | ✅ | Session files |
 | Full model compat fields in schema | ✅ | ❌ | pi-ai model compat exposed in config |
 
@@ -334,7 +340,7 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 
 ## 10. Memory & Knowledge System
 
-| Feature | OpenClaw | IronClaw | Notes |
+| Feature | OpenClaw | OptimClaw | Notes |
 |---------|----------|----------|-------|
 | Vector memory | ✅ | ✅ | pgvector |
 | Session-based memory | ✅ | ✅ | |
@@ -345,7 +351,7 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 | OpenAI embeddings | ✅ | ✅ | |
 | Gemini embeddings | ✅ | ❌ | |
 | Local embeddings | ✅ | ❌ | |
-| SQLite-vec backend | ✅ | ❌ | IronClaw uses PostgreSQL |
+| SQLite-vec backend | ✅ | ❌ | OptimClaw uses PostgreSQL |
 | LanceDB backend | ✅ | ❌ | Configurable auto-capture max length |
 | QMD backend | ✅ | ❌ | |
 | Atomic reindexing | ✅ | ✅ | |
@@ -363,7 +369,7 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 
 ## 11. Mobile Apps
 
-| Feature | OpenClaw | IronClaw | Priority | Notes |
+| Feature | OpenClaw | OptimClaw | Priority | Notes |
 |---------|----------|----------|----------|-------|
 | iOS app (SwiftUI) | ✅ | 🚫 | - | Out of scope initially |
 | Android app (Kotlin) | ✅ | 🚫 | - | Out of scope initially |
@@ -384,7 +390,7 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 
 ## 12. macOS App
 
-| Feature | OpenClaw | IronClaw | Priority | Notes |
+| Feature | OpenClaw | OptimClaw | Priority | Notes |
 |---------|----------|----------|----------|-------|
 | SwiftUI native app | ✅ | 🚫 | - | Out of scope |
 | Menu bar presence | ✅ | 🚫 | - | Animated menubar icon |
@@ -405,7 +411,7 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 
 ## 13. Web Interface
 
-| Feature | OpenClaw | IronClaw | Priority | Notes |
+| Feature | OpenClaw | OptimClaw | Priority | Notes |
 |---------|----------|----------|----------|-------|
 | Control UI Dashboard | ✅ | ✅ | - | Web gateway with chat, memory, jobs, logs, extensions |
 | Channel status view | ✅ | 🚧 | P2 | Gateway status widget, full channel view pending |
@@ -425,7 +431,7 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 
 ## 14. Automation
 
-| Feature | OpenClaw | IronClaw | Priority | Notes |
+| Feature | OpenClaw | OptimClaw | Priority | Notes |
 |---------|----------|----------|----------|-------|
 | Cron jobs | ✅ | ✅ | - | Routines with cron trigger |
 | Per-job model fallback override | ✅ | ❌ | P2 | `payload.fallbacks` overrides agent-level fallbacks |
@@ -459,14 +465,14 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 
 ## 15. Security Features
 
-| Feature | OpenClaw | IronClaw | Notes |
+| Feature | OpenClaw | OptimClaw | Notes |
 |---------|----------|----------|-------|
 | Gateway token auth | ✅ | ✅ | Bearer token auth on web gateway |
 | Device pairing | ✅ | ❌ | |
 | Tailscale identity | ✅ | ❌ | |
 | Trusted-proxy auth | ✅ | ❌ | Header-based reverse proxy auth |
-| OAuth flows | ✅ | 🚧 | NEAR AI OAuth |
-| DM pairing verification | ✅ | ✅ | ironclaw pairing approve, host APIs |
+| OAuth flows | ✅ | 🚧 | NEAR AI OAuth + Gemini OAuth (PKCE, S256) + hosted extension/MCP OAuth broker; external auth-proxy rollout still pending |
+| DM pairing verification | ✅ | ✅ | optimclaw pairing approve, host APIs |
 | Allowlist/blocklist | ✅ | 🚧 | allow_from + pairing store |
 | Per-group tool policies | ✅ | ❌ | |
 | Exec approvals | ✅ | ✅ | TUI overlay |
@@ -477,7 +483,7 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 | Loopback-first | ✅ | 🚧 | HTTP binds 0.0.0.0 |
 | Docker sandbox | ✅ | ✅ | Orchestrator/worker containers |
 | Podman support | ✅ | ❌ | Alternative to Docker |
-| WASM sandbox | ❌ | ✅ | IronClaw innovation |
+| WASM sandbox | ❌ | ✅ | OptimClaw innovation |
 | Sandbox env sanitization | ✅ | 🚧 | Shell tool scrubs env vars (secret detection); docker container env sanitization partial |
 | Tool policies | ✅ | ✅ | |
 | Elevated mode | ✅ | ❌ | |
@@ -499,7 +505,7 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 
 ## 16. Development & Build System
 
-| Feature | OpenClaw | IronClaw | Notes |
+| Feature | OpenClaw | OptimClaw | Notes |
 |---------|----------|----------|-------|
 | Primary language | TypeScript | Rust | Different ecosystems |
 | Build tool | tsdown | cargo | |
@@ -522,9 +528,10 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 ## Implementation Priorities
 
 ### P0 - Core (Already Done)
+
 - ✅ TUI channel with approval overlays
 - ✅ HTTP webhook channel
-- ✅ DM pairing (ironclaw pairing list/approve, host APIs)
+- ✅ DM pairing (optimclaw pairing list/approve, host APIs)
 - ✅ WASM tool sandbox
 - ✅ Workspace/memory with hybrid search + embeddings batching
 - ✅ Prompt injection defense
@@ -549,6 +556,7 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 - ✅ OpenAI-compatible / OpenRouter provider support
 
 ### P1 - High Priority
+
 - ❌ Slack channel (real implementation)
 - ✅ Telegram channel (WASM, DM pairing, caption, /start)
 - ❌ WhatsApp channel
@@ -556,6 +564,7 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 - ✅ Hooks system (core lifecycle hooks + bundled/plugin/workspace hooks + outbound webhooks)
 
 ### P2 - Medium Priority
+
 - ❌ Media handling (images, PDFs)
 - ✅ Ollama/local model support (via rig::providers::ollama)
 - ❌ Configuration hot-reload
@@ -564,6 +573,7 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 - ❌ Partial output preservation on abort
 
 ### P3 - Lower Priority
+
 - ❌ Discord channel
 - ❌ Matrix channel
 - ❌ Other messaging platforms
@@ -595,7 +605,7 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 
 ## Deviations from OpenClaw
 
-IronClaw intentionally differs from OpenClaw in these ways:
+OptimClaw intentionally differs from OpenClaw in these ways:
 
 1. **Rust vs TypeScript**: Native performance, memory safety, single binary distribution
 2. **WASM sandbox vs Docker**: Lighter weight, faster startup, capability-based security
@@ -603,7 +613,7 @@ IronClaw intentionally differs from OpenClaw in these ways:
 4. **NEAR AI focus**: Primary provider with session-based auth
 5. **No mobile/desktop apps**: Focus on server-side and CLI initially
 6. **WASM channels**: Novel extension mechanism not in OpenClaw
-7. **Tinfoil private inference**: IronClaw-only provider for private/encrypted inference
+7. **Tinfoil private inference**: OptimClaw-only provider for private/encrypted inference
 8. **GitHub WASM tool**: Native GitHub integration as WASM tool
 9. **Prompt-based skills**: Different approach than OpenClaw capability bundles (trust gating, attenuation)
 

README.ja.md

@@ -1,8 +1,8 @@
 <p align="center">
-  <img src="ironclaw.png?v=2" alt="IronClaw" width="200"/>
+  <img src="optimclaw.png?v=2" alt="OptimClaw" width="200"/>
 </p>
 
-<h1 align="center">IronClaw</h1>
+<h1 align="center">OptimClaw</h1>
 
 <p align="center">
   <strong>あなたの味方になる、安全なパーソナルAIアシスタント</strong>
@@ -10,8 +10,8 @@
 
 <p align="center">
   <a href="#license"><img src="https://img.shields.io/badge/license-MIT%20OR%20Apache%202.0-blue.svg" alt="License: MIT OR Apache-2.0" /></a>
-  <a href="https://t.me/ironclawAI"><img src="https://img.shields.io/badge/Telegram-%40ironclawAI-26A5E4?style=flat&logo=telegram&logoColor=white" alt="Telegram: @ironclawAI" /></a>
-  <a href="https://www.reddit.com/r/ironclawAI/"><img src="https://img.shields.io/badge/Reddit-r%2FironclawAI-FF4500?style=flat&logo=reddit&logoColor=white" alt="Reddit: r/ironclawAI" /></a>
+  <a href="https://t.me/optimclawAI"><img src="https://img.shields.io/badge/Telegram-%40optimclawAI-26A5E4?style=flat&logo=telegram&logoColor=white" alt="Telegram: @optimclawAI" /></a>
+  <a href="https://www.reddit.com/r/optimclawAI/"><img src="https://img.shields.io/badge/Reddit-r%2FoptimclawAI-FF4500?style=flat&logo=reddit&logoColor=white" alt="Reddit: r/optimclawAI" /></a>
 </p>
 
 <p align="center">
@@ -34,16 +34,16 @@
 
 ## フィロソフィー
 
-IronClawはシンプルな原則に基づいて構築されています：**あなたのAIアシスタントは、あなたのために働くべきであり、あなたに不利益をもたらすべきではありません。**
+OptimClawはシンプルな原則に基づいて構築されています：**あなたのAIアシスタントは、あなたのために働くべきであり、あなたに不利益をもたらすべきではありません。**
 
-AIシステムがデータの取り扱いについて不透明になり、企業の利益に沿って調整されることが増えている世界で、IronClawは異なるアプローチを取ります：
+AIシステムがデータの取り扱いについて不透明になり、企業の利益に沿って調整されることが増えている世界で、OptimClawは異なるアプローチを取ります：
 
 - **あなたのデータはあなたのもの** - すべての情報はローカルに保存・暗号化され、あなたの管理下から離れることはありません
 - **設計段階からの透明性** - オープンソース、監査可能、隠れたテレメトリやデータ収集なし
 - **自己拡張する能力** - ベンダーのアップデートを待たずに、新しいツールをその場で構築
 - **多層防御** - 複数のセキュリティレイヤーがプロンプトインジェクションやデータ流出から保護
 
-IronClawは、個人生活にも仕事にも本当に信頼できるAIアシスタントです。
+OptimClawは、個人生活にも仕事にも本当に信頼できるAIアシスタントです。
 
 ## 機能
 
@@ -66,7 +66,7 @@ IronClawは、個人生活にも仕事にも本当に信頼できるAIアシス
 
 ### 自己拡張
 
-- **動的ツール構築** - 必要なものを説明すると、IronClawがWASMツールとして構築
+- **動的ツール構築** - 必要なものを説明すると、OptimClawがWASMツールとして構築
 - **MCPプロトコル** - Model Context Protocolサーバーに接続して追加機能を利用
 - **プラグインアーキテクチャ** - 再起動なしで新しいWASMツールやチャネルを追加
 
@@ -86,12 +86,12 @@ IronClawは、個人生活にも仕事にも本当に信頼できるAIアシス
 
 ## ダウンロードまたはビルド
 
-最新のアップデートは[リリースページ](https://github.com/nearai/ironclaw/releases/)をご覧ください。
+最新のアップデートは[リリースページ](https://github.com/nearai/optimclaw/releases/)をご覧ください。
 
 <details>
   <summary>Windowsインストーラーでインストール（Windows）</summary>
 
-[Windowsインストーラー](https://github.com/nearai/ironclaw/releases/latest/download/ironclaw-x86_64-pc-windows-msvc.msi)をダウンロードして実行してください。
+[Windowsインストーラー](https://github.com/nearai/optimclaw/releases/latest/download/optimclaw-x86_64-pc-windows-msvc.msi)をダウンロードして実行してください。
 
 </details>
 
@@ -99,7 +99,7 @@ IronClawは、個人生活にも仕事にも本当に信頼できるAIアシス
   <summary>PowerShellスクリプトでインストール（Windows）</summary>
 
 ```sh
-irm https://github.com/nearai/ironclaw/releases/latest/download/ironclaw-installer.ps1 | iex
+irm https://github.com/nearai/optimclaw/releases/latest/download/optimclaw-installer.ps1 | iex
 ```
 
 </details>
@@ -108,7 +108,7 @@ irm https://github.com/nearai/ironclaw/releases/latest/download/ironclaw-install
   <summary>シェルスクリプトでインストール（macOS、Linux、Windows/WSL）</summary>
 
 ```sh
-curl --proto '=https' --tlsv1.2 -LsSf https://github.com/nearai/ironclaw/releases/latest/download/ironclaw-installer.sh | sh
+curl --proto '=https' --tlsv1.2 -LsSf https://github.com/nearai/optimclaw/releases/latest/download/optimclaw-installer.sh | sh
 ```
 </details>
 
@@ -116,7 +116,7 @@ curl --proto '=https' --tlsv1.2 -LsSf https://github.com/nearai/ironclaw/release
   <summary>Homebrewでインストール（macOS/Linux）</summary>
 
 ```sh
-brew install ironclaw
+brew install optimclaw
 ```
 
 </details>
@@ -128,8 +128,8 @@ brew install ironclaw
 
 ```bash
 # リポジトリをクローン
-git clone https://github.com/nearai/ironclaw.git
-cd ironclaw
+git clone https://github.com/nearai/optimclaw.git
+cd optimclaw
 
 # ビルド
 cargo build --release
@@ -146,25 +146,25 @@ cargo test
 
 ```bash
 # データベースを作成
-createdb ironclaw
+createdb optimclaw
 
 # pgvectorを有効化
-psql ironclaw -c "CREATE EXTENSION IF NOT EXISTS vector;"
+psql optimclaw -c "CREATE EXTENSION IF NOT EXISTS vector;"
 ```
 
 ## 設定
 
-セットアップウィザードを実行してIronClawを設定します：
+セットアップウィザードを実行してOptimClawを設定します：
 
 ```bash
-ironclaw onboard
+optimclaw onboard
 ```
 
-ウィザードは、データベース接続、NEAR AI認証（ブラウザOAuth経由）、シークレットの暗号化（システムキーチェーンを使用）を処理します。設定は接続されたデータベースに永続化されます。ブートストラップ変数（例：`DATABASE_URL`、`LLM_BACKEND`）は、データベース接続前に利用できるよう`~/.ironclaw/.env`に書き込まれます。
+ウィザードは、データベース接続、NEAR AI認証（ブラウザOAuth経由）、シークレットの暗号化（システムキーチェーンを使用）を処理します。設定は接続されたデータベースに永続化されます。ブートストラップ変数（例：`DATABASE_URL`、`LLM_BACKEND`）は、データベース接続前に利用できるよう`~/.optimclaw/.env`に書き込まれます。
 
 ### 代替LLMプロバイダー
 
-IronClawはデフォルトでNEAR AIを使用しますが、多くのLLMプロバイダーをすぐに利用できます。組み込みプロバイダーには**Anthropic**、**OpenAI**、**Google Gemini**、**MiniMax**、**Mistral**、**Ollama**（ローカル）が含まれます。**OpenRouter**（300以上のモデル）、**Together AI**、**Fireworks AI**、セルフホストサーバー（**vLLM**、**LiteLLM**）などのOpenAI互換サービスもサポートされています。
+OptimClawはデフォルトでNEAR AIを使用しますが、多くのLLMプロバイダーをすぐに利用できます。組み込みプロバイダーには**Anthropic**、**OpenAI**、**Google Gemini**、**MiniMax**、**Mistral**、**Ollama**（ローカル）が含まれます。**OpenRouter**（300以上のモデル）、**Together AI**、**Fireworks AI**、セルフホストサーバー（**vLLM**、**LiteLLM**）などのOpenAI互換サービスもサポートされています。
 
 ウィザードでプロバイダーを選択するか、環境変数を直接設定してください：
 
@@ -184,7 +184,7 @@ LLM_MODEL=anthropic/claude-sonnet-4
 
 ## セキュリティ
 
-IronClawは、データを保護し悪用を防ぐために多層防御を実装しています。
+OptimClawは、データを保護し悪用を防ぐために多層防御を実装しています。
 
 ### WASMサンドボックス
 
@@ -280,13 +280,13 @@ WASM ──► 許可リスト ──► リーク    ──► 認証情報 ─
 
 ```bash
 # 初回セットアップ（データベース、認証などを設定）
-ironclaw onboard
+optimclaw onboard
 
 # インタラクティブREPLを起動
 cargo run
 
 # デバッグログ付き
-RUST_LOG=ironclaw=debug cargo run
+RUST_LOG=optimclaw=debug cargo run
 ```
 
 ## 開発
@@ -299,7 +299,7 @@ cargo fmt
 cargo clippy --all --benches --tests --examples --all-features
 
 # テスト実行
-createdb ironclaw_test
+createdb optimclaw_test
 cargo test
 
 # 特定のテストを実行
@@ -311,7 +311,7 @@ cargo test test_name
 
 ## OpenClawの系譜
 
-IronClawは[OpenClaw](https://github.com/openclaw/openclaw)にインスパイアされたRust再実装です。完全な対応表は[FEATURE_PARITY.md](FEATURE_PARITY.md)をご覧ください。
+OptimClawは[OpenClaw](https://github.com/openclaw/openclaw)にインスパイアされたRust再実装です。完全な対応表は[FEATURE_PARITY.md](FEATURE_PARITY.md)をご覧ください。
 
 主な違い：
 

README.md

@@ -1,8 +1,8 @@
 <p align="center">
-  <img src="ironclaw.png?v=2" alt="IronClaw" width="200"/>
+  <img src="optimclaw.png?v=2" alt="OptimClaw" width="200"/>
 </p>
 
-<h1 align="center">IronClaw</h1>
+<h1 align="center">OptimClaw</h1>
 
 <p align="center">
   <strong>Your secure personal AI assistant, always on your side</strong>
@@ -10,8 +10,11 @@
 
 <p align="center">
   <a href="#license"><img src="https://img.shields.io/badge/license-MIT%20OR%20Apache%202.0-blue.svg" alt="License: MIT OR Apache-2.0" /></a>
-  <a href="https://t.me/ironclawAI"><img src="https://img.shields.io/badge/Telegram-%40ironclawAI-26A5E4?style=flat&logo=telegram&logoColor=white" alt="Telegram: @ironclawAI" /></a>
-  <a href="https://www.reddit.com/r/ironclawAI/"><img src="https://img.shields.io/badge/Reddit-r%2FironclawAI-FF4500?style=flat&logo=reddit&logoColor=white" alt="Reddit: r/ironclawAI" /></a>
+  <a href="https://t.me/optimclawAI"><img src="https://img.shields.io/badge/Telegram-%40optimclawAI-26A5E4?style=flat&logo=telegram&logoColor=white" alt="Telegram: @optimclawAI" /></a>
+  <a href="https://www.reddit.com/r/optimclawAI/"><img src="https://img.shields.io/badge/Reddit-r%2FoptimclawAI-FF4500?style=flat&logo=reddit&logoColor=white" alt="Reddit: r/optimclawAI" /></a>
+  <a href="https://gitcgr.com/nearai/optimclaw">
+    <img src="https://gitcgr.com/badge/nearai/optimclaw.svg" alt="gitcgr" />
+  </a>
 </p>
 
 <p align="center">
@@ -24,6 +27,8 @@
 <p align="center">
   <a href="#philosophy">Philosophy</a> •
   <a href="#features">Features</a> •
+  <a href="#mesh-cluster">Mesh Cluster</a> •
+  <a href="#lazy-tools">Lazy Tools</a> •
   <a href="#installation">Installation</a> •
   <a href="#configuration">Configuration</a> •
   <a href="#security">Security</a> •
@@ -34,16 +39,16 @@
 
 ## Philosophy
 
-IronClaw is built on a simple principle: **your AI assistant should work for you, not against you**.
+OptimClaw is built on a simple principle: **your AI assistant should work for you, not against you**.
 
-In a world where AI systems are increasingly opaque about data handling and aligned with corporate interests, IronClaw takes a different approach:
+In a world where AI systems are increasingly opaque about data handling and aligned with corporate interests, OptimClaw takes a different approach:
 
 - **Your data stays yours** - All information is stored locally, encrypted, and never leaves your control
 - **Transparency by design** - Open source, auditable, no hidden telemetry or data harvesting
 - **Self-expanding capabilities** - Build new tools on the fly without waiting for vendor updates
 - **Defense in depth** - Multiple security layers protect against prompt injection and data exfiltration
 
-IronClaw is the AI assistant you can actually trust with your personal and professional life.
+OptimClaw is the AI assistant you can actually trust with your personal and professional life.
 
 ## Features
 
@@ -66,7 +71,7 @@ IronClaw is the AI assistant you can actually trust with your personal and profe
 
 ### Self-Expanding
 
-- **Dynamic Tool Building** - Describe what you need, and IronClaw builds it as a WASM tool
+- **Dynamic Tool Building** - Describe what you need, and OptimClaw builds it as a WASM tool
 - **MCP Protocol** - Connect to Model Context Protocol servers for additional capabilities
 - **Plugin Architecture** - Drop in new WASM tools and channels without restarting
 
@@ -76,6 +81,50 @@ IronClaw is the AI assistant you can actually trust with your personal and profe
 - **Workspace Filesystem** - Flexible path-based storage for notes, logs, and context
 - **Identity Files** - Maintain consistent personality and preferences across sessions
 
+## Mesh Cluster
+
+OptimClaw instances can form an **autonomous AI mesh network** where nodes discover each other automatically, coordinate via a gossip protocol, and route tasks intelligently across the cluster.
+
+Key highlights:
+
+- **Zero-config discovery** -- UDP beacon broadcast finds peers on the local network automatically
+- **Post-quantum encryption** -- ML-KEM-768 key exchange with AES-256-GCM authenticated encryption protects all inter-node traffic against both classical and quantum adversaries
+- **SWIM gossip membership** -- Reliable failure detection and cluster state convergence in O(log N) rounds
+- **Intelligent task routing** -- A scoring algorithm balances load, latency, capability match, session affinity, and region locality to pick the best node for each task
+- **Graceful degradation** -- Nodes operate independently if connectivity is lost; no split-brain data corruption
+
+Quick start (two nodes on one machine):
+
+```bash
+# Terminal 1
+export CLUSTER_ENABLED=true CLUSTER_SECRET="your-32-char-secret-here-change-me" CLUSTER_NODE_ID=node-a
+cargo run
+
+# Terminal 2
+export CLUSTER_ENABLED=true CLUSTER_SECRET="your-32-char-secret-here-change-me" CLUSTER_NODE_ID=node-b CLUSTER_BIND_PORT=9410
+cargo run
+```
+
+Monitor via `GET /api/mesh/status` and `GET /api/mesh/nodes`.
+
+See [docs/MESH_CLUSTER.md](docs/MESH_CLUSTER.md) for the full guide covering architecture, configuration reference, security model, and troubleshooting.
+
+## Lazy Tools
+
+Lazy tool loading reduces the system prompt from approximately 13,000 tokens to approximately 4,000 tokens by deferring tool schemas that are not immediately needed.
+
+Enable it with:
+
+```bash
+export OPTIMCLAW_LAZY_TOOLS=1
+```
+
+When enabled, 12 core tools (echo, time, json, http, web_fetch, file_read, file_write, shell, memory_search, memory_write, message, tool_info) are loaded eagerly. All other tools -- including MCP, WASM, and skill tools -- are listed by name only. The LLM calls `tool_info` to load the full schema for any additional tool on demand.
+
+This is recommended for production deployments and cost-sensitive usage with expensive models.
+
+See [docs/LAZY_TOOLS.md](docs/LAZY_TOOLS.md) for the full guide.
+
 ## Installation
 
 ### Prerequisites
@@ -86,12 +135,12 @@ IronClaw is the AI assistant you can actually trust with your personal and profe
 
 ## Download or Build
 
-Visit [Releases page](https://github.com/nearai/ironclaw/releases/) to see the latest updates.
+Visit [Releases page](https://github.com/nearai/optimclaw/releases/) to see the latest updates.
 
 <details>
   <summary>Install via Windows Installer (Windows)</summary>
 
-Download the [Windows Installer](https://github.com/nearai/ironclaw/releases/latest/download/ironclaw-x86_64-pc-windows-msvc.msi) and run it.
+Download the [Windows Installer](https://github.com/nearai/optimclaw/releases/latest/download/optimclaw-x86_64-pc-windows-msvc.msi) and run it.
 
 </details>
 
@@ -99,7 +148,7 @@ Download the [Windows Installer](https://github.com/nearai/ironclaw/releases/lat
   <summary>Install via powershell script (Windows)</summary>
 
 ```sh
-irm https://github.com/nearai/ironclaw/releases/latest/download/ironclaw-installer.ps1 | iex
+irm https://github.com/nearai/optimclaw/releases/latest/download/optimclaw-installer.ps1 | iex
 ```
 
 </details>
@@ -108,7 +157,7 @@ irm https://github.com/nearai/ironclaw/releases/latest/download/ironclaw-install
   <summary>Install via shell script (macOS, Linux, Windows/WSL)</summary>
 
 ```sh
-curl --proto '=https' --tlsv1.2 -LsSf https://github.com/nearai/ironclaw/releases/latest/download/ironclaw-installer.sh | sh
+curl --proto '=https' --tlsv1.2 -LsSf https://github.com/nearai/optimclaw/releases/latest/download/optimclaw-installer.sh | sh
 ```
 </details>
 
@@ -116,7 +165,7 @@ curl --proto '=https' --tlsv1.2 -LsSf https://github.com/nearai/ironclaw/release
   <summary>Install via Homebrew (macOS/Linux)</summary>
 
 ```sh
-brew install ironclaw
+brew install optimclaw
 ```
 
 </details>
@@ -128,8 +177,8 @@ Install it with `cargo`, just make sure you have [Rust](https://rustup.rs) insta
 
 ```bash
 # Clone the repository
-git clone https://github.com/nearai/ironclaw.git
-cd ironclaw
+git clone https://github.com/nearai/optimclaw.git
+cd optimclaw
 
 # Build
 cargo build --release
@@ -146,29 +195,29 @@ For **full release** (after modifying channel sources), run `./scripts/build-all
 
 ```bash
 # Create database
-createdb ironclaw
+createdb optimclaw
 
 # Enable pgvector
-psql ironclaw -c "CREATE EXTENSION IF NOT EXISTS vector;"
+psql optimclaw -c "CREATE EXTENSION IF NOT EXISTS vector;"
 ```
 
 ## Configuration
 
-Run the setup wizard to configure IronClaw:
+Run the setup wizard to configure OptimClaw:
 
 ```bash
-ironclaw onboard
+optimclaw onboard
 ```
 
 The wizard handles database connection, NEAR AI authentication (via browser OAuth),
 and secrets encryption (using your system keychain). Settings are persisted in the
 connected database; bootstrap variables (e.g. `DATABASE_URL`, `LLM_BACKEND`) are
-written to `~/.ironclaw/.env` so they are available before the database connects.
+written to `~/.optimclaw/.env` so they are available before the database connects.
 
 ### Alternative LLM Providers
 
-IronClaw defaults to NEAR AI but supports many LLM providers out of the box.
-Built-in providers include **Anthropic**, **OpenAI**, **Google Gemini**, **MiniMax**,
+OptimClaw defaults to NEAR AI but supports many LLM providers out of the box.
+Built-in providers include **Anthropic**, **OpenAI**, **GitHub Copilot**, **Google Gemini**, **MiniMax**,
 **Mistral**, and **Ollama** (local). OpenAI-compatible services like **OpenRouter**
 (300+ models), **Together AI**, **Fireworks AI**, and self-hosted servers (**vLLM**,
 **LiteLLM**) are also supported.
@@ -191,7 +240,7 @@ See [docs/LLM_PROVIDERS.md](docs/LLM_PROVIDERS.md) for a full provider guide.
 
 ## Security
 
-IronClaw implements defense in depth to protect your data and prevent misuse.
+OptimClaw implements defense in depth to protect your data and prevent misuse.
 
 ### WASM Sandbox
 
@@ -284,13 +333,13 @@ External content passes through multiple security layers:
 
 ```bash
 # First-time setup (configures database, auth, etc.)
-ironclaw onboard
+optimclaw onboard
 
 # Start interactive REPL
 cargo run
 
 # With debug logging
-RUST_LOG=ironclaw=debug cargo run
+RUST_LOG=optimclaw=debug cargo run
 ```
 
 ## Development
@@ -303,7 +352,7 @@ cargo fmt
 cargo clippy --all --benches --tests --examples --all-features
 
 # Run tests
-createdb ironclaw_test
+createdb optimclaw_test
 cargo test
 
 # Run specific test
@@ -315,7 +364,7 @@ cargo test test_name
 
 ## OpenClaw Heritage
 
-IronClaw is a Rust reimplementation inspired by [OpenClaw](https://github.com/openclaw/openclaw). See [FEATURE_PARITY.md](FEATURE_PARITY.md) for the complete tracking matrix.
+OptimClaw is a Rust reimplementation inspired by [OpenClaw](https://github.com/openclaw/openclaw). See [FEATURE_PARITY.md](FEATURE_PARITY.md) for the complete tracking matrix.
 
 Key differences:
 

README.ru.md

@@ -1,8 +1,8 @@
 <p align="center">
-  <img src="ironclaw.png?v=2" alt="IronClaw" width="200"/>
+  <img src="optimclaw.png?v=2" alt="OptimClaw" width="200"/>
 </p>
 
-<h1 align="center">IronClaw</h1>
+<h1 align="center">OptimClaw</h1>
 
 <p align="center">
   <strong>Ваш защищенный персональный AI-ассистент, всегда на вашей стороне</strong>
@@ -10,8 +10,8 @@
 
 <p align="center">
   <a href="#license"><img src="https://img.shields.io/badge/license-MIT%20OR%20Apache%202.0-blue.svg" alt="Лицензия: MIT OR Apache-2.0" /></a>
-  <a href="https://t.me/ironclawAI"><img src="https://img.shields.io/badge/Telegram-%40ironclawAI-26A5E4?style=flat&logo=telegram&logoColor=white" alt="Telegram: @ironclawAI" /></a>
-  <a href="https://www.reddit.com/r/ironclawAI/"><img src="https://img.shields.io/badge/Reddit-r%2FironclawAI-FF4500?style=flat&logo=reddit&logoColor=white" alt="Reddit: r/ironclawAI" /></a>
+  <a href="https://t.me/optimclawAI"><img src="https://img.shields.io/badge/Telegram-%40optimclawAI-26A5E4?style=flat&logo=telegram&logoColor=white" alt="Telegram: @optimclawAI" /></a>
+  <a href="https://www.reddit.com/r/optimclawAI/"><img src="https://img.shields.io/badge/Reddit-r%2FoptimclawAI-FF4500?style=flat&logo=reddit&logoColor=white" alt="Reddit: r/optimclawAI" /></a>
 </p>
 
 <p align="center">
@@ -34,16 +34,16 @@
 
 ## Философия
 
-IronClaw построен на простом принципе: **ваш AI-ассистент должен работать на вас, а не против вас**.
+OptimClaw построен на простом принципе: **ваш AI-ассистент должен работать на вас, а не против вас**.
 
-В мире, где системы ИИ становятся все более непрозрачными в вопросах обработки данных и ориентируются на корпоративные интересы, IronClaw выбирает другой путь:
+В мире, где системы ИИ становятся все более непрозрачными в вопросах обработки данных и ориентируются на корпоративные интересы, OptimClaw выбирает другой путь:
 
 - **Ваши данные остаются вашими** — вся информация хранится локально, зашифрована и никогда не покидает ваш контроль.
 - **Прозрачность по умолчанию** — открытый исходный код, возможность аудита, отсутствие скрытой телеметрии или сбора данных.
 - **Саморасширяемые возможности** — создавайте новые инструменты «на лету», не дожидаясь обновлений от вендора.
 - **Глубокая защита** — несколько уровней безопасности защищают от инъекций промптов и утечки данных.
 
-IronClaw — это AI-ассистент, которому вы действительно можете доверять в личной и профессиональной жизни.
+OptimClaw — это AI-ассистент, которому вы действительно можете доверять в личной и профессиональной жизни.
 
 ## Возможности
 
@@ -66,7 +66,7 @@ IronClaw — это AI-ассистент, которому вы действи
 
 ### Саморасширяемый
 
-- **Динамическое создание инструментов** — опишите, что вам нужно, и IronClaw создаст это как инструмент WASM.
+- **Динамическое создание инструментов** — опишите, что вам нужно, и OptimClaw создаст это как инструмент WASM.
 - **Протокол MCP** — подключайтесь к серверам Model Context Protocol для получения дополнительных возможностей.
 - **Плагинная архитектура** — добавляйте новые инструменты WASM и каналы без перезагрузки системы.
 
@@ -86,12 +86,12 @@ IronClaw — это AI-ассистент, которому вы действи
 
 ## Загрузка и сборка
 
-Посетите [страницу релизов](https://github.com/nearai/ironclaw/releases/), чтобы увидеть последние обновления.
+Посетите [страницу релизов](https://github.com/nearai/optimclaw/releases/), чтобы увидеть последние обновления.
 
 <details>
   <summary>Установка через установщик Windows (Windows)</summary>
 
-Загрузите [Windows Installer](https://github.com/nearai/ironclaw/releases/latest/download/ironclaw-x86_64-pc-windows-msvc.msi) и запустите его.
+Загрузите [Windows Installer](https://github.com/nearai/optimclaw/releases/latest/download/optimclaw-x86_64-pc-windows-msvc.msi) и запустите его.
 
 </details>
 
@@ -99,7 +99,7 @@ IronClaw — это AI-ассистент, которому вы действи
   <summary>Установка через powershell-скрипт (Windows)</summary>
 
 ```sh
-irm https://github.com/nearai/ironclaw/releases/latest/download/ironclaw-installer.ps1 | iex
+irm https://github.com/nearai/optimclaw/releases/latest/download/optimclaw-installer.ps1 | iex
 ```
 
 </details>
@@ -108,7 +108,7 @@ irm https://github.com/nearai/ironclaw/releases/latest/download/ironclaw-install
   <summary>Установка через shell-скрипт (macOS, Linux, Windows/WSL)</summary>
 
 ```sh
-curl --proto '=https' --tlsv1.2 -LsSf https://github.com/nearai/ironclaw/releases/latest/download/ironclaw-installer.sh | sh
+curl --proto '=https' --tlsv1.2 -LsSf https://github.com/nearai/optimclaw/releases/latest/download/optimclaw-installer.sh | sh
 ```
 </details>
 
@@ -116,7 +116,7 @@ curl --proto '=https' --tlsv1.2 -LsSf https://github.com/nearai/ironclaw/release
   <summary>Установка через Homebrew (macOS/Linux)</summary>
 
 ```sh
-brew install ironclaw
+brew install optimclaw
 ```
 
 </details>
@@ -128,8 +128,8 @@ brew install ironclaw
 
 ```bash
 # Клонируйте репозиторий
-git clone https://github.com/nearai/ironclaw.git
-cd ironclaw
+git clone https://github.com/nearai/optimclaw.git
+cd optimclaw
 
 # Сборка
 cargo build --release
@@ -146,25 +146,25 @@ cargo test
 
 ```bash
 # Создание базы данных
-createdb ironclaw
+createdb optimclaw
 
 # Включение pgvector
-psql ironclaw -c "CREATE EXTENSION IF NOT EXISTS vector;"
+psql optimclaw -c "CREATE EXTENSION IF NOT EXISTS vector;"
 ```
 
 ## Конфигурация
 
-Запустите мастер настройки для конфигурации IronClaw:
+Запустите мастер настройки для конфигурации OptimClaw:
 
 ```bash
-ironclaw onboard
+optimclaw onboard
 ```
 
-Мастер настройки поможет установить соединение с базой данных, пройти аутентификацию NEAR AI (через браузер OAuth) и настроить шифрование секретов (используя системную связку ключей). Настройки сохраняются в базе данных; базовые переменные (например, `DATABASE_URL`, `LLM_BACKEND`) записываются в `~/.ironclaw/.env`, чтобы они были доступны до подключения к БД.
+Мастер настройки поможет установить соединение с базой данных, пройти аутентификацию NEAR AI (через браузер OAuth) и настроить шифрование секретов (используя системную связку ключей). Настройки сохраняются в базе данных; базовые переменные (например, `DATABASE_URL`, `LLM_BACKEND`) записываются в `~/.optimclaw/.env`, чтобы они были доступны до подключения к БД.
 
 ### Альтернативные LLM-провайдеры
 
-IronClaw по умолчанию использует NEAR AI, но поддерживает множество LLM-провайдеров из коробки.
+OptimClaw по умолчанию использует NEAR AI, но поддерживает множество LLM-провайдеров из коробки.
 Встроенные провайдеры включают **Anthropic**, **OpenAI**, **Google Gemini**, **MiniMax**,
 **Mistral** и **Ollama** (локально). Также поддерживаются OpenAI-совместимые сервисы:
 **OpenRouter** (300+ моделей), **Together AI**, **Fireworks AI** и собственные серверы
@@ -188,7 +188,7 @@ LLM_MODEL=anthropic/claude-sonnet-4
 
 ## Безопасность
 
-IronClaw реализует эшелонированную защиту для обеспечения безопасности ваших данных и предотвращения злоупотреблений.
+OptimClaw реализует эшелонированную защиту для обеспечения безопасности ваших данных и предотвращения злоупотреблений.
 
 ### Песочница WASM
 
@@ -282,13 +282,13 @@ WASM ──► Валидатор ──► Сканер ───► Инъек
 
 ```bash
 # Первоначальная настройка (БД, аутентификация и т.д.)
-ironclaw onboard
+optimclaw onboard
 
 # Запуск интерактивного REPL
 cargo run
 
 # С отладочными логами
-RUST_LOG=ironclaw=debug cargo run
+RUST_LOG=optimclaw=debug cargo run
 ```
 
 ## Разработка
@@ -301,7 +301,7 @@ cargo fmt
 cargo clippy --all --benches --tests --examples --all-features
 
 # Запуск тестов
-createdb ironclaw_test
+createdb optimclaw_test
 cargo test
 
 # Запуск конкретного теста
@@ -313,7 +313,7 @@ cargo test название_теста
 
 ## Наследие OpenClaw
 
-IronClaw — это реализация на Rust, вдохновленная проектом [OpenClaw](https://github.com/openclaw/openclaw). Полную матрицу соответствия функций можно найти в [FEATURE_PARITY.md](FEATURE_PARITY.md).
+OptimClaw — это реализация на Rust, вдохновленная проектом [OpenClaw](https://github.com/openclaw/openclaw). Полную матрицу соответствия функций можно найти в [FEATURE_PARITY.md](FEATURE_PARITY.md).
 
 Ключевые отличия:
 

README.zh-CN.md

@@ -1,8 +1,8 @@
 <p align="center">
-  <img src="ironclaw.png?v=2" alt="IronClaw" width="200"/>
+  <img src="optimclaw.png?v=2" alt="OptimClaw" width="200"/>
 </p>
 
-<h1 align="center">IronClaw</h1>
+<h1 align="center">OptimClaw</h1>
 
 <p align="center">
   <strong>安全可靠的个人 AI 助手，始终站在你这边</strong>
@@ -10,8 +10,8 @@
 
 <p align="center">
   <a href="#license"><img src="https://img.shields.io/badge/license-MIT%20OR%20Apache%202.0-blue.svg" alt="License: MIT OR Apache-2.0" /></a>
-  <a href="https://t.me/ironclawAI"><img src="https://img.shields.io/badge/Telegram-%40ironclawAI-26A5E4?style=flat&logo=telegram&logoColor=white" alt="Telegram: @ironclawAI" /></a>
-  <a href="https://www.reddit.com/r/ironclawAI/"><img src="https://img.shields.io/badge/Reddit-r%2FironclawAI-FF4500?style=flat&logo=reddit&logoColor=white" alt="Reddit: r/ironclawAI" /></a>
+  <a href="https://t.me/optimclawAI"><img src="https://img.shields.io/badge/Telegram-%40optimclawAI-26A5E4?style=flat&logo=telegram&logoColor=white" alt="Telegram: @optimclawAI" /></a>
+  <a href="https://www.reddit.com/r/optimclawAI/"><img src="https://img.shields.io/badge/Reddit-r%2FoptimclawAI-FF4500?style=flat&logo=reddit&logoColor=white" alt="Reddit: r/optimclawAI" /></a>
 </p>
 
 <p align="center">
@@ -34,16 +34,16 @@
 
 ## 设计理念
 
-IronClaw 基于一个简单的原则：**你的 AI 助手应该为你服务，而不是与你为敌。**
+OptimClaw 基于一个简单的原则：**你的 AI 助手应该为你服务，而不是与你为敌。**
 
-在 AI 系统对数据处理日益不透明、与企业利益捆绑的今天，IronClaw 选择了一条不同的路：
+在 AI 系统对数据处理日益不透明、与企业利益捆绑的今天，OptimClaw 选择了一条不同的路：
 
 - **数据归你所有** — 所有信息存储在本地，加密保护，始终在你掌控之下
 - **透明至上** — 完全开源，可审计，没有隐藏的遥测或数据收集
 - **自主扩展** — 随时构建新工具，无需等待供应商更新
 - **纵深防御** — 多层安全机制抵御提示注入和数据泄露
 
-IronClaw 是一个你真正可以信赖的 AI 助手，无论是个人生活还是工作。
+OptimClaw 是一个你真正可以信赖的 AI 助手，无论是个人生活还是工作。
 
 ## 功能特性
 
@@ -66,7 +66,7 @@ IronClaw 是一个你真正可以信赖的 AI 助手，无论是个人生活还
 
 ### 自主扩展
 
-- **动态工具构建** — 描述你的需求，IronClaw 会将其构建为 WASM 工具
+- **动态工具构建** — 描述你的需求，OptimClaw 会将其构建为 WASM 工具
 - **MCP 协议** — 连接模型上下文协议（Model Context Protocol）服务器以获取额外能力
 - **插件架构** — 无需重启即可加载新的 WASM 工具和渠道
 
@@ -86,12 +86,12 @@ IronClaw 是一个你真正可以信赖的 AI 助手，无论是个人生活还
 
 ## 下载或编译
 
-访问 [Releases 页面](https://github.com/nearai/ironclaw/releases/) 查看最新版本。
+访问 [Releases 页面](https://github.com/nearai/optimclaw/releases/) 查看最新版本。
 
 <details>
   <summary>通过 Windows 安装程序安装 (Windows)</summary>
 
-下载 [Windows 安装程序](https://github.com/nearai/ironclaw/releases/latest/download/ironclaw-x86_64-pc-windows-msvc.msi) 并运行。
+下载 [Windows 安装程序](https://github.com/nearai/optimclaw/releases/latest/download/optimclaw-x86_64-pc-windows-msvc.msi) 并运行。
 
 </details>
 
@@ -99,7 +99,7 @@ IronClaw 是一个你真正可以信赖的 AI 助手，无论是个人生活还
   <summary>通过 PowerShell 脚本安装 (Windows)</summary>
 
 ```sh
-irm https://github.com/nearai/ironclaw/releases/latest/download/ironclaw-installer.ps1 | iex
+irm https://github.com/nearai/optimclaw/releases/latest/download/optimclaw-installer.ps1 | iex
 ```
 
 </details>
@@ -108,7 +108,7 @@ irm https://github.com/nearai/ironclaw/releases/latest/download/ironclaw-install
   <summary>通过 Shell 脚本安装 (macOS、Linux、Windows/WSL)</summary>
 
 ```sh
-curl --proto '=https' --tlsv1.2 -LsSf https://github.com/nearai/ironclaw/releases/latest/download/ironclaw-installer.sh | sh
+curl --proto '=https' --tlsv1.2 -LsSf https://github.com/nearai/optimclaw/releases/latest/download/optimclaw-installer.sh | sh
 ```
 </details>
 
@@ -116,7 +116,7 @@ curl --proto '=https' --tlsv1.2 -LsSf https://github.com/nearai/ironclaw/release
   <summary>通过 Homebrew 安装 (macOS/Linux)</summary>
 
 ```sh
-brew install ironclaw
+brew install optimclaw
 ```
 
 </details>
@@ -128,8 +128,8 @@ brew install ironclaw
 
 ```bash
 # 克隆仓库
-git clone https://github.com/nearai/ironclaw.git
-cd ironclaw
+git clone https://github.com/nearai/optimclaw.git
+cd optimclaw
 
 # 编译
 cargo build --release
@@ -146,26 +146,26 @@ cargo test
 
 ```bash
 # 创建数据库
-createdb ironclaw
+createdb optimclaw
 
 # 启用 pgvector 扩展
-psql ironclaw -c "CREATE EXTENSION IF NOT EXISTS vector;"
+psql optimclaw -c "CREATE EXTENSION IF NOT EXISTS vector;"
 ```
 
 ## 配置
 
-运行设置向导来配置 IronClaw：
+运行设置向导来配置 OptimClaw：
 
 ```bash
-ironclaw onboard
+optimclaw onboard
 ```
 
-向导将引导你完成数据库连接、NEAR AI 身份验证（通过浏览器 OAuth）和密钥加密（使用系统钥匙串）。设置会保存在数据库中；引导变量（如 `DATABASE_URL`、`LLM_BACKEND`）写入 `~/.ironclaw/.env`，以便在数据库连接前可用。
+向导将引导你完成数据库连接、NEAR AI 身份验证（通过浏览器 OAuth）和密钥加密（使用系统钥匙串）。设置会保存在数据库中；引导变量（如 `DATABASE_URL`、`LLM_BACKEND`）写入 `~/.optimclaw/.env`，以便在数据库连接前可用。
 
 ### 替代 LLM 提供商
 
-IronClaw 默认使用 NEAR AI，但开箱即用地支持多种 LLM 提供商。
-内置提供商包括 **Anthropic**、**OpenAI**、**Google Gemini**、**MiniMax**、**Mistral** 和 **Ollama**（本地部署）。同时也支持 OpenAI 兼容服务，如 **OpenRouter**（300+ 模型）、**Together AI**、**Fireworks AI** 以及自托管服务器（**vLLM**、**LiteLLM**）。
+OptimClaw 默认使用 NEAR AI，但开箱即用地支持多种 LLM 提供商。
+内置提供商包括 **Anthropic**、**OpenAI**、**GitHub Copilot**、**Google Gemini**、**MiniMax**、**Mistral** 和 **Ollama**（本地部署）。同时也支持 OpenAI 兼容服务，如 **OpenRouter**（300+ 模型）、**Together AI**、**Fireworks AI** 以及自托管服务器（**vLLM**、**LiteLLM**）。
 
 在向导中选择你的提供商，或直接设置环境变量：
 
@@ -185,7 +185,7 @@ LLM_MODEL=anthropic/claude-sonnet-4
 
 ## 安全机制
 
-IronClaw 实现了纵深防御策略来保护你的数据并防止滥用。
+OptimClaw 实现了纵深防御策略来保护你的数据并防止滥用。
 
 ### WASM 沙箱
 
@@ -278,13 +278,13 @@ WASM ──► 白名单  ──► 泄露扫描 ──► 凭据  ──► 执
 
 ```bash
 # 首次设置（配置数据库、认证等）
-ironclaw onboard
+optimclaw onboard
 
 # 启动交互式 REPL
 cargo run
 
 # 启用调试日志
-RUST_LOG=ironclaw=debug cargo run
+RUST_LOG=optimclaw=debug cargo run
 ```
 
 ## 开发
@@ -297,7 +297,7 @@ cargo fmt
 cargo clippy --all --benches --tests --examples --all-features
 
 # 运行测试
-createdb ironclaw_test
+createdb optimclaw_test
 cargo test
 
 # 运行指定测试
@@ -309,7 +309,7 @@ cargo test test_name
 
 ## OpenClaw 传承
 
-IronClaw 是受 [OpenClaw](https://github.com/openclaw/openclaw) 启发的 Rust 重新实现。参见 [FEATURE_PARITY.md](FEATURE_PARITY.md) 了解完整的功能追踪矩阵。
+OptimClaw 是受 [OpenClaw](https://github.com/openclaw/openclaw) 启发的 Rust 重新实现。参见 [FEATURE_PARITY.md](FEATURE_PARITY.md) 了解完整的功能追踪矩阵。
 
 主要差异：
 

benches/safety_check.rs

@@ -1,5 +1,5 @@
 use criterion::{Criterion, black_box, criterion_group, criterion_main};
-use ironclaw::safety::{LeakDetector, Sanitizer, Validator};
+use optimclaw::safety::{LeakDetector, Sanitizer, Validator};
 
 fn bench_sanitizer(c: &mut Criterion) {
     let mut group = c.benchmark_group("sanitizer");

benches/safety_pipeline.rs

@@ -1,6 +1,6 @@
 use criterion::{Criterion, black_box, criterion_group, criterion_main};
-use ironclaw::config::SafetyConfig;
-use ironclaw::safety::{SafetyLayer, Validator};
+use optimclaw::config::SafetyConfig;
+use optimclaw::safety::{SafetyLayer, Validator};
 
 fn bench_safety_layer_pipeline(c: &mut Criterion) {
     let mut group = c.benchmark_group("safety_pipeline");
@@ -40,7 +40,7 @@ fn bench_safety_layer_pipeline(c: &mut Criterion) {
 
     // Benchmark wrap_for_llm (structural boundary wrapping)
     group.bench_function("wrap_for_llm", |b| {
-        b.iter(|| layer.wrap_for_llm(black_box("shell"), black_box(clean_tool_output), false))
+        b.iter(|| layer.wrap_for_llm(black_box("shell"), black_box(clean_tool_output)))
     });
 
     // Benchmark inbound secret scanning

channels-src/discord/Cargo.lock

@@ -20,162 +20,33 @@ version = "1.0.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
 
-[[package]]
-name = "base64ct"
-version = "1.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
-
 [[package]]
 name = "bitflags"
 version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "843867be96c8daad0d758b57df9392b6d8d271134fce549de6ce169ff98a92af"
 
-[[package]]
-name = "block-buffer"
-version = "0.10.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
-dependencies = [
- "generic-array",
-]
-
 [[package]]
 name = "cfg-if"
 version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
-[[package]]
-name = "const-oid"
-version = "0.9.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
-
-[[package]]
-name = "cpufeatures"
-version = "0.2.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "crypto-common"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
-dependencies = [
- "generic-array",
- "typenum",
-]
-
-[[package]]
-name = "curve25519-dalek"
-version = "4.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
-dependencies = [
- "cfg-if",
- "cpufeatures",
- "curve25519-dalek-derive",
- "digest",
- "fiat-crypto",
- "rustc_version",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "curve25519-dalek-derive"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "der"
-version = "0.7.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
-dependencies = [
- "const-oid",
- "zeroize",
-]
-
-[[package]]
-name = "digest"
-version = "0.10.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
-dependencies = [
- "block-buffer",
- "crypto-common",
-]
-
 [[package]]
 name = "discord-channel"
-version = "0.2.0"
+version = "0.2.1"
 dependencies = [
- "ed25519-dalek",
- "hex",
  "serde",
  "serde_json",
  "wit-bindgen",
 ]
 
-[[package]]
-name = "ed25519"
-version = "2.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
-dependencies = [
- "pkcs8",
- "signature",
-]
-
-[[package]]
-name = "ed25519-dalek"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9"
-dependencies = [
- "curve25519-dalek",
- "ed25519",
- "serde",
- "sha2",
- "subtle",
- "zeroize",
-]
-
 [[package]]
 name = "equivalent"
 version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 
-[[package]]
-name = "fiat-crypto"
-version = "0.2.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
-
-[[package]]
-name = "generic-array"
-version = "0.14.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
-dependencies = [
- "typenum",
- "version_check",
-]
-
 [[package]]
 name = "hashbrown"
 version = "0.14.5"
@@ -197,12 +68,6 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
-[[package]]
-name = "hex"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
-
 [[package]]
 name = "id-arena"
 version = "2.3.0"
@@ -223,9 +88,9 @@ dependencies = [
 
 [[package]]
 name = "itoa"
-version = "1.0.17"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92ecc6618181def0457392ccd0ee51198e065e016d1d527a7ac1b6dc7c1f09d2"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
 [[package]]
 name = "leb128"
@@ -233,12 +98,6 @@ version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "884e2677b40cc8c339eaefcb701c32ef1fd2493d71118dc0ca4b6a736c93bd67"
 
-[[package]]
-name = "libc"
-version = "0.2.182"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6800badb6cb2082ffd7b6a67e6125bb39f18782f793520caee8cb8846be06112"
-
 [[package]]
 name = "log"
 version = "0.4.29"
@@ -253,19 +112,9 @@ checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
 
 [[package]]
 name = "once_cell"
-version = "1.21.3"
+version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
-
-[[package]]
-name = "pkcs8"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
-dependencies = [
- "der",
- "spki",
-]
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 
 [[package]]
 name = "prettyplease"
@@ -288,22 +137,13 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.44"
+version = "1.0.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21b2ebcf727b7760c461f091f9f0f539b77b8e87f2fd88131e7f1b433b3cece4"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
 dependencies = [
  "proc-macro2",
 ]
 
-[[package]]
-name = "rustc_version"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
-dependencies = [
- "semver",
-]
-
 [[package]]
 name = "semver"
 version = "1.0.27"
@@ -353,23 +193,6 @@ dependencies = [
  "zmij",
 ]
 
-[[package]]
-name = "sha2"
-version = "0.10.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
-dependencies = [
- "cfg-if",
- "cpufeatures",
- "digest",
-]
-
-[[package]]
-name = "signature"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
-
 [[package]]
 name = "smallvec"
 version = "1.15.1"
@@ -385,22 +208,6 @@ dependencies = [
  "smallvec",
 ]
 
-[[package]]
-name = "spki"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
-dependencies = [
- "base64ct",
- "der",
-]
-
-[[package]]
-name = "subtle"
-version = "2.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
-
 [[package]]
 name = "syn"
 version = "2.0.117"
@@ -412,12 +219,6 @@ dependencies = [
  "unicode-ident",
 ]
 
-[[package]]
-name = "typenum"
-version = "1.19.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb"
-
 [[package]]
 name = "unicode-ident"
 version = "1.0.24"
@@ -575,30 +376,24 @@ dependencies = [
 
 [[package]]
 name = "zerocopy"
-version = "0.8.39"
+version = "0.8.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db6d35d663eadb6c932438e763b262fe1a70987f9ae936e60158176d710cae4a"
+checksum = "efbb2a062be311f2ba113ce66f697a4dc589f85e78a4aea276200804cea0ed87"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.39"
+version = "0.8.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4122cd3169e94605190e77839c9a40d40ed048d305bfdc146e7df40ab0f3e517"
+checksum = "0e8bc7269b54418e7aeeef514aa68f8690b8c0489a06b0136e5f57c4c5ccab89"
 dependencies = [
  "proc-macro2",
  "quote",
  "syn",
 ]
 
-[[package]]
-name = "zeroize"
-version = "1.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
-
 [[package]]
 name = "zmij"
 version = "1.0.21"

channels-src/discord/Cargo.toml

@@ -1,8 +1,8 @@
 [package]
 name = "discord-channel"
-version = "0.2.0"
+version = "0.2.1"
 edition = "2021"
-description = "Discord channel for IronClaw"
+description = "Discord channel for OptimClaw"
 license = "MIT OR Apache-2.0"
 publish = false
 
@@ -10,8 +10,6 @@ publish = false
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 wit-bindgen = "0.36"
-ed25519-dalek = { version = "2", default-features = false, features = ["alloc", "fast", "zeroize"] }
-hex = "0.4"
 
 [lib]
 crate-type = ["cdylib"]

channels-src/discord/README.md

@@ -1,4 +1,4 @@
-# Discord Channel for IronClaw
+# Discord Channel for OptimClaw
 
 WASM channel for Discord integration - handle slash commands and button interactions via webhooks.
 
@@ -13,12 +13,12 @@ WASM channel for Discord integration - handle slash commands and button interact
 
 1. Create a Discord Application at <https://discord.com/developers/applications>
 2. Create a Bot and get the token
-3. Set up Interactions URL to point to your IronClaw instance
+3. Set up Interactions URL to point to your OptimClaw instance
 4. Copy the Application ID and Public Key
-5. Store in IronClaw secrets:
+5. Store in OptimClaw secrets:
 
    ```bash
-   ironclaw secret set discord_bot_token YOUR_BOT_TOKEN
+   optimclaw secret set discord_bot_token YOUR_BOT_TOKEN
    ```
 
    **Note:** The `discord_bot_token` secret is used for Discord REST API calls.
@@ -51,7 +51,7 @@ curl -X POST \
 
 In your Discord app settings, set:
 
-- Interactions Endpoint URL: `https://your-ironclaw.com/webhook/discord`
+- Interactions Endpoint URL: `https://your-optimclaw.com/webhook/discord`
 
 ## Usage Examples
 
@@ -86,6 +86,24 @@ If an internal error occurs (e.g., metadata serialization failure), the tool att
 Check the host logs for detailed error information.
 
 ## Advanced Usage
+### Gateway Mode
+
+The Discord channel now defaults to Discord Gateway transport for inbound message intake.
+The bundled identify payload requests intents `4609`, which expands to:
+
+- `GUILDS` (`1`)
+- `GUILD_MESSAGES` (`512`)
+- `DIRECT_MESSAGES` (`4096`)
+
+Gateway DMs now follow the same pairing policy as webhook DMs. Unpaired users receive a pairing
+instruction reply in the DM channel before the message is allowed through to the agent. If you
+want stricter access control than pairing, set `owner_id`; that lock still applies to both
+webhook and Gateway traffic.
+
+Gateway presence simply reflects a successful authenticated Gateway connection and advertises
+`online`. Pairing still controls whether DMs are allowed through to the agent, but it no longer
+changes the visible Discord status.
+
 ### Mention Polling
 
 The Discord channel can also poll configured channels for `@bot` mentions.
@@ -110,6 +128,7 @@ Example channel config:
 - `owner_id`: when set, only that Discord user can interact with the bot.
 - `dm_policy`: `open` allows all DMs; `pairing` requires approval.
 - `allow_from`: allowlist entries for DM pairing checks (`*`, user id, or username).
+- Gateway DMs respect `dm_policy` and pairing just like webhook DMs.
 
 ### Embeds
 
@@ -127,7 +146,7 @@ To send embeds, include an `embeds` array in the `metadata_json` field of the ag
 
 ### "401 Unauthorized"
 
-- Check that `discord_bot_token` is set correctly in IronClaw secrets.
+- Check that `discord_bot_token` is set correctly in OptimClaw secrets.
 - Ensure the bot is added to the server.
 
 ### "Interaction Failed"

channels-src/discord/discord.capabilities.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.2.0",
+  "version": "0.2.1",
   "wit_version": "0.3.0",
   "type": "channel",
   "name": "discord",
@@ -22,7 +22,8 @@
   "capabilities": {
     "http": {
       "allowlist": [
-        { "host": "discord.com", "path_prefix": "/api/v10" }
+        { "host": "discord.com", "path_prefix": "/api/v10" },
+        { "host": "gateway.discord.gg", "path_prefix": "/", "methods": ["GET"] }
       ],
       "credentials": {
         "discord_bot_token": {
@@ -36,6 +37,20 @@
         "requests_per_hour": 3600
       }
     },
+    "websocket": {
+      "url": "wss://gateway.discord.gg/?v=10&encoding=json",
+      "connect_on_start": true,
+      "identify_secret_name": "discord_bot_token",
+      "identify": {
+        "_intents_doc": "GUILDS(1) + GUILD_MESSAGES(512) + DIRECT_MESSAGES(4096)",
+        "intents": 4609,
+        "properties": {
+          "os": "linux",
+          "browser": "ironclaw",
+          "device": "ironclaw"
+        }
+      }
+    },
     "secrets": {
       "allowed_names": ["discord_bot_token", "discord_*"]
     },

channels-src/feishu/Cargo.lock

@@ -44,6 +44,7 @@ version = "0.1.0"
 dependencies = [
  "serde",
  "serde_json",
+ "subtle",
  "wit-bindgen",
 ]
 
@@ -208,6 +209,12 @@ dependencies = [
  "smallvec",
 ]
 
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
 [[package]]
 name = "syn"
 version = "2.0.117"

channels-src/feishu/Cargo.toml

@@ -2,7 +2,7 @@
 name = "feishu-channel"
 version = "0.1.0"
 edition = "2021"
-description = "Feishu/Lark Bot channel for IronClaw"
+description = "Feishu/Lark Bot channel for OptimClaw"
 license = "MIT OR Apache-2.0"
 
 [lib]
@@ -15,6 +15,7 @@ wit-bindgen = "0.36"
 # Serialization
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
+subtle = "2.6"
 
 # Exclude from parent workspace (this is a standalone WASM component)
 

channels-src/feishu/feishu.capabilities.json

@@ -3,11 +3,11 @@
   "wit_version": "0.3.0",
   "type": "channel",
   "name": "feishu",
-  "description": "Feishu/Lark Bot channel for receiving and responding to Feishu messages",
+  "description": "Feishu/Lark Bot channel for receiving and responding to Feishu messages via Event Subscription webhooks",
   "auth": {
     "secret_name": "feishu_app_id",
     "display_name": "Feishu / Lark",
-    "instructions": "Create a bot at https://open.feishu.cn/app (Feishu) or https://open.larksuite.com/app (Lark). You need the App ID and App Secret.",
+    "instructions": "Create a bot at https://open.feishu.cn/app (Feishu) or https://open.larksuite.com/app (Lark). You need the App ID and App Secret. Note: OptimClaw supports Event Subscription webhook delivery, but not Feishu's long-connection websocket mode.",
     "setup_url": "https://open.feishu.cn/app",
     "token_hint": "App ID looks like cli_XXXX, App Secret is a long alphanumeric string",
     "env_var": "FEISHU_APP_ID"
@@ -16,18 +16,18 @@
     "required_secrets": [
       {
         "name": "feishu_app_id",
-        "prompt": "Enter your Feishu/Lark App ID (from https://open.feishu.cn/app)",
+        "prompt": "Enter your Feishu/Lark App ID (from https://open.feishu.cn/app). Use webhook-based Event Subscription, not long-connection websocket mode.",
         "optional": false
       },
       {
         "name": "feishu_app_secret",
-        "prompt": "Enter your Feishu/Lark App Secret",
+        "prompt": "Enter your Feishu/Lark App Secret (from your app settings at open.feishu.cn)",
         "optional": false
       },
       {
         "name": "feishu_verification_token",
-        "prompt": "Enter your Feishu/Lark Verification Token (from Event Subscription settings)",
-        "optional": true
+        "prompt": "Enter your Feishu/Lark Verification Token (from Event Subscription webhook settings)",
+        "optional": false
       }
     ],
     "setup_url": "https://open.feishu.cn/app"
@@ -63,13 +63,15 @@
       },
       "webhook": {
         "secret_header": "X-Feishu-Verification-Token",
-        "secret_name": "feishu_verification_token"
+        "secret_name": "feishu_verification_token",
+        "managed_by_host": false
       }
     }
   },
   "config": {
     "app_id": null,
     "app_secret": null,
+    "verification_token": null,
     "api_base": "https://open.feishu.cn",
     "owner_id": null,
     "dm_policy": "pairing",

channels-src/feishu/src/lib.rs

@@ -1,11 +1,13 @@
 // Feishu API types have fields reserved for future use.
 #![allow(dead_code)]
 
-//! Feishu/Lark Bot channel for IronClaw.
+//! Feishu/Lark Bot channel for OptimClaw.
 //!
 //! This WASM component implements the channel interface for handling Feishu
 //! webhooks (Event Subscription v2.0) and sending messages back via the
-//! Feishu/Lark Bot API.
+//! Feishu/Lark Bot API. OptimClaw currently does not connect to Feishu's
+//! long-connection websocket subscription mode; use Event Subscription
+//! webhooks for this channel.
 //!
 //! # Features
 //!
@@ -21,7 +23,8 @@
 //! - App credentials (app_id, app_secret) are injected by the host into
 //!   the config JSON during startup for token exchange
 //! - Bearer token for API calls is obtained via token exchange and cached
-//! - Verification token validated by host for webhook requests
+//! - Webhook requests must be authenticated by the host or by a matching
+//!   Feishu verification token in the request body
 
 // Generate bindings from the WIT file
 wit_bindgen::generate!({
@@ -30,6 +33,7 @@ wit_bindgen::generate!({
 });
 
 use serde::{Deserialize, Serialize};
+use subtle::ConstantTimeEq;
 
 // Re-export generated types
 use exports::near::agent::channel::{
@@ -48,6 +52,7 @@ const ALLOW_FROM_PATH: &str = "allow_from";
 const API_BASE_PATH: &str = "api_base";
 const APP_ID_PATH: &str = "app_id";
 const APP_SECRET_PATH: &str = "app_secret";
+const VERIFICATION_TOKEN_PATH: &str = "verification_token";
 const TOKEN_PATH: &str = "tenant_access_token";
 const TOKEN_EXPIRY_PATH: &str = "token_expiry";
 
@@ -100,6 +105,10 @@ struct FeishuEventHeader {
     /// Tenant key.
     #[serde(default)]
     tenant_key: Option<String>,
+
+    /// Verification token for v2 event payloads.
+    #[serde(default)]
+    token: Option<String>,
 }
 
 /// Message receive event payload (im.message.receive_v1).
@@ -206,9 +215,17 @@ struct FeishuApiResponse<T> {
     data: Option<T>,
 }
 
-/// Tenant access token response.
-#[derive(Debug, Default, Deserialize)]
-struct TenantAccessTokenData {
+/// Tenant access token response (flat format).
+///
+/// Unlike most Feishu APIs that nest results under `data`, the
+/// `/auth/v3/tenant_access_token/internal` endpoint returns `code`, `msg`,
+/// `tenant_access_token`, and `expire` at the top level.
+#[derive(Debug, Deserialize)]
+struct TenantAccessTokenResponse {
+    #[serde(default)]
+    code: i32,
+    #[serde(default)]
+    msg: String,
     tenant_access_token: String,
     expire: i64,
 }
@@ -241,6 +258,9 @@ struct FeishuConfig {
     /// Feishu App Secret (for token exchange).
     app_secret: Option<String>,
 
+    /// Feishu Event Subscription verification token.
+    verification_token: Option<String>,
+
     /// API base URL. Defaults to "https://open.feishu.cn" (use
     /// "https://open.larksuite.com" for Lark international).
     #[serde(default = "default_api_base")]
@@ -290,6 +310,9 @@ impl Guest for FeishuChannel {
         if let Some(ref app_secret) = config.app_secret {
             let _ = channel_host::workspace_write(APP_SECRET_PATH, app_secret);
         }
+        if let Some(ref verification_token) = config.verification_token {
+            let _ = channel_host::workspace_write(VERIFICATION_TOKEN_PATH, verification_token);
+        }
 
         if let Some(owner_id) = &config.owner_id {
             let _ = channel_host::workspace_write(OWNER_ID_PATH, owner_id);
@@ -366,6 +389,23 @@ impl Guest for FeishuChannel {
             }
         };
 
+        let configured_token =
+            channel_host::workspace_read(VERIFICATION_TOKEN_PATH).filter(|token| !token.is_empty());
+        if !is_authenticated_webhook(
+            req.secret_validated,
+            configured_token.as_deref(),
+            request_verification_token(&event),
+        ) {
+            channel_host::log(
+                channel_host::LogLevel::Warn,
+                "Rejecting unauthenticated Feishu webhook request",
+            );
+            return json_response(
+                401,
+                serde_json::json!({"error": "Webhook authentication failed"}),
+            );
+        }
+
         // Handle URL verification challenge (initial webhook setup).
         if event.event_type.as_deref() == Some("url_verification") {
             if let Some(challenge) = &event.challenge {
@@ -770,9 +810,8 @@ fn obtain_tenant_token(api_base: &str) -> Result<String, String> {
                 ));
             }
 
-            let token_resp: FeishuApiResponse<TenantAccessTokenData> =
-                serde_json::from_slice(&response.body)
-                    .map_err(|e| format!("Failed to parse token response: {}", e))?;
+            let token_resp: TenantAccessTokenResponse = serde_json::from_slice(&response.body)
+                .map_err(|e| format!("Failed to parse token response: {}", e))?;
 
             if token_resp.code != 0 {
                 return Err(format!(
@@ -781,23 +820,33 @@ fn obtain_tenant_token(api_base: &str) -> Result<String, String> {
                 ));
             }
 
-            let data = token_resp
-                .data
-                .ok_or_else(|| "Token response missing data".to_string())?;
+            if token_resp.tenant_access_token.is_empty() {
+                return Err("Token response missing tenant_access_token".to_string());
+            }
+
+            if token_resp.expire <= 0 {
+                return Err(format!(
+                    "Token response has invalid expire value: {}",
+                    token_resp.expire
+                ));
+            }
 
             // Cache the token with expiry.
             let now = channel_host::now_millis();
-            let expiry = now + (data.expire as u64) * 1000;
+            let expiry = now.saturating_add((token_resp.expire as u64).saturating_mul(1000));
 
-            let _ = channel_host::workspace_write(TOKEN_PATH, &data.tenant_access_token);
+            let _ = channel_host::workspace_write(TOKEN_PATH, &token_resp.tenant_access_token);
             let _ = channel_host::workspace_write(TOKEN_EXPIRY_PATH, &expiry.to_string());
 
             channel_host::log(
                 channel_host::LogLevel::Debug,
-                &format!("Tenant access token refreshed, expires in {}s", data.expire),
+                &format!(
+                    "Tenant access token refreshed, expires in {}s",
+                    token_resp.expire
+                ),
             );
 
-            Ok(data.tenant_access_token)
+            Ok(token_resp.tenant_access_token)
         }
         Err(e) => Err(format!("Token exchange request failed: {}", e)),
     }
@@ -819,3 +868,148 @@ fn json_response(status: u16, body: serde_json::Value) -> OutgoingHttpResponse {
         body: body_bytes,
     }
 }
+
+fn is_authenticated_webhook(
+    secret_validated: bool,
+    configured_token: Option<&str>,
+    request_token: Option<&str>,
+) -> bool {
+    if secret_validated {
+        return true;
+    }
+
+    match (configured_token, request_token) {
+        (Some(expected), Some(provided)) => {
+            bool::from(expected.as_bytes().ct_eq(provided.as_bytes()))
+        }
+        _ => false,
+    }
+}
+
+fn request_verification_token(event: &FeishuEvent) -> Option<&str> {
+    event
+        .header
+        .as_ref()
+        .and_then(|header| header.token.as_deref())
+        .or(event.token.as_deref())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn parse_flat_token_response() {
+        let json = r#"{
+            "code": 0,
+            "msg": "ok",
+            "tenant_access_token": "t-abc123",
+            "expire": 7200
+        }"#;
+        let resp: TenantAccessTokenResponse = serde_json::from_str(json).unwrap();
+        assert_eq!(resp.code, 0);
+        assert_eq!(resp.msg, "ok");
+        assert_eq!(resp.tenant_access_token, "t-abc123");
+        assert_eq!(resp.expire, 7200);
+    }
+
+    #[test]
+    fn parse_token_response_rejects_missing_token() {
+        let json = r#"{"code": 0, "msg": "ok", "expire": 7200}"#;
+        let result: Result<TenantAccessTokenResponse, _> = serde_json::from_str(json);
+        assert!(
+            result.is_err(),
+            "should fail when tenant_access_token is missing"
+        );
+    }
+
+    #[test]
+    fn parse_token_response_rejects_missing_expire() {
+        let json = r#"{"code": 0, "msg": "ok", "tenant_access_token": "t-abc"}"#;
+        let result: Result<TenantAccessTokenResponse, _> = serde_json::from_str(json);
+        assert!(result.is_err(), "should fail when expire is missing");
+    }
+
+    #[test]
+    fn parse_token_response_defaults_code_and_msg() {
+        let json = r#"{"tenant_access_token": "t-abc", "expire": 3600}"#;
+        let resp: TenantAccessTokenResponse = serde_json::from_str(json).unwrap();
+        assert_eq!(resp.code, 0);
+        assert_eq!(resp.msg, "");
+        assert_eq!(resp.tenant_access_token, "t-abc");
+        assert_eq!(resp.expire, 3600);
+    }
+
+    #[test]
+    fn parse_token_error_response() {
+        let json = r#"{
+            "code": 10003,
+            "msg": "invalid app_id",
+            "tenant_access_token": "",
+            "expire": 0
+        }"#;
+        let resp: TenantAccessTokenResponse = serde_json::from_str(json).unwrap();
+        assert_eq!(resp.code, 10003);
+        assert!(resp.tenant_access_token.is_empty());
+    }
+
+    #[test]
+    fn webhook_auth_requires_host_auth_or_matching_verification_token() {
+        assert!(
+            !is_authenticated_webhook(false, None, Some("token")),
+            "requests without any configured verification mechanism must be rejected"
+        );
+        assert!(
+            !is_authenticated_webhook(false, Some("expected"), None),
+            "requests missing the Feishu token must be rejected when host auth did not pass"
+        );
+        assert!(
+            !is_authenticated_webhook(false, Some("expected"), Some("wrong")),
+            "requests with the wrong Feishu token must be rejected"
+        );
+        assert!(
+            is_authenticated_webhook(false, Some("expected"), Some("expected")),
+            "matching Feishu verification token should authenticate the request"
+        );
+        assert!(
+            is_authenticated_webhook(true, None, None),
+            "host-authenticated requests should still be accepted"
+        );
+        assert!(
+            is_authenticated_webhook(true, Some("expected"), Some("wrong")),
+            "host authentication should take precedence over body token checks"
+        );
+    }
+
+    #[test]
+    fn request_verification_token_prefers_v2_header_token() {
+        let event: FeishuEvent = serde_json::from_str(
+            r#"{
+                "schema": "2.0",
+                "header": {
+                    "event_id": "evt_123",
+                    "event_type": "im.message.receive_v1",
+                    "token": "header-token"
+                },
+                "event": {}
+            }"#,
+        )
+        .unwrap();
+
+        assert_eq!(request_verification_token(&event), Some("header-token"));
+    }
+
+    #[test]
+    fn request_verification_token_falls_back_to_top_level_token() {
+        let event: FeishuEvent = serde_json::from_str(
+            r#"{
+                "type": "url_verification",
+                "challenge": "abc",
+                "token": "top-level-token"
+            }"#,
+        )
+        .unwrap();
+
+        assert_eq!(request_verification_token(&event), Some("top-level-token"));
+    }
+}

channels-src/slack/Cargo.toml

@@ -2,7 +2,7 @@
 name = "slack-channel"
 version = "0.2.1"
 edition = "2021"
-description = "Slack Events API channel for IronClaw"
+description = "Slack Events API channel for OptimClaw"
 license = "MIT OR Apache-2.0"
 
 [lib]

channels-src/slack/src/lib.rs

@@ -1,4 +1,4 @@
-//! Slack Events API channel for IronClaw.
+//! Slack Events API channel for OptimClaw.
 //!
 //! This WASM component implements the channel interface for handling Slack
 //! webhooks and sending messages back to Slack.
@@ -650,7 +650,7 @@ fn send_pairing_reply(channel_id: &str, code: &str) -> Result<(), String> {
     let payload = serde_json::json!({
         "channel": channel_id,
         "text": format!(
-            "To pair with this bot, run: `ironclaw pairing approve slack {}`",
+            "To pair with this bot, run: `optimclaw pairing approve slack {}`",
             code
         ),
     });

channels-src/telegram/Cargo.toml

@@ -2,7 +2,7 @@
 name = "telegram-channel"
 version = "0.2.1"
 edition = "2021"
-description = "Telegram Bot API channel for IronClaw"
+description = "Telegram Bot API channel for OptimClaw"
 license = "MIT OR Apache-2.0"
 
 [lib]

channels-src/telegram/src/lib.rs

@@ -1,7 +1,7 @@
 // Telegram API types have fields reserved for future use (entities, reply threading, etc.)
 #![allow(dead_code)]
 
-//! Telegram Bot API channel for IronClaw.
+//! Telegram Bot API channel for OptimClaw.
 //!
 //! This WASM component implements the channel interface for handling Telegram
 //! webhooks and sending messages back via the Bot API.
@@ -1170,7 +1170,7 @@ fn send_photo(
         );
     }
 
-    let boundary = format!("ironclaw-{}", channel_host::now_millis());
+    let boundary = format!("optimclaw-{}", channel_host::now_millis());
     let mut body = Vec::new();
 
     write_multipart_field(&mut body, &boundary, "chat_id", &chat_id.to_string());
@@ -1235,7 +1235,7 @@ fn send_document(
 ) -> Result<(), String> {
     let message_thread_id = normalize_thread_id(message_thread_id);
 
-    let boundary = format!("ironclaw-{}", channel_host::now_millis());
+    let boundary = format!("optimclaw-{}", channel_host::now_millis());
     let mut body = Vec::new();
 
     write_multipart_field(&mut body, &boundary, "chat_id", &chat_id.to_string());
@@ -1552,7 +1552,7 @@ fn send_pairing_reply(chat_id: i64, code: &str) -> Result<(), String> {
     send_message(
         chat_id,
         &format!(
-            "To pair with this bot, run: `ironclaw pairing approve telegram {}`",
+            "To pair with this bot, run: `optimclaw pairing approve telegram {}`",
             code
         ),
         None,

channels-src/whatsapp/Cargo.toml

@@ -2,7 +2,7 @@
 name = "whatsapp-channel"
 version = "0.2.0"
 edition = "2021"
-description = "WhatsApp Cloud API channel for IronClaw"
+description = "WhatsApp Cloud API channel for OptimClaw"
 
 [lib]
 crate-type = ["cdylib"]

channels-src/whatsapp/src/lib.rs

@@ -1,7 +1,7 @@
 // WhatsApp API types have fields reserved for future use (contacts, statuses, etc.)
 #![allow(dead_code)]
 
-//! WhatsApp Cloud API channel for IronClaw.
+//! WhatsApp Cloud API channel for OptimClaw.
 //!
 //! This WASM component implements the channel interface for handling WhatsApp
 //! webhooks and sending messages back via the Cloud API.
@@ -910,7 +910,7 @@ fn send_pairing_reply(
         "text": {
             "preview_url": false,
             "body": format!(
-                "To pair with this bot, run: ironclaw pairing approve whatsapp {}",
+                "To pair with this bot, run: optimclaw pairing approve whatsapp {}",
                 code
             )
         }

clippy.toml

@@ -1,6 +1,6 @@
 # Complexity guardrails for AI-assisted development quality.
 # These thresholds prevent new violations while preserving existing code.
-# See: https://github.com/nearai/ironclaw/issues/338
+# See: https://github.com/nearai/optimclaw/issues/338
 
 cognitive-complexity-threshold = 15  # default: 25 (only active when lint is enabled)
 too-many-lines-threshold = 100      # default: 100 (only active when lint is enabled)

crates/optimclaw_common/Cargo.toml

@@ -0,0 +1,17 @@
+[package]
+name = "optimclaw_common"
+version = "0.1.0"
+edition = "2024"
+rust-version = "1.92"
+description = "Shared types and utilities for the OptimClaw workspace"
+authors = ["NEAR AI <[email protected]>"]
+license = "MIT OR Apache-2.0"
+homepage = "https://github.com/nearai/optimclaw"
+repository = "https://github.com/nearai/optimclaw"
+
+[package.metadata.dist]
+dist = false
+
+[dependencies]
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"

crates/optimclaw_common/src/event.rs

@@ -0,0 +1,393 @@
+//! Application-wide event types.
+//!
+//! `AppEvent` is the real-time event protocol used across the entire
+//! application.  The web gateway serialises these to SSE / WebSocket
+//! frames, but other subsystems (agent loop, orchestrator, extensions)
+//! produce and consume them too.
+
+use serde::{Deserialize, Serialize};
+
+/// A single tool decision in a reasoning update (SSE DTO).
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ToolDecisionDto {
+    pub tool_name: String,
+    pub rationale: String,
+}
+
+impl ToolDecisionDto {
+    /// Parse a list of tool decisions from a JSON array value.
+    pub fn from_json_array(value: &serde_json::Value) -> Vec<Self> {
+        value
+            .as_array()
+            .map(|arr| {
+                arr.iter()
+                    .filter_map(|d| {
+                        Some(Self {
+                            tool_name: d.get("tool_name")?.as_str()?.to_string(),
+                            rationale: d.get("rationale")?.as_str()?.to_string(),
+                        })
+                    })
+                    .collect()
+            })
+            .unwrap_or_default()
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(tag = "type")]
+pub enum AppEvent {
+    #[serde(rename = "response")]
+    Response { content: String, thread_id: String },
+    #[serde(rename = "thinking")]
+    Thinking {
+        message: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        thread_id: Option<String>,
+    },
+    #[serde(rename = "tool_started")]
+    ToolStarted {
+        name: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        thread_id: Option<String>,
+    },
+    #[serde(rename = "tool_completed")]
+    ToolCompleted {
+        name: String,
+        success: bool,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        error: Option<String>,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        parameters: Option<String>,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        thread_id: Option<String>,
+    },
+    #[serde(rename = "tool_result")]
+    ToolResult {
+        name: String,
+        preview: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        thread_id: Option<String>,
+    },
+    #[serde(rename = "stream_chunk")]
+    StreamChunk {
+        content: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        thread_id: Option<String>,
+    },
+    #[serde(rename = "status")]
+    Status {
+        message: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        thread_id: Option<String>,
+    },
+    #[serde(rename = "job_started")]
+    JobStarted {
+        job_id: String,
+        title: String,
+        browse_url: String,
+    },
+    #[serde(rename = "approval_needed")]
+    ApprovalNeeded {
+        request_id: String,
+        tool_name: String,
+        description: String,
+        parameters: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        thread_id: Option<String>,
+        /// Whether the "always" auto-approve option should be shown.
+        allow_always: bool,
+    },
+    #[serde(rename = "auth_required")]
+    AuthRequired {
+        extension_name: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        instructions: Option<String>,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        auth_url: Option<String>,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        setup_url: Option<String>,
+    },
+    #[serde(rename = "auth_completed")]
+    AuthCompleted {
+        extension_name: String,
+        success: bool,
+        message: String,
+    },
+    #[serde(rename = "error")]
+    Error {
+        message: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        thread_id: Option<String>,
+    },
+    #[serde(rename = "heartbeat")]
+    Heartbeat,
+
+    // Sandbox job streaming events (worker + Claude Code bridge)
+    #[serde(rename = "job_message")]
+    JobMessage {
+        job_id: String,
+        role: String,
+        content: String,
+    },
+    #[serde(rename = "job_tool_use")]
+    JobToolUse {
+        job_id: String,
+        tool_name: String,
+        input: serde_json::Value,
+    },
+    #[serde(rename = "job_tool_result")]
+    JobToolResult {
+        job_id: String,
+        tool_name: String,
+        output: String,
+    },
+    #[serde(rename = "job_status")]
+    JobStatus { job_id: String, message: String },
+    #[serde(rename = "job_result")]
+    JobResult {
+        job_id: String,
+        status: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        session_id: Option<String>,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        fallback_deliverable: Option<serde_json::Value>,
+    },
+
+    /// An image was generated by a tool.
+    #[serde(rename = "image_generated")]
+    ImageGenerated {
+        data_url: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        path: Option<String>,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        thread_id: Option<String>,
+    },
+
+    /// Suggested follow-up messages for the user.
+    #[serde(rename = "suggestions")]
+    Suggestions {
+        suggestions: Vec<String>,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        thread_id: Option<String>,
+    },
+
+    /// Per-turn token usage and cost summary.
+    #[serde(rename = "turn_cost")]
+    TurnCost {
+        input_tokens: u64,
+        output_tokens: u64,
+        cost_usd: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        thread_id: Option<String>,
+    },
+
+    /// Extension activation status change (WASM channels).
+    #[serde(rename = "extension_status")]
+    ExtensionStatus {
+        extension_name: String,
+        status: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        message: Option<String>,
+    },
+
+    /// Agent reasoning update (why it chose specific tools).
+    #[serde(rename = "reasoning_update")]
+    ReasoningUpdate {
+        narrative: String,
+        decisions: Vec<ToolDecisionDto>,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        thread_id: Option<String>,
+    },
+
+    /// Reasoning update for a sandbox job.
+    #[serde(rename = "job_reasoning")]
+    JobReasoning {
+        job_id: String,
+        narrative: String,
+        decisions: Vec<ToolDecisionDto>,
+    },
+}
+
+impl AppEvent {
+    /// The wire-format event type string (matches the `#[serde(rename)]` value).
+    pub fn event_type(&self) -> &'static str {
+        match self {
+            Self::Response { .. } => "response",
+            Self::Thinking { .. } => "thinking",
+            Self::ToolStarted { .. } => "tool_started",
+            Self::ToolCompleted { .. } => "tool_completed",
+            Self::ToolResult { .. } => "tool_result",
+            Self::StreamChunk { .. } => "stream_chunk",
+            Self::Status { .. } => "status",
+            Self::JobStarted { .. } => "job_started",
+            Self::ApprovalNeeded { .. } => "approval_needed",
+            Self::AuthRequired { .. } => "auth_required",
+            Self::AuthCompleted { .. } => "auth_completed",
+            Self::Error { .. } => "error",
+            Self::Heartbeat => "heartbeat",
+            Self::JobMessage { .. } => "job_message",
+            Self::JobToolUse { .. } => "job_tool_use",
+            Self::JobToolResult { .. } => "job_tool_result",
+            Self::JobStatus { .. } => "job_status",
+            Self::JobResult { .. } => "job_result",
+            Self::ImageGenerated { .. } => "image_generated",
+            Self::Suggestions { .. } => "suggestions",
+            Self::TurnCost { .. } => "turn_cost",
+            Self::ExtensionStatus { .. } => "extension_status",
+            Self::ReasoningUpdate { .. } => "reasoning_update",
+            Self::JobReasoning { .. } => "job_reasoning",
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Verify that `event_type()` returns the same string as the serde
+    /// `"type"` field for every variant.  This catches drift between the
+    /// `#[serde(rename)]` attributes and the manual match arms.
+    #[test]
+    fn event_type_matches_serde_type_field() {
+        let variants: Vec<AppEvent> = vec![
+            AppEvent::Response {
+                content: String::new(),
+                thread_id: String::new(),
+            },
+            AppEvent::Thinking {
+                message: String::new(),
+                thread_id: None,
+            },
+            AppEvent::ToolStarted {
+                name: String::new(),
+                thread_id: None,
+            },
+            AppEvent::ToolCompleted {
+                name: String::new(),
+                success: true,
+                error: None,
+                parameters: None,
+                thread_id: None,
+            },
+            AppEvent::ToolResult {
+                name: String::new(),
+                preview: String::new(),
+                thread_id: None,
+            },
+            AppEvent::StreamChunk {
+                content: String::new(),
+                thread_id: None,
+            },
+            AppEvent::Status {
+                message: String::new(),
+                thread_id: None,
+            },
+            AppEvent::JobStarted {
+                job_id: String::new(),
+                title: String::new(),
+                browse_url: String::new(),
+            },
+            AppEvent::ApprovalNeeded {
+                request_id: String::new(),
+                tool_name: String::new(),
+                description: String::new(),
+                parameters: String::new(),
+                thread_id: None,
+                allow_always: false,
+            },
+            AppEvent::AuthRequired {
+                extension_name: String::new(),
+                instructions: None,
+                auth_url: None,
+                setup_url: None,
+            },
+            AppEvent::AuthCompleted {
+                extension_name: String::new(),
+                success: true,
+                message: String::new(),
+            },
+            AppEvent::Error {
+                message: String::new(),
+                thread_id: None,
+            },
+            AppEvent::Heartbeat,
+            AppEvent::JobMessage {
+                job_id: String::new(),
+                role: String::new(),
+                content: String::new(),
+            },
+            AppEvent::JobToolUse {
+                job_id: String::new(),
+                tool_name: String::new(),
+                input: serde_json::Value::Null,
+            },
+            AppEvent::JobToolResult {
+                job_id: String::new(),
+                tool_name: String::new(),
+                output: String::new(),
+            },
+            AppEvent::JobStatus {
+                job_id: String::new(),
+                message: String::new(),
+            },
+            AppEvent::JobResult {
+                job_id: String::new(),
+                status: String::new(),
+                session_id: None,
+                fallback_deliverable: None,
+            },
+            AppEvent::ImageGenerated {
+                data_url: String::new(),
+                path: None,
+                thread_id: None,
+            },
+            AppEvent::Suggestions {
+                suggestions: vec![],
+                thread_id: None,
+            },
+            AppEvent::TurnCost {
+                input_tokens: 0,
+                output_tokens: 0,
+                cost_usd: String::new(),
+                thread_id: None,
+            },
+            AppEvent::ExtensionStatus {
+                extension_name: String::new(),
+                status: String::new(),
+                message: None,
+            },
+            AppEvent::ReasoningUpdate {
+                narrative: String::new(),
+                decisions: vec![],
+                thread_id: None,
+            },
+            AppEvent::JobReasoning {
+                job_id: String::new(),
+                narrative: String::new(),
+                decisions: vec![],
+            },
+        ];
+
+        for variant in &variants {
+            let json: serde_json::Value = serde_json::to_value(variant).unwrap();
+            let serde_type = json["type"].as_str().unwrap();
+            assert_eq!(
+                variant.event_type(),
+                serde_type,
+                "event_type() mismatch for variant: {:?}",
+                variant
+            );
+        }
+    }
+
+    #[test]
+    fn round_trip_deserialize() {
+        let original = AppEvent::Response {
+            content: "hello".to_string(),
+            thread_id: "t1".to_string(),
+        };
+        let json = serde_json::to_string(&original).unwrap();
+        let deserialized: AppEvent = serde_json::from_str(&json).unwrap();
+        assert_eq!(deserialized.event_type(), "response");
+    }
+}

crates/optimclaw_common/src/lib.rs

@@ -0,0 +1,7 @@
+//! Shared types and utilities for the OptimClaw workspace.
+
+mod event;
+mod util;
+
+pub use event::{AppEvent, ToolDecisionDto};
+pub use util::truncate_preview;

crates/optimclaw_common/src/util.rs

@@ -0,0 +1,100 @@
+//! Shared utility functions.
+
+/// Truncate a string to at most `max_bytes` bytes at a char boundary, appending "...".
+///
+/// If the input is wrapped in `<tool_output ...>...</tool_output>` and truncation
+/// removes the closing tag, the tag is re-appended so downstream XML parsers
+/// never see an unclosed element.
+pub fn truncate_preview(s: &str, max_bytes: usize) -> String {
+    if s.len() <= max_bytes {
+        return s.to_string();
+    }
+    // Walk backwards from max_bytes to find a valid char boundary
+    let mut end = max_bytes;
+    while end > 0 && !s.is_char_boundary(end) {
+        end -= 1;
+    }
+    let mut result = format!("{}...", &s[..end]);
+
+    // Re-close <tool_output> if truncation cut through the closing tag.
+    if s.starts_with("<tool_output") && !result.ends_with("</tool_output>") {
+        result.push_str("\n</tool_output>");
+    }
+
+    result
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_truncate_preview_short_string() {
+        assert_eq!(truncate_preview("hello", 10), "hello");
+    }
+
+    #[test]
+    fn test_truncate_preview_exact_boundary() {
+        assert_eq!(truncate_preview("hello", 5), "hello");
+    }
+
+    #[test]
+    fn test_truncate_preview_truncates_ascii() {
+        assert_eq!(truncate_preview("hello world", 5), "hello...");
+    }
+
+    #[test]
+    fn test_truncate_preview_empty_string() {
+        assert_eq!(truncate_preview("", 10), "");
+    }
+
+    #[test]
+    fn test_truncate_preview_multibyte_char_boundary() {
+        let s = "a\u{20AC}b";
+        let result = truncate_preview(s, 3);
+        assert_eq!(result, "a...");
+    }
+
+    #[test]
+    fn test_truncate_preview_emoji() {
+        let s = "hi\u{1F980}";
+        let result = truncate_preview(s, 4);
+        assert_eq!(result, "hi...");
+    }
+
+    #[test]
+    fn test_truncate_preview_cjk() {
+        let s = "\u{4F60}\u{597D}\u{4E16}\u{754C}";
+        let result = truncate_preview(s, 7);
+        assert_eq!(result, "\u{4F60}\u{597D}...");
+    }
+
+    #[test]
+    fn test_truncate_preview_zero_max_bytes() {
+        assert_eq!(truncate_preview("hello", 0), "...");
+    }
+
+    #[test]
+    fn test_truncate_preview_closes_tool_output_tag() {
+        let s = "<tool_output name=\"search\">\nSome very long content here\n</tool_output>";
+        let result = truncate_preview(s, 60);
+        assert!(result.ends_with("</tool_output>"));
+        assert!(result.contains("..."));
+    }
+
+    #[test]
+    fn test_truncate_preview_no_extra_close_when_intact() {
+        let s = "<tool_output name=\"echo\">\nshort\n</tool_output>";
+        let result = truncate_preview(s, 500);
+        assert_eq!(result, s);
+        assert_eq!(result.matches("</tool_output>").count(), 1);
+    }
+
+    #[test]
+    fn test_truncate_preview_non_xml_unaffected() {
+        let s = "Just a plain long string that gets truncated";
+        let result = truncate_preview(s, 10);
+        assert_eq!(result, "Just a pla...");
+        assert!(!result.contains("</tool_output>"));
+    }
+}

crates/optimclaw_safety/Cargo.toml

@@ -1,14 +1,13 @@
 [package]
-name = "ironclaw_safety"
-version = "0.1.0"
+name = "optimclaw_safety"
+version = "0.2.0"
 edition = "2024"
 rust-version = "1.92"
 description = "Prompt injection defense, input validation, secret leak detection, and safety policy enforcement"
 authors = ["NEAR AI <[email protected]>"]
 license = "MIT OR Apache-2.0"
-homepage = "https://github.com/nearai/ironclaw"
-repository = "https://github.com/nearai/ironclaw"
-publish = false
+homepage = "https://github.com/nearai/optimclaw"
+repository = "https://github.com/nearai/optimclaw"
 
 [package.metadata.dist]
 dist = false

crates/optimclaw_safety/fuzz/Cargo.toml

@@ -1,5 +1,5 @@
 [package]
-name = "ironclaw-safety-fuzz"
+name = "optimclaw-safety-fuzz"
 version = "0.0.0"
 publish = false
 edition = "2021"
@@ -11,7 +11,7 @@ cargo-fuzz = true
 libfuzzer-sys = "0.4"
 serde_json = "1"
 
-[dependencies.ironclaw_safety]
+[dependencies.optimclaw_safety]
 path = ".."
 
 [[bin]]

crates/optimclaw_safety/fuzz/README.md

@@ -1,6 +1,6 @@
-# ironclaw_safety Fuzz Targets
+# optimclaw_safety Fuzz Targets
 
-Fuzz testing for the `ironclaw_safety` crate using [cargo-fuzz](https://github.com/rust-fuzz/cargo-fuzz) (libFuzzer).
+Fuzz testing for the `optimclaw_safety` crate using [cargo-fuzz](https://github.com/rust-fuzz/cargo-fuzz) (libFuzzer).
 
 ## Targets
 
@@ -22,7 +22,7 @@ rustup install nightly
 ## Running
 
 ```bash
-cd crates/ironclaw_safety
+cd crates/optimclaw_safety
 
 # Run a specific target (runs until stopped or crash found)
 cargo +nightly fuzz run fuzz_safety_sanitizer