netclaw-dev · Aaronontheweb · Jul 16, 2026 · Jul 11, 2026 · Jul 11, 2026 · Jul 11, 2026
diff --git a/.github/workflows/pr_validation.yml b/.github/workflows/pr_validation.yml
@@ -97,7 +97,7 @@ jobs:
       # expected to produce one today.
       - name: "Upload hang dump"
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: test-hang-dump-${{ matrix.os }}
           path: ./TestResults

diff --git a/.github/workflows/smoke.yml b/.github/workflows/smoke.yml
@@ -204,9 +204,10 @@ jobs:
 
       - name: Mark binaries executable
         run: |
-          chmod +x publish/cli/netclaw publish/daemon/netclawd
+          chmod +x publish/cli/netclaw publish/daemon/netclawd publish/mcp-server/Netclaw.SmokeMcpServer
           echo "NETCLAW_SMOKE_CLI=$(pwd)/publish/cli/netclaw" >> "$GITHUB_ENV"
           echo "NETCLAW_SMOKE_DAEMON=$(pwd)/publish/daemon/netclawd" >> "$GITHUB_ENV"
+          echo "NETCLAW_SMOKE_MCP_SERVER=$(pwd)/publish/mcp-server/Netclaw.SmokeMcpServer" >> "$GITHUB_ENV"
 
       - name: Run screenshot regression
         shell: bash

diff --git a/AGENTS.md b/AGENTS.md
@@ -193,6 +193,8 @@ manifest or installer feed.
   to the primitive defeats the purpose. Use `.Value` for explicit access and
   explicit casts where truly needed. If a value object can silently become a
   string, it provides no more safety than a raw string.
+- **Never use the `global::` namespace qualifier in C# source.** Resolve name
+  collisions with an ordinary `using` directive or type alias instead.
 - **Optional/nullable parameters are rare by default — make dependencies
   required.** A constructor or method parameter should be optional (nullable or
   defaulted) only when its absence is a genuine, intended runtime state the

diff --git a/Directory.Build.props b/Directory.Build.props
@@ -9,7 +9,7 @@
     <Nullable>enable</Nullable>
     <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <VersionPrefix>0.25.0</VersionPrefix>
-    <VersionSuffix>alpha.onnx.6</VersionSuffix>
+    <VersionSuffix>alpha.onnx.7</VersionSuffix>
     <PackageReleaseNotes>- Preserve Git working context across sessions and subagents — A bounded, audience-aware Git working-context snapshot stays current in the system prompt, and coding subagents inherit recent-file/project context (#1630)
 - User-written AGENTS.md for application-specific agent guidance — Operators can author ~/.netclaw/identity/AGENTS.md, layered after Netclaw's embedded operating core and inherited by sub-agents (#1622)
 - Memory curation no longer overwrites existing documents on collision — Create-decision collisions now append new content instead of silently overwriting the existing document (#1637)

diff --git a/Directory.Packages.props b/Directory.Packages.props
@@ -9,9 +9,10 @@
     <OpenTelemetryVersion>1.16.0</OpenTelemetryVersion>
     <SlackNetVersion>0.17.10</SlackNetVersion>
     <DiscordNetVersion>3.20.1</DiscordNetVersion>
-    <MattermostNetVersion>5.0.0</MattermostNetVersion>
-    <MicrosoftExtensionsAIVersion>10.6.0</MicrosoftExtensionsAIVersion>
-    <MicrosoftAspNetCoreVersion>10.0.9</MicrosoftAspNetCoreVersion>
+    <MattermostNetVersion>5.0.3</MattermostNetVersion>
+    <MicrosoftExtensionsAIVersion>10.8.0</MicrosoftExtensionsAIVersion>
+    <OpenAIVersion>2.12.0</OpenAIVersion>
+    <MicrosoftAspNetCoreVersion>10.0.10</MicrosoftAspNetCoreVersion>
     <SkiaSharpVersion>4.148.0</SkiaSharpVersion>
     <!-- Aspire pins are exercised only by samples/Netclaw.Demo.AppHost and its
          integration tests. The 13.x line is the .NET 10 generation of Aspire;
@@ -52,6 +53,7 @@
     <PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="$(MicrosoftAspNetCoreVersion)" />
     <PackageVersion Include="Microsoft.Data.Sqlite" Version="$(MicrosoftAspNetCoreVersion)" />
     <PackageVersion Include="Microsoft.Extensions.AI.OpenAI" Version="$(MicrosoftExtensionsAIVersion)" />
+    <PackageVersion Include="OpenAI" Version="$(OpenAIVersion)" />
     <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="$(MicrosoftAspNetCoreVersion)" />
     <PackageVersion Include="Microsoft.Extensions.Hosting" Version="$(MicrosoftAspNetCoreVersion)" />
     <PackageVersion Include="Microsoft.Extensions.Http" Version="$(MicrosoftAspNetCoreVersion)" />
@@ -82,8 +84,9 @@
   <ItemGroup>
     <PackageVersion Include="Akka.Hosting.TestKit" Version="$(AkkaHostingVersion)" />
     <PackageVersion Include="xunit.v3" Version="3.2.2" />
+    <PackageVersion Include="xunit.v3.mtp-off" Version="4.0.0-pre.128" />
     <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.5" />
-    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.7.0" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
     <PackageVersion Include="CsCheck" Version="4.7.0" />
     <PackageVersion Include="Verify.XunitV3" Version="31.20.0" />
     <PackageVersion Include="Testcontainers" Version="4.13.0" />
@@ -117,11 +120,11 @@
   <ItemGroup>
     <PackageVersion Include="Microsoft.ML.OnnxRuntime" Version="1.27.0" />
     <PackageVersion Include="FastBertTokenizer" Version="1.0.28" />
-    <!-- Pinned to 10.0.9 (matches $(MicrosoftAspNetCoreVersion)), not the lowest version that
-         compiles: Microsoft.Extensions.AI 10.6.0 already pulls System.Numerics.Tensors
-         >= 10.0.8 transitively, and CentralPackageTransitivePinningEnabled requires the
+    <!-- Pinned to 10.0.10 (matches $(MicrosoftAspNetCoreVersion)), not the lowest version that
+         compiles: Microsoft.Extensions.AI 10.8.0 already pulls System.Numerics.Tensors
+         >= 10.0.10 transitively, and CentralPackageTransitivePinningEnabled requires the
          central pin to be at least as high as every transitive floor in the graph. -->
-    <PackageVersion Include="System.Numerics.Tensors" Version="10.0.9" />
+    <PackageVersion Include="System.Numerics.Tensors" Version="10.0.10" />
   </ItemGroup>
   <!-- Source generators -->
   <ItemGroup>

diff --git a/IMPLEMENTATION_PLAN.md b/IMPLEMENTATION_PLAN.md
@@ -110,6 +110,38 @@ the smallest repeatable manual script plus expected output.
 
 ## NOW
 
+### Priority: Simplify Tool Execution Context Architecture
+
+**PRDs:** `docs/prd/PRD-001-netclaw-mvp.md`, `docs/prd/PRD-002-gateway-security-envelope.md`, `docs/prd/PRD-006-mcp-tool-integration.md`, `docs/prd/PRD-007-agent-personality-and-local-memory.md`
+**Specs:** `openspec/changes/archive/2026-07-15-simplify-tool-execution-context/`
+**Surface area:** tool execution, session actors, subagents, working context
+**Verification:** L2 plus behavioral evals
+
+Deliver three sequential, independently reviewed PRs from the active OpenSpec
+change. The series replaces nullable and context-free execution APIs with
+required immutable scopes and semantic value objects, composes the session
+pipeline with behavior-preserving dependency modeling, and gives child runs independent
+working state with gated asynchronous Git enrichment.
+
+Done when:
+
+- [x] Stage 1 lands required run scopes, per-call isolation, and non-null
+  security/authority dependencies without compatibility shims.
+- [x] Stage 2 lands the composed pipeline without changing existing background,
+  fallback, authorization, approval, MCP, or model-visible behavior.
+- [x] Stage 3 lands child fork/delta semantics and Git inspection only for
+  non-Public runs with a declared Git project.
+- [x] Each stage passes review, CI, post-merge fresh-worktree verification, and
+  repository quality gates. Stage 3 eval execution was attempted but explicitly
+  blocked because the required `NETCLAW_EVAL_*` provider environment was absent;
+  no model-facing tool schema or prompt behavior changed in that stage.
+- [x] OpenSpec deltas are verified, synced, and archived after the final merge.
+
+Durable execution details and checkbox state live in
+`openspec/changes/archive/2026-07-15-simplify-tool-execution-context/tasks.md`. Per-run evidence
+lives in `.ralph/runs/`; Git commits and PR state remain the recovery source of
+truth across context compaction.
+
 ### Phase 0: Execution Governance
 
 Purpose: prevent shallow local fixes from being mistaken for runtime-complete

diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md
@@ -1,5 +1,20 @@
 # NetClaw Release Notes
 
+## 0.25.0-alpha.onnx.7 (2026-07-16)
+
+> Experimental ONNX local-embeddings build. Syncs `feature/memory-embeddings` with `dev`
+> (post-0.25.0-beta.4). No memory/embeddings behavior changes vs onnx.6. Everything still
+> rides `Memory.Embeddings.Enabled`, off by default; install only by exact pin
+> (`NETCLAW_VERSION=0.25.0-alpha.onnx.7`).
+
+### Synced from dev
+- **Webhook timestamped HMAC verification** — inbound webhook signatures are now verified against a timestamped HMAC, closing a replay window ([#1660](https://github.com/netclaw-dev/netclaw/pull/1660))
+- **Tool execution pipeline refactor** — session tool dispatch now runs through a dedicated `SessionToolExecutionPipeline`/`SessionToolBatch` structure instead of a long positional-argument call, tightening the session/tool-execution seam ([#1641](https://github.com/netclaw-dev/netclaw/pull/1641), [#1643](https://github.com/netclaw-dev/netclaw/pull/1643), [#1644](https://github.com/netclaw-dev/netclaw/pull/1644), [#1646](https://github.com/netclaw-dev/netclaw/pull/1646))
+- **OpenAI client 2.12 support** — updated OpenAI provider integration for client library 2.12 ([#1654](https://github.com/netclaw-dev/netclaw/pull/1654))
+- **Reminders definition rescan fix** — reminder definitions are now rescanned correctly after edits ([#1653](https://github.com/netclaw-dev/netclaw/pull/1653))
+- **TSV content-scanner support** — the content scanner now handles tab-separated-value files ([#1645](https://github.com/netclaw-dev/netclaw/pull/1645))
+- Routine dependency bumps
+
 ## 0.25.0-alpha.onnx.6 (2026-07-14)
 
 > Experimental ONNX local-embeddings build. Syncs `feature/memory-embeddings` with `dev`

diff --git a/docs/spec/SPEC-002-session-lifecycle-and-protocol.md b/docs/spec/SPEC-002-session-lifecycle-and-protocol.md
@@ -41,6 +41,42 @@ This enables:
 5. Actor emits typed `SessionOutput` events to subscribers.
 6. Actor checks compaction threshold.
 
+### Tool Execution Pipeline
+
+Tool-enabled sessions compose one `SessionToolExecutionPipeline` from required
+execution, time, and logging services. Each admitted tool-call response
+is submitted as one `SessionToolBatch`; the batch derives its immutable tool
+authority from the admitted `TurnContext` and carries environment and
+per-batch capabilities separately. Callers cannot supply a second authority
+object that disagrees with the admitted turn.
+
+The pipeline executes calls concurrently with fresh invocation state per call.
+Interactive approval is a required capability union: unavailable, or available
+with its required bridge. Tool-call and tool-result observability uses the
+existing session transcript path rather than a parallel no-op audit sink.
+Unavailable background-job infrastructure is an explicit capability state and
+retains synchronous execution behavior. This internal composition does not
+change MCP schemas, persisted actor messages, approval outcomes, or model-facing
+tool results.
+
+### Working Context and Child Runs
+
+For Team and Personal turns with a declared project directory, the session
+captures Git working context asynchronously before invoking the model. Git
+inspection has one aggregate deadline and produces an explicit available,
+not-repository, or unavailable result. Public turns and turns without a project
+directory do not launch Git. Continuations carry a generation number so a late
+inspection from a cancelled or superseded call cannot mutate the active turn.
+
+Each admitted subagent receives a `ChildRunScope`: a fork of immutable tool
+authority plus the parent's working-context snapshot. The child owns fresh
+activity tracking and mutable tool-call state; neither is shared with the
+parent or sibling runs. Terminal results use typed completion variants.
+Completed and partial runs carry a `WorkingContextDelta`; failed and cancelled
+runs cannot carry one. The parent merges only files the child confirms it
+changed through first-party tools. Git-observed dirty files remain diagnostic
+context and are never attributed to the child.
+
 ## Subscriber Model
 
 Subscribers join via `JoinSession` with an `OutputFilter` bitmask controlling

diff --git a/docs/spec/SPEC-011-daemon-architecture.md b/docs/spec/SPEC-011-daemon-architecture.md
@@ -95,6 +95,20 @@ Both binaries reference these class libraries:
   `ModelSelection`, `NetclawPaths`. Used by the CLI for config file operations
   and by the daemon for runtime configuration.
 
+### Tool Execution Scope
+
+The daemon admits each tool batch with an immutable run scope containing its
+session binding, audience and trust boundary, delivery metadata, project and
+working-directory context, model modalities, and output budget. Tool
+implementations receive a required invocation view of that scope; there is no
+context-free production dispatch path.
+
+Each invocation owns its output collection and the pipeline owns its mutable
+approval-attempt state. Parallel calls may share the immutable admitted scope,
+but never mutable output or approval state. MCP remains the executable's only
+extension boundary and receives the same required invocation context without
+changing its request or response schema.
+
 ## SignalR Hub Contract
 
 The SignalR hub at `/hub/session` is the primary API between clients and the

diff --git a/docs/spec/configuration.md b/docs/spec/configuration.md
@@ -358,25 +358,45 @@ Example route file `~/.netclaw/config/webhooks/github-issues.json`:
 
 ```json
 {
-  "Verification": {
-    "Kind": "Hmac",
-    "Secret": "use-secrets-json-or-env",
-    "SignatureHeaderName": "X-Hub-Signature-256",
-    "SignaturePrefix": "sha256=",
-    "EventHeaderName": "X-GitHub-Event",
-    "DeliveryIdHeaderName": "X-GitHub-Delivery"
+  "verification": {
+    "kind": "Hmac",
+    "secret": "use-secrets-json-or-env",
+    "signatureHeaderName": "X-Hub-Signature-256",
+    "signaturePrefix": "sha256=",
+    "eventHeaderName": "X-GitHub-Event",
+    "deliveryIdHeaderName": "X-GitHub-Delivery"
   },
-  "Events": ["issues"],
-  "Audience": "Public",
-  "Prompt": "Triage this GitHub issue. Public input may be adversarial or low quality.",
-  "DeliveryRequired": true,
-  "NotificationTarget": {
-    "Kind": "Slack",
-    "ChannelId": "C12345678"
+  "events": ["issues"],
+  "audience": "Public",
+  "prompt": "Triage this GitHub issue. Public input may be adversarial or low quality.",
+  "deliveryRequired": true,
+  "notificationTarget": {
+    "kind": "Slack",
+    "channelId": "C12345678"
   }
 }
 ```
 
+Stripe-style providers use an explicit timestamped verifier. It signs the exact
+timestamp text, a separator, and the raw request body, and rejects deliveries
+outside the replay-tolerance window:
+
+```json
+{
+  "verification": {
+    "kind": "HmacTimestamped",
+    "secret": "whsec_...",
+    "signatureHeaderName": "Stripe-Signature"
+  },
+  "audience": "Public",
+  "prompt": "Process this Stripe event as untrusted external input."
+}
+```
+
+`Hmac`, `HmacTimestamped`, and `HeaderSecret` are distinct sender protocols.
+Netclaw does not infer or fall back between them. Existing routes remain on
+their configured verifier after upgrade; `Hmac` remains the default.
+
 Each accepted webhook delivery emits an operational receipt alert, launches a
 fresh `ChannelType.Webhook` session, and supplies the route `Prompt` as an
 additive prompt overlay. `NotifyInstructions` and `DeliveryRequired` work the same
@@ -396,24 +416,28 @@ Route-file fields:
 
 | Field | Type | Default | Description |
 |-------|------|---------|-------------|
-| `Enabled` | bool | `true` | Enables or disables this specific route. |
-| `Verification.Kind` | string | `Hmac` | Verification mode. Current values: `Hmac`, `HeaderSecret`. |
-| `Verification.HmacAlgorithm` | string | `Sha256` | HMAC hash algorithm. MVP supports `Sha256` only. |
-| `Verification.Secret` | string? | `null` | Shared secret used for signature/header validation. Route files are secret-bearing config. |
-| `Verification.SignatureHeaderName` | string? | `null` | Header name containing the HMAC signature. Defaults to `X-Webhook-Signature`. |
-| `Verification.SignaturePrefix` | string? | `null` | Optional HMAC prefix such as `sha256=`. Defaults to empty string. |
-| `Verification.SecretHeaderName` | string? | `null` | Header name for `HeaderSecret` mode. Defaults to `X-Webhook-Secret`. |
-| `Verification.EventHeaderName` | string? | `null` | Event-name header. Defaults to `X-Webhook-Event`. |
-| `Verification.DeliveryIdHeaderName` | string? | `null` | Delivery ID header. Defaults to `X-Webhook-Delivery`. |
-| `Events` | string[] | `[]` | Optional allow-list of event types. Empty means all verified events are accepted. |
-| `Audience` | string | `Public` | Source audience for the autonomous webhook session (`Public`, `Team`, `Personal`). |
-| `Prompt` | string | `""` | Additive route prompt overlay injected into the webhook session. |
-| `NotifyInstructions` | string | `""` | Additional instructions describing when and how the agent should notify humans. |
-| `DeliveryRequired` | bool | `true` | Reminder-style delivery policy: when `true`, routes with notification instructions/targets fail if no notification is produced. |
-| `NotificationTarget.Kind` | string | `Slack` | Human-facing notification channel type. Slack is the only implementation today. |
-| `NotificationTarget.ChannelId` | string? | `null` | Slack channel ID used when the agent decides to notify. |
-| `MaxBodyBytes` | int | `1048576` | Maximum accepted request-body size in bytes. Requests larger than this are rejected before dispatch. |
-| `RateLimitPerMinute` | int | `30` | Maximum accepted deliveries per minute for this route. |
+| `enabled` | bool | `true` | Enables or disables this specific route. |
+| `verification.kind` | string | `Hmac` | Verification mode: `Hmac`, `HmacTimestamped`, or `HeaderSecret`. |
+| `verification.hmacAlgorithm` | string | `Sha256` | HMAC hash algorithm. MVP supports `Sha256` only. |
+| `verification.secret` | string? | `null` | Shared secret used for signature/header validation. Route files are secret-bearing config. |
+| `verification.signatureHeaderName` | string? | `null` | Header name containing the HMAC signature. Defaults to `X-Webhook-Signature`. |
+| `verification.signaturePrefix` | string? | `null` | Optional HMAC prefix such as `sha256=`. Defaults to empty string. |
+| `verification.secretHeaderName` | string? | `null` | Header name for `HeaderSecret` mode. Defaults to `X-Webhook-Secret`. |
+| `verification.eventHeaderName` | string? | `null` | Event-name header. Defaults to `X-Webhook-Event`. |
+| `verification.deliveryIdHeaderName` | string? | `null` | Delivery ID header. Defaults to `X-Webhook-Delivery`. |
+| `verification.toleranceSeconds` | int? | `300` | Maximum past or future clock difference for `HmacTimestamped`, from 1 through 3600 seconds. |
+| `verification.timestampField` | string? | `t` | Structured-header timestamp field for `HmacTimestamped`; must be an ASCII HTTP token and differ from the signature field. |
+| `verification.signatureField` | string? | `v1` | Structured-header signature field for `HmacTimestamped`; follows the same HTTP-token constraint, and multiple instances support sender secret rotation. |
+| `verification.signedPayloadSeparator` | string? | `.` | Separator between the exact timestamp text and raw body for `HmacTimestamped`. |
+| `events` | string[] | `[]` | Optional allow-list of event types. Empty means all verified events are accepted. |
+| `audience` | string | `Public` | Source audience for the autonomous webhook session (`Public`, `Team`, `Personal`). |
+| `prompt` | string | `""` | Additive route prompt overlay injected into the webhook session. |
+| `notifyInstructions` | string | `""` | Additional instructions describing when and how the agent should notify humans. |
+| `deliveryRequired` | bool | `true` | Reminder-style delivery policy: when `true`, routes with notification instructions/targets fail if no notification is produced. |
+| `notificationTarget.kind` | string | `Slack` | Human-facing notification channel type. Slack is the only implementation today. |
+| `notificationTarget.channelId` | string? | `null` | Slack channel ID used when the agent decides to notify. |
+| `maxBodyBytes` | int | `1048576` | Maximum accepted request-body size in bytes. Requests larger than this are rejected before dispatch. |
+| `rateLimitPerMinute` | int | `30` | Maximum accepted deliveries per minute for this route. |
 
 Route files are hot-reloaded on request. If a route file becomes missing,
 malformed, or invalid, Netclaw removes that route immediately and returns `404`