@jumboo/create-agent 0.1.0

package/templates/default/src/auth.js

@@ -0,0 +1,116 @@
+/**
+ * Caller authentication + the x402 access gate for POST /solve.
+ *
+ * Who may trigger /solve:
+ *   1. The agent OPERATOR (getAgent(AGENT_ID).operatorWallet)  → FREE (Compete path)
+ *   2. The TASK CREATOR (tasks(taskId).creator)                → Hire path, pays a
+ *      micro-fee via the HTTP 402 handshake (x402)
+ *   3. Anyone else                                             → 403.
+ */
+import { ethers } from "ethers";
+import { config } from "./config.js";
+
+/**
+ * Verifies the caller headers:
+ *   X-Jumboo-Address:   the caller's wallet address
+ *   X-Jumboo-Signature: EIP-191 personal_sign over the exact string
+ *                       `jumboo-solve:<taskId>`
+ * Returns the verified (checksummed) address, or null when auth fails.
+ */
+export function verifyCaller(req, taskId) {
+  const address = req.get("X-Jumboo-Address");
+  const signature = req.get("X-Jumboo-Signature");
+  if (!address || !signature) return null;
+
+  let recovered;
+  try {
+    recovered = ethers.verifyMessage(`jumboo-solve:${taskId}`, signature);
+  } catch {
+    return null;
+  }
+  if (recovered.toLowerCase() !== address.toLowerCase()) return null;
+  return recovered;
+}
+
+/** The authoritative x402 payment requirements for one /solve attempt. */
+export function paymentRequirements({ taskId, operatorWallet }) {
+  return {
+    x402Version: 1,
+    accepts: [
+      {
+        scheme: "exact",
+        network: config.hirePrice.network,
+        asset: config.hirePrice.asset,
+        amount: config.hirePrice.amount,
+        payTo: operatorWallet,
+        resource: "/solve",
+        description: `Hire agent #${config.agentId} to attempt task ${taskId}`,
+      },
+    ],
+  };
+}
+
+/**
+ * Validates the X-PAYMENT header against the quoted requirements.
+ *
+ * ============================ TODO — PRODUCTION ============================
+ * This DEMO implementation only checks that the caller echoed the quoted
+ * terms back. It TRUSTS the header. In production the X-PAYMENT payload must
+ * be verified AND settled through an x402 facilitator before any compute is
+ * spent. Never ship this trust-the-header shortcut.
+ * ===========================================================================
+ */
+export function verifyPayment(req, requirements) {
+  const header = req.get("X-PAYMENT");
+  if (!header) return { ok: false, reason: "no X-PAYMENT header" };
+
+  let payment;
+  try {
+    payment = JSON.parse(Buffer.from(header, "base64").toString("utf8"));
+  } catch {
+    return { ok: false, reason: "X-PAYMENT is not base64-encoded JSON" };
+  }
+
+  const terms = requirements.accepts[0];
+  const mismatches = [];
+  if (payment.scheme !== terms.scheme) mismatches.push("scheme");
+  if (payment.asset !== terms.asset) mismatches.push("asset");
+  if (String(payment.amount) !== String(terms.amount)) mismatches.push("amount");
+  if (String(payment.payTo || "").toLowerCase() !== terms.payTo.toLowerCase()) mismatches.push("payTo");
+  if (mismatches.length > 0) {
+    return { ok: false, reason: `X-PAYMENT does not match quoted terms: ${mismatches.join(", ")}` };
+  }
+  return { ok: true, payment };
+}
+
+/**
+ * The full access decision for POST /solve.
+ * Returns { allow: true, path } or { allow: false, status, body }.
+ */
+export function authorizeSolve({ req, caller, agent, task, taskId }) {
+  // 1. Operator triggers its own agent → free (Compete).
+  if (caller.toLowerCase() === agent.operatorWallet.toLowerCase()) {
+    return { allow: true, path: "compete" };
+  }
+
+  // 2. Task creator hires this agent → x402 handshake (Hire).
+  if (caller.toLowerCase() === task.creator.toLowerCase()) {
+    const requirements = paymentRequirements({ taskId, operatorWallet: agent.operatorWallet });
+    const payment = verifyPayment(req, requirements);
+    if (!payment.ok) {
+      return {
+        allow: false,
+        status: 402,
+        body: { error: `Payment required: ${payment.reason}`, ...requirements },
+      };
+    }
+    return { allow: true, path: "hire" };
+  }
+
+  // 3. Everyone else is refused.
+  return {
+    allow: false,
+    status: 403,
+    body: { error: "Only the agent operator (Compete) or the task creator (Hire) may trigger /solve" },
+  };
+}

package/templates/default/src/chain.js

@@ -0,0 +1,46 @@
+/**
+ * On-chain reads: load a task and the agent identity. The protocol-critical
+ * writes (signing the marker, claiming the escrow) live in @jumboo/agent-sdk.
+ */
+import { ethers } from "ethers";
+import { config } from "./config.js";
+
+export const provider = new ethers.JsonRpcProvider(config.rpcUrl);
+
+/** The agent's registered hot wallet — signs taskIds for PR markers. */
+export const hotWallet = new ethers.Wallet(config.agentHotKey);
+
+// TaskState enum in JumbooTaskRegistry.sol
+export const TaskState = {
+  Created: 0n,
+  Completed: 1n,
+  Cancelled: 2n,
+};
+
+const TASK_REGISTRY_ABI = [
+  "function tasks(bytes32) view returns (bytes32 taskId, string repoUrl, string issueId, uint256 rewardAmount, address creator, uint256 agentId, uint64 deadline, uint8 state)",
+];
+
+const IDENTITY_REGISTRY_ABI = [
+  "function getAgent(uint256) view returns (address operatorWallet, address agentWallet, string agentURI, bool active)",
+];
+
+export const taskRegistry = new ethers.Contract(config.taskRegistryAddress, TASK_REGISTRY_ABI, provider);
+export const identityRegistry = new ethers.Contract(config.identityRegistryAddress, IDENTITY_REGISTRY_ABI, provider);
+
+/** Loads a task from the TaskRegistry; returns null when it does not exist. */
+export async function getTask(taskId) {
+  const task = await taskRegistry.tasks(taskId);
+  if (task.creator === ethers.ZeroAddress) return null;
+  return task;
+}
+
+/** Loads this backend's agent identity; returns null when not registered. */
+export async function getAgent(agentId = config.agentId) {
+  try {
+    const [operatorWallet, agentWallet, agentURI, active] = await identityRegistry.getAgent(agentId);
+    return { operatorWallet, agentWallet, agentURI, active };
+  } catch {
+    return null;
+  }
+}

package/templates/default/src/config.js

@@ -0,0 +1,71 @@
+/**
+ * Environment loading + validation. The .env file sits next to package.json so
+ * the agent works from any working directory.
+ */
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { config as loadEnv } from "dotenv";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+export const ROOT_DIR = path.resolve(__dirname, "..");
+
+loadEnv({ path: path.join(ROOT_DIR, ".env") });
+
+const SOLVERS = ["echo", "claude", "codex", "opencode", "antigravity", "custom"];
+
+function required(name, hint = "") {
+  const value = process.env[name];
+  if (!value) {
+    throw new Error(`Missing required env var ${name}${hint ? ` (${hint})` : ""} — see .env.example`);
+  }
+  return value;
+}
+
+function intEnv(name, fallback) {
+  const raw = process.env[name];
+  if (raw === undefined || raw === "") return fallback;
+  const n = parseInt(raw, 10);
+  if (!Number.isInteger(n) || n <= 0) throw new Error(`${name} must be a positive integer, got: ${raw}`);
+  return n;
+}
+
+// Optional so `npm start` works right after scaffolding, before you register.
+// Defaults to "0" (unregistered): the server boots and /health responds; you
+// need a real id (from `npm run register`) before the agent can win a task.
+const agentId = process.env.AGENT_ID || "0";
+if (!/^\d+$/.test(agentId)) throw new Error(`AGENT_ID must be a non-negative integer, got: ${agentId}`);
+
+const solver = process.env.SOLVER || "echo";
+if (!SOLVERS.includes(solver)) {
+  throw new Error(`SOLVER must be one of ${SOLVERS.join(" | ")}, got: ${solver}`);
+}
+
+const hotKey = required("AGENT_HOT_KEY", "the agent's registered hot wallet private key");
+if (!/^0x[0-9a-fA-F]{64}$/.test(hotKey)) throw new Error("AGENT_HOT_KEY must be a 0x-prefixed 32-byte hex private key");
+
+export const config = {
+  port: intEnv("PORT", 8917),
+  rpcUrl: required("RPC_URL"),
+  agentId,
+  agentHotKey: hotKey,
+  agentTxKey: process.env.AGENT_TX_KEY || hotKey,
+  githubToken: process.env.GITHUB_TOKEN || "",
+  githubUsername: process.env.GITHUB_USERNAME || "jumboo-agent",
+  oracleUrl: required("ORACLE_URL", "e.g. https://oracle.jumboo.xyz").replace(/\/+$/, ""),
+  taskRegistryAddress: required("TASK_REGISTRY_ADDRESS"),
+  identityRegistryAddress: required("IDENTITY_REGISTRY_ADDRESS"),
+  validationRegistryAddress: required("VALIDATION_REGISTRY_ADDRESS"),
+  workdir: path.resolve(ROOT_DIR, process.env.WORKDIR || "./workspace"),
+  solver,
+  // Optional CLI-agent overrides (see src/solver.js). Blank/null = use the preset.
+  solverCommand: process.env.SOLVER_COMMAND || "",
+  solverArgs: process.env.SOLVER_ARGS ? process.env.SOLVER_ARGS.split(" ").filter(Boolean) : null,
+  solverPromptVia: process.env.SOLVER_PROMPT_VIA || "",
+  hirePrice: {
+    amount: process.env.HIRE_PRICE_AMOUNT || "0.50",
+    asset: process.env.HIRE_PRICE_ASSET || "USDC",
+    network: process.env.HIRE_PRICE_NETWORK || "sepolia",
+  },
+  dryRun: process.env.DRY_RUN === "1",
+  attestationPollSec: intEnv("ATTESTATION_POLL_SEC", 60),
+};

package/templates/default/src/github.js

@@ -0,0 +1,95 @@
+/**
+ * Minimal GitHub REST helpers over plain fetch — no SDK dependency.
+ * Also owns repo-URL parsing, which tolerates non-GitHub URLs (file://
+ * remotes are used in local DRY_RUN testing: no issue fetch, no fork logic).
+ */
+import { config } from "./config.js";
+
+const API = "https://api.github.com";
+
+/** Parses a task repoUrl into { isGitHub, owner, repo, cloneUrl }. */
+export function parseRepoUrl(repoUrl) {
+  const url = (repoUrl || "").trim();
+
+  const ssh = url.match(/^git@github\.com:([^/]+)\/(.+?)(?:\.git)?$/);
+  if (ssh) return { isGitHub: true, owner: ssh[1], repo: ssh[2], cloneUrl: url };
+
+  const https = url.match(/^https?:\/\/(?:www\.)?github\.com\/([^/]+)\/([^/]+?)(?:\.git)?\/?$/);
+  if (https) return { isGitHub: true, owner: https[1], repo: https[2], cloneUrl: url };
+
+  // file:// or any non-GitHub remote — clone/push directly, skip GitHub API.
+  return { isGitHub: false, owner: null, repo: null, cloneUrl: url };
+}
+
+/** Clone URL with the token embedded, so `git clone`/`git push` authenticate. */
+export function authenticatedCloneUrl(parsed) {
+  if (!parsed.isGitHub || !config.githubToken) return parsed.cloneUrl;
+  return `https://x-access-token:${config.githubToken}@github.com/${parsed.owner}/${parsed.repo}.git`;
+}
+
+async function ghFetch(path, { method = "GET", body } = {}) {
+  const res = await fetch(`${API}${path}`, {
+    method,
+    headers: {
+      Authorization: `Bearer ${config.githubToken}`,
+      Accept: "application/vnd.github+json",
+      "X-GitHub-Api-Version": "2022-11-28",
+      ...(body ? { "Content-Type": "application/json" } : {}),
+    },
+    body: body ? JSON.stringify(body) : undefined,
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    const details = data.errors ? ` — ${JSON.stringify(data.errors)}` : "";
+    throw new Error(`GitHub API ${res.status} ${method} ${path}: ${data.message || "request failed"}${details}`);
+  }
+  return data;
+}
+
+/** Fetch an issue's { title, body }; returns null on any failure (best-effort). */
+export async function getIssue(owner, repo, number) {
+  try {
+    const issue = await ghFetch(`/repos/${owner}/${repo}/issues/${number}`);
+    return { number, title: issue.title || "", body: issue.body || "" };
+  } catch {
+    return null;
+  }
+}
+
+/** Default branch of a repo; falls back to "main". */
+export async function getDefaultBranch(owner, repo) {
+  try {
+    const data = await ghFetch(`/repos/${owner}/${repo}`);
+    return data.default_branch || "main";
+  } catch {
+    return "main";
+  }
+}
+
+/**
+ * Fork the repo into the machine user's account (used when a direct push to
+ * origin is rejected). Fork creation is async — poll until it exists.
+ */
+export async function createFork(owner, repo) {
+  const fork = await ghFetch(`/repos/${owner}/${repo}/forks`, { method: "POST" });
+  const forkOwner = fork.owner?.login || config.githubUsername;
+  const forkRepo = fork.name || repo;
+  for (let i = 0; i < 10; i++) {
+    try {
+      await ghFetch(`/repos/${forkOwner}/${forkRepo}`);
+      break;
+    } catch {
+      await new Promise((r) => setTimeout(r, 3000));
+    }
+  }
+  return { owner: forkOwner, repo: forkRepo };
+}
+
+/** Open a pull request; head may be "branch" or "forkOwner:branch". */
+export async function createPullRequest(owner, repo, { title, head, base, body }) {
+  const pr = await ghFetch(`/repos/${owner}/${repo}/pulls`, {
+    method: "POST",
+    body: { title, head, base, body },
+  });
+  return { number: pr.number, url: pr.html_url };
+}

package/templates/default/src/index.js

@@ -0,0 +1,85 @@
+/**
+ * __PROJECT_NAME__ — a Jumboo agent backend.
+ *
+ * Receives POST /solve, enforces the Compete/Hire (x402) access policy, then
+ * runs the full pipeline: clone repo → solve issue → open PR with the Jumboo
+ * marker block → poll the oracle → auto-claim the escrow (via @jumboo/agent-sdk).
+ */
+import express from "express";
+import { config } from "./config.js";
+import { hotWallet, getAgent, getTask, TaskState } from "./chain.js";
+import { verifyCaller, authorizeSolve } from "./auth.js";
+import { startJob, getJob, jobView, jobCount } from "./job.js";
+
+const app = express();
+app.use(express.json());
+
+app.get("/health", (_req, res) => {
+  res.json({
+    ok: true,
+    agentId: config.agentId,
+    wallet: hotWallet.address,
+    solver: config.solver,
+    dryRun: config.dryRun,
+    jobs: jobCount(),
+  });
+});
+
+app.post("/solve", async (req, res) => {
+  try {
+    const taskId = req.body?.taskId;
+    if (!/^0x[0-9a-fA-F]{64}$/.test(taskId || "")) {
+      return res.status(400).json({ error: "body must be { taskId: '0x<64 hex>' }" });
+    }
+
+    const caller = verifyCaller(req, taskId);
+    if (!caller) {
+      return res.status(401).json({
+        error:
+          "invalid caller auth: send X-Jumboo-Address and X-Jumboo-Signature " +
+          `(personal_sign of the string "jumboo-solve:${taskId}")`,
+      });
+    }
+
+    const agent = await getAgent(config.agentId);
+    if (!agent) {
+      return res.status(500).json({ error: `agent #${config.agentId} is not registered on-chain` });
+    }
+    if (!agent.active) {
+      return res.status(409).json({ error: `agent #${config.agentId} is inactive` });
+    }
+
+    const task = await getTask(taskId);
+    if (!task) {
+      return res.status(404).json({ error: "task not found on-chain" });
+    }
+    if (task.state !== TaskState.Created) {
+      return res.status(409).json({ error: `task is not open (state=${task.state})` });
+    }
+
+    const decision = authorizeSolve({ req, caller, agent, task, taskId });
+    if (!decision.allow) {
+      return res.status(decision.status).json(decision.body);
+    }
+
+    const job = startJob({ taskId, task, caller, path: decision.path });
+    return res.status(202).json({ jobId: job.id, status: "queued" });
+  } catch (err) {
+    console.error(`[solve] ${err.stack || err.message}`);
+    return res.status(500).json({ error: err.message });
+  }
+});
+
+app.get("/jobs/:id", (req, res) => {
+  const job = getJob(req.params.id);
+  if (!job) return res.status(404).json({ error: "job not found" });
+  res.json(jobView(job));
+});
+
+app.listen(config.port, () => {
+  console.log(`__PROJECT_NAME__ listening on :${config.port}`);
+  console.log(`  agent id:   #${config.agentId}`);
+  console.log(`  hot wallet: ${hotWallet.address}`);
+  console.log(`  solver:     ${config.solver}${config.dryRun ? " (DRY_RUN)" : ""}`);
+  console.log(`  oracle:     ${config.oracleUrl}`);
+});

package/templates/default/src/job.js

@@ -0,0 +1,234 @@
+/**
+ * The async job pipeline behind POST /solve:
+ *
+ *   queued → cloning → solving → pushing → opening-pr → awaiting-merge
+ *          → claiming → done | failed:<step>
+ *
+ * The protocol-critical steps use @jumboo/agent-sdk:
+ *   - buildMarker: sign the taskId + build the PR marker block
+ *   - claim:       poll the oracle for the attestation, then submit it on-chain
+ *
+ * DRY_RUN=1 stops after the push: the PR is not opened, the marker block is
+ * logged instead, and attestation polling/claiming is skipped.
+ */
+import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { mkdir } from "node:fs/promises";
+import path from "node:path";
+import { ethers } from "ethers";
+import { buildMarker, claim, OUTCOME_NAME } from "@jumboo/agent-sdk";
+import { config } from "./config.js";
+import { provider, hotWallet } from "./chain.js";
+import { getSolver } from "./solver.js";
+import {
+  parseRepoUrl,
+  authenticatedCloneUrl,
+  getIssue,
+  getDefaultBranch,
+  createFork,
+  createPullRequest,
+} from "./github.js";
+
+const jobs = new Map();
+
+/** Run a child process, resolving stdout or rejecting with combined output. */
+function run(cmd, args, { cwd } = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(cmd, args, { cwd, windowsHide: true });
+    let out = "";
+    let err = "";
+    child.stdout.on("data", (d) => (out += d));
+    child.stderr.on("data", (d) => (err += d));
+    child.on("error", (e) => reject(new Error(`${cmd} failed to start: ${e.message}`)));
+    child.on("close", (code) => {
+      if (code !== 0) {
+        reject(new Error(`${cmd} ${args[0]} exited ${code}: ${(err || out).trim().slice(0, 2000)}`));
+      } else {
+        resolve(out);
+      }
+    });
+  });
+}
+
+const git = (args, opts) => run("git", args, opts);
+
+function setStatus(job, status, detail) {
+  job.status = status;
+  job.steps.push({ status, at: new Date().toISOString(), ...(detail ? { detail } : {}) });
+  console.log(`[job ${job.id}] ${status}${detail ? ` — ${detail}` : ""}`);
+}
+
+export function getJob(id) {
+  return jobs.get(id) || null;
+}
+
+export function jobCount() {
+  return jobs.size;
+}
+
+/** Public JSON view of a job (no secrets are ever stored on the job object). */
+export function jobView(job) {
+  return {
+    jobId: job.id,
+    taskId: job.taskId,
+    path: job.path,
+    caller: job.caller,
+    solver: job.solver,
+    status: job.status,
+    steps: job.steps,
+    branch: job.branch ?? null,
+    prUrl: job.prUrl ?? null,
+    markerBlock: job.markerBlock ?? null,
+    outcome: job.outcome ?? null,
+    claimTx: job.claimTx ?? null,
+    dryRun: job.dryRun ?? false,
+    error: job.error ?? null,
+    createdAt: job.createdAt,
+  };
+}
+
+/** Registers a queued job and kicks off the async pipeline. */
+export function startJob({ taskId, task, caller, path: accessPath }) {
+  const job = {
+    id: randomBytes(8).toString("hex"),
+    taskId,
+    task,
+    caller,
+    path: accessPath, // "compete" | "hire"
+    solver: config.solver,
+    status: "queued",
+    steps: [],
+    createdAt: new Date().toISOString(),
+  };
+  jobs.set(job.id, job);
+  setStatus(job, "queued", `${accessPath} path, caller ${caller}`);
+  setImmediate(() =>
+    runJob(job).catch((err) => {
+      job.error = job.error || err.message;
+      if (!job.status.startsWith("failed")) job.status = "failed:unknown";
+      console.error(`[job ${job.id}] pipeline crashed: ${err.message}`);
+    })
+  );
+  return job;
+}
+
+async function runJob(job) {
+  const { task, taskId } = job;
+  const parsed = parseRepoUrl(task.repoUrl);
+  const repoDir = path.join(config.workdir, job.id);
+  const branch = `jumboo/task-${taskId.slice(2, 10)}`;
+  job.branch = branch;
+  let step = "cloning";
+
+  try {
+    // 1+2. Clone the task repo and create the working branch --------------
+    setStatus(job, "cloning", `${task.repoUrl} → ${repoDir}`);
+    await mkdir(config.workdir, { recursive: true });
+    await git(["clone", authenticatedCloneUrl(parsed), repoDir]);
+    await git(["checkout", "-b", branch], { cwd: repoDir });
+
+    // 3. Solve -------------------------------------------------------------
+    step = "solving";
+    const issue = await resolveIssue(parsed, task.issueId);
+    setStatus(job, "solving", `driver=${config.solver}, issue=${issue.ref}`);
+    const solver = getSolver();
+    const { summary } = await solver.solve({ repoDir, task, issue });
+    job.summary = summary;
+
+    // 4. Commit as the machine user, push (fork fallback) -------------------
+    step = "pushing";
+    setStatus(job, "pushing", branch);
+    await git(["add", "-A"], { cwd: repoDir });
+    const changed = await git(["status", "--porcelain"], { cwd: repoDir });
+    if (!changed.trim()) {
+      throw new Error("solver produced no changes — nothing to commit");
+    }
+    const user = config.githubUsername;
+    await git(
+      [
+        "-c", `user.name=${user}`,
+        "-c", `user.email=${user}@users.noreply.github.com`,
+        "commit", "-m", `Jumboo task ${taskId.slice(0, 10)}… (agent #${config.agentId})`,
+      ],
+      { cwd: repoDir }
+    );
+
+    let prHead = branch;
+    try {
+      await git(["push", "-u", "origin", branch], { cwd: repoDir });
+    } catch (pushErr) {
+      // No write access to origin → fork-and-push (GitHub repos only).
+      if (!parsed.isGitHub || !config.githubToken) throw pushErr;
+      setStatus(job, "pushing", `origin push rejected, forking as ${user}`);
+      const fork = await createFork(parsed.owner, parsed.repo);
+      const forkUrl = `https://x-access-token:${config.githubToken}@github.com/${fork.owner}/${fork.repo}.git`;
+      await git(["remote", "add", "fork", forkUrl], { cwd: repoDir });
+      await git(["push", "-u", "fork", branch], { cwd: repoDir });
+      prHead = `${fork.owner}:${branch}`;
+    }
+
+    // 5. Build the marker block (SDK signs the RAW taskId bytes for us) ------
+    const { marker } = await buildMarker({ taskId, agentId: config.agentId, hotWallet });
+    job.markerBlock = marker;
+
+    // 6. Open the PR (or log the markers in DRY_RUN) -------------------------
+    if (config.dryRun) {
+      job.dryRun = true;
+      console.log(`[job ${job.id}] DRY_RUN — skipping PR creation. Branch: ${prHead}`);
+      console.log(`[job ${job.id}] PR marker block:\n${marker}`);
+      setStatus(job, "done", `dry run: branch ${prHead} pushed, PR skipped`);
+      return;
+    }
+
+    step = "opening-pr";
+    setStatus(job, "opening-pr", `head=${prHead}`);
+    if (!parsed.isGitHub) {
+      throw new Error("cannot open a PR on a non-GitHub repo (use DRY_RUN=1 for local remotes)");
+    }
+    const base = await getDefaultBranch(parsed.owner, parsed.repo);
+    const pr = await createPullRequest(parsed.owner, parsed.repo, {
+      title: `Jumboo task ${taskId.slice(0, 10)}… (agent #${config.agentId})`,
+      head: prHead,
+      base,
+      body: `${(job.summary || "").trim()}\n\n---\n${marker}`,
+    });
+    job.prUrl = pr.url;
+    console.log(`[job ${job.id}] PR opened: ${pr.url}`);
+
+    // 7. Wait for the oracle's attestation, then claim on-chain (SDK) --------
+    step = "awaiting-merge";
+    setStatus(job, "awaiting-merge", `polling ${config.oracleUrl} every ${config.attestationPollSec}s`);
+    const txWallet = new ethers.Wallet(config.agentTxKey, provider); // pays claim gas
+    const { attestation, receipt } = await claim({
+      oracleUrl: config.oracleUrl,
+      registryAddress: config.validationRegistryAddress,
+      taskId,
+      agentId: config.agentId,
+      wallet: txWallet,
+      intervalMs: config.attestationPollSec * 1000,
+      onPoll: ({ error }) => {
+        if (error) console.warn(`[job ${job.id}] poll: ${error.message}`);
+      },
+    });
+    job.outcome = OUTCOME_NAME[Number(attestation.outcome)] ?? String(attestation.outcome);
+
+    step = "claiming";
+    setStatus(job, "claiming", `outcome=${job.outcome}`);
+    job.claimTx = receipt.hash;
+    setStatus(job, "done", `outcome=${job.outcome}, tx=${receipt.hash}`);
+  } catch (err) {
+    job.error = err.message;
+    setStatus(job, `failed:${step}`, err.message);
+  }
+}
+
+/** Best-effort issue content for the solver prompt. */
+async function resolveIssue(parsed, issueId) {
+  const fallback = { title: "", body: "", ref: String(issueId) };
+  if (!parsed.isGitHub || !config.githubToken) return fallback;
+  const match = String(issueId).match(/\d+/);
+  if (!match) return fallback;
+  const issue = await getIssue(parsed.owner, parsed.repo, Number(match[0]));
+  if (!issue) return fallback;
+  return { ...issue, ref: `#${issue.number} ${issue.title}`.trim() };
+}