@oracle-agent/oracle 0.1.0 → 0.2.0

package/README.md

@@ -11,13 +11,26 @@ open-source agent runtime from [Nous Research](https://nousresearch.com).
 Oracle itself makes **no model calls and needs no API key**. It is the tool layer
 an agent drives. Bring whatever model your Hermes is already using.
 
-The **public package is prepare-only**: it never takes a private key and never
-broadcasts. Owner-local signer modules may exist in a private tree for operator
-deployments; they are excluded from the npm artifact and from every public
-entrypoint.
+This package is **prepare-only**: it never takes a private key and never
+broadcasts. For agentic trading with **your** keys on **your** machine, install
+the companion [`@oracle-agent/operator`](https://github.com/demi-hl/oracle-operator)
+alongside it — same split we run ourselves.
 
 ---
 
+## Install
+
+```bash
+# prepare-only (safe default)
+npm i @oracle-agent/oracle
+
+# full self-host lane (keys stay on YOUR machine) — same model we run
+npm i @oracle-agent/oracle @oracle-agent/operator
+```
+
+See the operator [SETUP](https://github.com/demi-hl/oracle-operator/blob/main/SETUP.md)
+for local key vault + Hyperliquid sign-and-submit.
+
 ## What Oracle is
 
 Most "AI crypto agent" projects give a model a hot wallet and hope. Oracle does
@@ -78,9 +91,9 @@ Three planes, and the boundary between them is mechanically enforced:
 - **Policy plane** (public) — destination allowlists, slippage guards, route and
   vault attestations, grant schema. Holds no keys; constrains what a signer may
   be asked to do.
-- **Exec plane** (owner-local source only) - signing and broadcast modules exist
-  for private operator deployments, but are excluded from every public package
-  entrypoint and from the npm artifact.
+- **Exec plane** (optional companion) - signing and broadcast live in
+  [`@oracle-agent/operator`](https://github.com/demi-hl/oracle-operator) on
+  your machine with your key. Not in this package or its npm artifact.
 
 `test/custody-boundary.test.mjs` walks the import graph and fails if any public
 module reaches wallet key material or a house signer. The split is a test, not a
@@ -146,7 +159,7 @@ allowlisted the wrong contract.
 | Intents | CoW Protocol |
 | Perps / lending / yield | GMX v2, Morpho, Pendle |
 | Bridges | Across, Hop, Relay |
-| Venues | Hyperliquid (incl. HyperCore staking), Polymarket |
+| Venues | Hyperliquid (core perps + HIP-3 builder dexs + HIP-4 outcomes), Polymarket (read + local CLOB prepare) |
 | NFT | OpenSea, Satflow, Magic Eden (Solana) |
 
 Every provider and every scanner capability declares an honest tier —
@@ -194,8 +207,11 @@ capability-labeled per chain; unconfigured venues stay unavailable instead of fa
 
 ## Install
 
-The npm package is intentionally unpublished while release hardening is in
-progress. Install from source:
+```bash
+npm install @oracle-agent/oracle    # Node >= 20.19.0
+```
+
+Or from source, if you want to run the suite:
 
 ```bash
 git clone https://github.com/demi-hl/oracle.git
@@ -382,3 +398,14 @@ oracle-data-mcp
 
 The code is open source. The **Oracle** name and marks are reserved; please
 don't imply endorsement by an official deployment when shipping a fork.
+
+### Operator hardening (0.4+)
+
+Prefer the local signer daemon so the agent never sees the vault passphrase:
+
+```bash
+npx oracle-signer   # has ORACLE_VAULT_PASSPHRASE
+# agent: ORACLE_SIGNER_URL + ORACLE_SIGNER_TOKEN only
+```
+
+See [oracle-operator SETUP](https://github.com/demi-hl/oracle-operator/blob/main/SETUP.md).

package/SECURITY.md

@@ -70,20 +70,20 @@ A security claim that isn't enforced by a test is just a comment.
 
 ## Residual operator notes
 
-These are not public-package custody holes. They are operator / release-process
-constraints that still apply after the public boundary hardening:
-
-1. **Owner-local signer modules may exist in the git tree** (`hl-exec`,
-   `key-vault`, `oracle-vault`) and are excluded from public entrypoints and the
-   npm artifact. Do not restore them to the public package for compatibility.
-   Before making the repository public, keep that exclusion intentional or move
-   the modules to a private operator repo.
+These are not public-package custody holes. They are operator constraints that
+still apply after the public boundary hardening:
+
+1. **Owner-local signer modules live in the public companion**
+   [`@oracle-agent/operator`](https://github.com/demi-hl/oracle-operator)
+   (`hl-exec`, `key-vault`, `oracle-vault`). Keys stay on the operator's
+   machine. They must not be restored into this prepare-only package or its
+   npm artifact. CI fails if a pack of *this* repo includes those paths.
 2. **Prepare helpers that validate executable routes require an attestation
    secret** (`requireSigned`) so they cannot be used as a softer pre-broadcast
    gate than `enforceTxPolicy`.
 3. **Daily spend ledger locks are pid + TTL based.** A live owner holds the
    lock; a dead pid or expired lock is reclaimed. Override TTL with
    `ORACLE_LEDGER_LOCK_TTL_MS` only if you know you need a longer window.
-4. **GitHub branch protection, code scanning, and vulnerability alerts** are
-   process controls outside this package. Enable them on `main` before treating
-   a public release as fully hardened operations.
+4. **GitHub process controls** (branch protection, CodeQL, secret scanning,
+   Dependabot) are enabled on this public repo and are independent of the
+   package boundary tests.

package/SETUP.md

@@ -5,8 +5,11 @@ a wallet private key. Prepared actions are signed in the user's wallet.
 
 ## Install
 
-The npm package is intentionally unpublished while release hardening is in
-progress. Install the source checkout with Node 20.19 or newer:
+```bash
+npm install @oracle-agent/oracle    # Node >= 20.19.0
+```
+
+Or from source, if you want to run the suite:
 
 ```bash
 git clone https://github.com/demi-hl/oracle.git
@@ -22,7 +25,7 @@ Oracle has two distribution boundaries and they are separate on purpose:
 | Plane | What it does | Needs a key? |
 |---|---|---|
 | **Read / prepare** | Market data, quotes, and *unsigned* transactions or EIP-712 actions | No, mostly |
-| **Owner-local source lane** | Optional private operator signing code, excluded from npm and public entrypoints | Yes |
+| **Owner-local source lane** | Optional companion `@oracle-agent/operator` — keys on YOUR machine | Yes |
 
 A prepared object is inert. It becomes real only when something signs it. You
 choose whether that something is your browser wallet or separately operated
@@ -129,8 +132,11 @@ Keeps the secret out of the process environment.
 
 ### 3. An encrypted vault (recommended)
 
+Install the companion and use its CLI (not shipped in this package):
+
 ```bash
-node bin/oracle-vault.mjs encrypt ~/.config/oracle/keys/hl.key
+npm i -g @oracle-agent/operator   # or npm i -D in your project
+oracle-vault encrypt ~/.config/oracle/keys/hl.key
 # writes  hl.key.vault.json          (scrypt N=2^17 + AES-256-GCM)
 # moves   hl.key -> hl.key.plaintext.bak
 
@@ -138,23 +144,22 @@ export ORACLE_VAULT_PASSPHRASE="..."         # or be prompted
 export HL_KEY_FILE=~/.config/oracle/keys/hl.key.vault.json
 
 # verify it unlocks, THEN destroy the plaintext backup
-node bin/oracle-vault.mjs inspect ~/.config/oracle/keys/hl.key.vault.json
+oracle-vault inspect ~/.config/oracle/keys/hl.key.vault.json
 shred -u ~/.config/oracle/keys/hl.key.plaintext.bak
 ```
 
-Oracle detects a vault file and decrypts it in memory. The key is never written
-back to disk, never logged, and never included in any returned object — there
-is a test asserting exactly that.
+The operator vault decrypts in memory only. The key is never written back to
+disk, never logged, and never included in any returned object.
 
 **What the vault does and does not protect.** It defends against a key file read
 by something that is not you: a synced backup, a stolen laptop at rest, an
 overly-broad `chmod`, a leaked tarball. It does **not** defend against malware
-running as your user while Oracle is unlocked. Nothing file-based does. If you
-need that, use a hardware wallet and the prepare-only path.
+running as your user while the vault is unlocked. Nothing file-based does. If
+you need that, use a hardware wallet and the prepare-only path.
 
 ```bash
-node bin/oracle-vault.mjs rekey <vault>     # rotate the passphrase
-node bin/oracle-vault.mjs inspect <vault>   # show KDF params, no secret
+oracle-vault rekey <vault>     # rotate the passphrase
+oracle-vault inspect <vault>   # show KDF params, no secret
 ```
 
 ---
@@ -178,10 +183,10 @@ const order = await data.call("hl-perps", "prepareOrder", {
 
 ### B. Owner-local execution
 
-The public `data.call()` facade refuses `hl-exec`. Private operator deployments
-must wire the source-only signer behind their own authenticated execution
-boundary. It is intentionally not exported or documented as a public package
-API.
+The public `data.call()` facade refuses `hl-exec`. Operator signing lives in
+[`@oracle-agent/operator`](https://github.com/demi-hl/oracle-operator) on your
+machine with your key. Import `hlSignAndSubmit` from that package — never from
+this one. Do not expose it on a public HTTP port.
 
 The public prepare path hard-caps slippage at 100 bps, bounds leverage by the
 asset maximum, rounds sizes and prices to venue precision, and makes brackets
@@ -233,3 +238,45 @@ routing is what makes running several practical instead of theoretical.
 
 Everything still works fine with a single provider. It is just better with a
 router that knows which brain to use for which job.
+
+### Operator hardening (0.4+)
+
+Prefer the local signer daemon so the agent never sees the vault passphrase:
+
+```bash
+npx oracle-signer   # has ORACLE_VAULT_PASSPHRASE
+# agent: ORACLE_SIGNER_URL + ORACLE_SIGNER_TOKEN only
+```
+
+See [oracle-operator SETUP](https://github.com/demi-hl/oracle-operator/blob/main/SETUP.md).
+
+## Local HIP-3 / HIP-4 / Polymarket (no VPS)
+
+### Hyperliquid HIP-3 (builder perps)
+```js
+const prep = await data.call("hl-perps", "prepareOrder", {
+  coin: "xyz:TSLA", side: "buy", type: "limit", price: "250", size: "1",
+});
+await hlSignAndSubmit(prep, { keyFile, userInitiated: true });
+// or signViaDaemon({ surface: "hl", prepared: prep, userInitiated: true })
+```
+
+### Hyperliquid HIP-4 (outcomes)
+```js
+const prep = await data.call("hl-outcome", "prepareOrder", {
+  outcome: 969, side: "yes", // or coin: "#9690"
+  side: "buy", type: "limit", price: "0.42", size: "20",
+});
+await hlSignAndSubmit(prep, { keyFile, userInitiated: true });
+```
+
+### Polymarket (local CLOB)
+```js
+const prep = await data.call("poly-clob", "prepareOrder", {
+  tokenId, side: "BUY", price: 0.45, size: 10,
+  maker: eoa, signer: eoa, tickSize: "0.01",
+});
+// signer process needs POLYMARKET_API_KEY/SECRET/PASSPHRASE + key
+await polySignAndSubmit(prep, { keyFile, userInitiated: true });
+// or signViaDaemon({ surface: "poly", prepared: prep, userInitiated: true })
+```

package/bin/desk-server.mjs

@@ -421,7 +421,9 @@ const server = createServer(async (req, res) => {
     if (e instanceof HttpError) {
       return send(res, e.status, { error: e.code, message: e.message });
     }
-    return send(res, 500, { error: String(e.message || e) });
+    // Never echo raw Error objects or stacks to the client.
+    console.error("desk-server internal error:", e && e.stack ? e.stack : e);
+    return send(res, 500, { error: "internal-error" });
   }
 });
 

package/docs/architecture.md

@@ -22,8 +22,9 @@ Three planes. The boundary between them is enforced by a test, not a convention.
                          x  no import may cross
                          |
    +-------------------------------------------+
-   |  PRIVATE (not published)                  |
-   |  keystore, house signer, exec-server      |
+   |  OWNER-LOCAL (companion package)          |
+   |  @oracle-agent/operator                   |
+   |  key-vault / hl-exec / oracle-vault       |
    +-------------------------------------------+
 ```
 
@@ -41,10 +42,10 @@ That is why the boundary is a test (`test/custody-boundary.test.mjs`) rather tha
 paragraph in a README. It walks the import graph from every shipped entrypoint and
 fails on:
 
-- a private module present in the tree
 - any public module importing signer or key material
-- a dangling local import (extraction left something behind)
+- a dangling local import that reaches a signer from a shipped entrypoint
 - a secret-shaped literal anywhere
+- a packed npm artifact that still contains signer/vault modules
 
 ## Data plane
 
@@ -127,9 +128,9 @@ No lane pins a model. `profile.json` carries a capability *class*
 (`strong-reasoner`, `fast-tool-caller`), so the installer never writes a vendor into
 a user's config.
 
-## What is not here
+## What is not in the public package
 
-The exec plane: keystore, house signer, local-signer service, exec-server,
-capability minting, and the venue adapters that hold signing authority. That is
-operator infrastructure. Its absence is the point — a self-hosted Oracle has nothing
-to steal.
+House custody, an always-on exec server, and capability minting are not shipped.
+Owner-local signer modules (`key-vault`, `hl-exec`, `oracle-vault`) live in the
+companion package `@oracle-agent/operator` on the user's machine. This prepare
+package has nothing to steal: it never takes a key and never broadcasts.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@oracle-agent/oracle",
-  "version": "0.1.0",
-  "description": "Oracle: prepare-only multichain agent control plane. Policy-bounded intents for a user-signed wallet. Self-custody by default — the public package never takes your key. Built for Hermes; no model key required.",
+  "version": "0.2.0",
+  "description": "Oracle: prepare-only multichain agent control plane. Policy-bounded intents for a user-signed wallet. Self-custody by default \u2014 the public package never takes your key. Built for Hermes; no model key required.",
   "license": "Apache-2.0",
   "type": "module",
   "publishConfig": {
@@ -40,7 +40,8 @@
     "./chains": "./src/chains.mjs",
     "./scanner": "./src/scanner/index.mjs",
     "./router": "./src/router/index.mjs",
-    "./nft-gas-war": "./src/nft-gas-war-guard.mjs"
+    "./nft-gas-war": "./src/nft-gas-war-guard.mjs",
+    "./prepare-envelope": "./src/prepare-envelope.mjs"
   },
   "scripts": {
     "test": "ORACLE_TEST_ISOLATE_SECRETS=1 ORACLE_ROUTE_ATTESTATION_SECRET=oracle-unit-test-secret node --test test/*.test.mjs",
@@ -82,9 +83,6 @@
     "CONTRIBUTING.md",
     "docs/",
     "examples/",
-    "scripts/",
-    "!bin/oracle-vault.mjs",
-    "!src/key-vault.mjs",
-    "!src/data/providers/hl-exec.mjs"
+    "scripts/"
   ]
 }

package/src/data/desk-data.mjs

@@ -27,6 +27,8 @@ import * as hevm from "./providers/hyperevm-dex.mjs";
 import * as mesol from "./providers/magiceden-sol.mjs";
 import * as hlstake from "./providers/hl-staking.mjs";
 import * as hlmarkets from "./providers/hl-markets.mjs";
+import * as hloutcome from "./providers/hl-outcome.mjs";
+import * as polyclob from "./providers/poly-clob.mjs";
 import * as hlperps from "./providers/hl-perps.mjs";
 import * as gecko from "./providers/geckoterminal.mjs";
 import * as curve from "./providers/curve.mjs";
@@ -211,6 +213,17 @@ const OPS = {
     floor: (o, a = {}) => osnft.openseaFloor(a.slug, o),
   },
 
+  "hl-outcome": {
+    list: (o) => hloutcome.hlOutcomeList(o),
+    prepareOrder: (o, a = {}) => hloutcome.hlPrepareOutcomeOrder(a, o),
+    prepareCancel: (o, a = {}) => hloutcome.hlPrepareOutcomeCancel(a, o),
+  },
+  "poly-clob": {
+    prepareOrder: (o, a = {}) => {
+      // prepare is sync; wrap for dataCall
+      return polyclob.polyPrepareOrder(a || {});
+    },
+  },
   "hl-perps": {
     health: (o) => hlmarkets.hlMarketsHealth(o),
     assetInfo: (o, a = {}) => hlperps.hlPerpAssetInfo(a, o),
@@ -529,6 +542,9 @@ export const data = {
     price: (tokenId, side, o) => dataCall("poly-public", "price", { tokenId, side }, o),
     events: (a, o) => dataCall("poly-public", "events", a || {}, o),
   },
+  polyClob: {
+    prepareOrder: (a, o) => dataCall("poly-clob", "prepareOrder", a || {}, o),
+  },
   rh: {
     health: (o) => dataCall("rh-agent", "health", {}, o),
     policy: (o) => dataCall("rh-agent", "policy", {}, o),

package/src/data/providers/bitcoin-esplora.mjs

@@ -208,22 +208,8 @@ export async function btcDecodeTxHex(args = {}, opts = {}) {
  * broadcast, so nothing goes out as a side effect of a read path. Oracle never
  * signs here; the caller supplies the bytes.
  */
-export async function btcBroadcast(args = {}, opts = {}) {
-  if (args.execute !== true) {
-    throw new Error("bitcoin-esplora: broadcast requires execute:true — refusing an implicit send");
-  }
-  const txHex = btcTxHex(args.txHex || args.hex || args.signedTransaction, "txHex");
-  const txid = await postText("/tx", txHex, opts);
-  if (!/^[0-9a-f]{64}$/i.test(txid)) {
-    throw new Error(`bitcoin-esplora: unexpected broadcast response ${String(txid).slice(0, 80)}`);
-  }
-  return {
-    provider: "bitcoin-esplora",
-    network: network(opts),
-    sent: true,
-    txid: txid.toLowerCase(),
-    signedTransactionHex: txHex,
-  };
+export async function btcBroadcast(_a = {}, _o = {}) {
+  throw new Error("bitcoin-esplora.btcBroadcast refused: @oracle-agent/oracle is prepare-only. Broadcast from the user wallet or a local operator process.");
 }
 
 // Keep httpJson import usable for Core RPC optional path later without circular deps.

package/src/data/providers/cowswap.mjs

@@ -331,72 +331,12 @@ export function cowOrderUid(intent = {}) {
   return toCowOrderUid({ digest, owner, validTo: message.validTo });
 }
 
-export async function cowSignOrder(intent = {}, opts = {}) {
-  requireExecuteGate(opts);
-  const typedData = intent.typedData;
-  if (!typedData?.domain || !typedData?.types || !typedData?.message) throw new Error("cowswap: typedData order intent required");
-  if (typedData.primaryType && typedData.primaryType !== "Order") throw new Error("cowswap: primaryType must be Order");
-  const owner = addr(intent.owner || opts.signerAddress, "owner");
-  assertCowOrderGuard(intent, typedData, owner, opts);
-  if (!opts.signTypedData || typeof opts.signTypedData !== "function") throw new Error("cowswap: signTypedData callback required");
-  const signature = await opts.signTypedData(typedData);
-  const recovered = addr(verifyTypedData(typedData.domain, typedData.types, typedData.message, signature), "recovered signer");
-  if (recovered !== owner) throw new Error("cowswap: recovered signer mismatch");
-  const uid = cowOrderUid({ ...intent, owner });
-  return {
-    provider: "cowswap",
-    chainId: Number(intent.chainId ?? typedData.domain.chainId),
-    owner,
-    signingScheme: "eip712",
-    signature,
-    uid,
-    quoteId: intent.quoteId ?? intent.cowGuard?.quoteId ?? null,
-    order: typedData.message,
-    typedData,
-    cowGuard: intent.cowGuard || null,
-    executableArtifact: true,
-    submitted: false,
-  };
+export async function cowSignOrder(_a = {}, _o = {}) {
+  throw new Error("cowswap.cowSignOrder refused: @oracle-agent/oracle is prepare-only. Sign with the user wallet; do not pass private keys here.");
 }
 
-export async function cowSubmitSignedOrder(signed = {}, opts = {}) {
-  requireExecuteGate(opts);
-  const chainId = Number(signed.chainId ?? signed.typedData?.domain?.chainId ?? 1);
-  const order = signed.order || signed.typedData?.message;
-  if (!order) throw new Error("cowswap: signed order message required");
-  const owner = addr(signed.owner || signed.from, "owner");
-  const signature = String(signed.signature || "").trim();
-  if (!/^0x[0-9a-fA-F]+$/.test(signature)) throw new Error("cowswap: signature hex required");
-  const typedData = signed.typedData || { domain: orderDomain(chainId), types: COW_ORDER_TYPES, message: order };
-  assertCowOrderGuard({ ...signed, chainId, typedData, cowGuard: signed.cowGuard }, typedData, owner, opts);
-  const recovered = addr(verifyTypedData(typedData.domain, typedData.types, typedData.message, signature), "recovered signer");
-  if (recovered !== owner) throw new Error("cowswap: recovered signer mismatch");
-  const uid = orderUid(signed.uid || cowOrderUid({ chainId, owner, typedData }));
-  const body = {
-    ...order,
-    signature,
-    signingScheme: signed.signingScheme || "eip712",
-    from: owner,
-    ...(signed.quoteId != null ? { quoteId: signed.quoteId } : {}),
-  };
-  const acceptedUid = await httpJson(`${host(chainId, opts)}/orders`, {
-    method: "POST",
-    body,
-    fetchImpl: opts.fetchImpl,
-    timeoutMs: opts.timeoutMs ?? 15_000,
-  });
-  const accepted = orderUid(typeof acceptedUid === "string" ? acceptedUid : acceptedUid?.uid || uid);
-  if (accepted !== uid) throw new Error("cowswap: accepted UID mismatch from orderbook");
-  return {
-    ok: true,
-    provider: "cowswap",
-    chainId,
-    uid: accepted,
-    expectedUid: uid,
-    owner,
-    submitted: true,
-    response: acceptedUid,
-  };
+export async function cowSubmitSignedOrder(_a = {}, _o = {}) {
+  throw new Error("cowswap.cowSubmitSignedOrder refused: @oracle-agent/oracle is prepare-only. Submit signed orders from the user wallet or local operator.");
 }
 
 export function cowPrepareCancel(q = {}) {
@@ -418,42 +358,15 @@ export function cowPrepareCancel(q = {}) {
   };
 }
 
-export async function cowSignCancel(cancel = {}, opts = {}) {
-  requireExecuteGate(opts);
-  const typedData = cancel.typedData;
-  if (!typedData?.domain || !typedData?.types || !typedData?.message) throw new Error("cowswap: cancellation typedData required");
-  if (typedData.primaryType && typedData.primaryType !== "OrderCancellations") throw new Error("cowswap: primaryType must be OrderCancellations");
-  const owner = addr(cancel.owner || opts.signerAddress, "owner");
-  if (!opts.signTypedData || typeof opts.signTypedData !== "function") throw new Error("cowswap: signTypedData callback required");
-  const signature = await opts.signTypedData(typedData);
-  const recovered = addr(verifyTypedData(typedData.domain, typedData.types, typedData.message, signature), "recovered signer");
-  if (recovered !== owner) throw new Error("cowswap: recovered signer mismatch");
-  return {
-    ...cancel,
-    owner,
-    signingScheme: "eip712",
-    signature,
-    executableArtifact: true,
-  };
+export async function cowSignCancel(_a = {}, _o = {}) {
+  throw new Error("cowswap.cowSignCancel refused: @oracle-agent/oracle is prepare-only. Cancel-sign with the user wallet.");
 }
 
-export async function cowCancelOrders(cancel = {}, opts = {}) {
-  requireExecuteGate(opts);
-  const chainId = Number(cancel.chainId ?? cancel.typedData?.domain?.chainId ?? 1);
-  const orderUids = (cancel.orderUids || cancel.typedData?.message?.orderUids || []).map((u, i) => orderUid(u, `orderUids[${i}]`));
-  if (!orderUids.length) throw new Error("cowswap: orderUids required");
-  const signature = String(cancel.signature || "").trim();
-  if (!/^0x[0-9a-fA-F]+$/.test(signature)) throw new Error("cowswap: cancellation signature hex required");
-  const body = { orderUids, signature, signingScheme: cancel.signingScheme || "eip712" };
-  const response = await httpJson(`${host(chainId, opts)}/orders`, {
-    method: "DELETE",
-    body,
-    fetchImpl: opts.fetchImpl,
-    timeoutMs: opts.timeoutMs ?? 15_000,
-  });
-  return { ok: true, provider: "cowswap", chainId, orderUids, cancelled: true, response };
+export async function cowCancelOrders(_a = {}, _o = {}) {
+  throw new Error("cowswap.cowCancelOrders refused: @oracle-agent/oracle is prepare-only. Cancel from the user wallet or local operator.");
 }
 
+
 function tradeBuyAmount(trade = {}) {
   return uintString(trade.buyAmount ?? trade.executedBuyAmount ?? "0", "trade.buyAmount");
 }

package/src/data/providers/evm-rpc.mjs

@@ -60,7 +60,26 @@ export function resolveRpcUrl(chainId, { rpcUrl, env = process.env } = {}) {
  * @param {string} method
  * @param {any[]} [params]
  */
+
+/** Prepare-only: write/settle JSON-RPC methods are hard-refused even on deep import. */
+const EVM_WRITE_RPC = new Set([
+  "eth_sendTransaction",
+  "eth_sendRawTransaction",
+  "eth_sign",
+  "eth_signTransaction",
+  "eth_signTypedData",
+  "eth_signTypedData_v4",
+  "personal_sign",
+]);
+
 export async function rpcCall(chainId, method, params = [], opts = {}) {
+  const methodName = String(method || "");
+  if (EVM_WRITE_RPC.has(methodName) || /send|sign/i.test(methodName) && !/^eth_get|^eth_call|^eth_block|^eth_chain|^eth_fee|^eth_gas|^eth_max|^eth_sync|^net_|^web3_/.test(methodName)) {
+    // allowlist is positive for common reads; anything send/sign-shaped dies.
+    if (EVM_WRITE_RPC.has(methodName) || methodName.startsWith("eth_send") || methodName.includes("sign")) {
+      throw new Error(`evm-rpc: ${methodName} refused — @oracle-agent/oracle is prepare-only (no broadcast/sign)`);
+    }
+  }
   const url = resolveRpcUrl(chainId, opts);
   if (!url) {
     throw new Error(