@oracle-agent/oracle 0.13.0 → 0.14.0

package/package.json

@@ -1,27 +1,123 @@
 {
   "name": "@oracle-agent/oracle",
-  "version": "0.13.0",
-  "description": "Oracle is distributed to Locals Only holders. This package is a pointer to the gate, not the product.",
+  "version": "0.14.0",
+  "description": "Oracle: standalone prepare-only multichain agent control plane with optional Hermes integration. Policy-bounded intents for a user-signed wallet; the public package never takes your key.",
+  "license": "BUSL-1.1",
   "type": "module",
-  "license": "SEE LICENSE IN LICENSE",
+  "publishConfig": {
+    "access": "public"
+  },
+  "homepage": "https://github.com/demi-hl/oracle",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/demi-hl/oracle.git"
+  },
+  "keywords": [
+    "ai-agent",
+    "multichain",
+    "evm",
+    "self-custody",
+    "defi",
+    "hermes",
+    "nous",
+    "mcp"
+  ],
   "engines": {
     "node": ">=20.19.0"
   },
   "bin": {
-    "oracle": "bin/oracle.mjs"
+    "oracle": "./bin/oracle.mjs",
+    "oracle-data": "./bin/desk-server.mjs",
+    "oracle-public": "./bin/oracle-public-server.mjs",
+    "oracle-data-mcp": "./bin/oracle-data-mcp.mjs",
+    "oracle-init": "./bin/oracle-init.mjs",
+    "oracle-upgrade": "./bin/oracle-upgrade.mjs",
+    "oracle-scan": "./bin/oracle-scan.mjs",
+    "oracle-route": "./bin/oracle-route.mjs",
+    "oracle-equities": "./bin/oracle-equities.mjs"
+  },
+  "exports": {
+    ".": "./src/index.mjs",
+    "./farming": "./src/data/providers/farming.mjs",
+    "./data": "./src/data/desk-data.mjs",
+    "./policy": "./src/public-control/policy-schema.mjs",
+    "./chains": "./src/chains.mjs",
+    "./scanner": "./src/scanner/index.mjs",
+    "./router": "./src/router/index.mjs",
+    "./equities": "./src/equities/index.mjs",
+    "./action-semantics": "./src/action-semantics.mjs",
+    "./address-book": "./src/address-book.mjs",
+    "./names": "./src/data/names.mjs",
+    "./nft-gas-war": "./src/nft-gas-war-guard.mjs",
+    "./prepare-envelope": "./src/prepare-envelope.mjs",
+    "./connect": "./src/onboarding/harness-configs.mjs",
+    "./receipts": "./src/action-receipts.mjs",
+    "./risk": "./src/portfolio-risk.mjs",
+    "./watch": "./src/watch-preferences.mjs",
+    "./signals": "./src/signals/index.mjs",
+    "./agent-grants": "./src/public-api/agent-grants.mjs"
+  },
+  "scripts": {
+    "test": "ORACLE_TEST_ISOLATE_SECRETS=1 ORACLE_ROUTE_ATTESTATION_SECRET=oracle-unit-test-secret node --test test/*.test.mjs",
+    "test:boundary": "ORACLE_TEST_ISOLATE_SECRETS=1 ORACLE_ROUTE_ATTESTATION_SECRET=oracle-unit-test-secret node --test test/custody-boundary.test.mjs",
+    "e2e:solana-bitcoin": "node scripts/e2e-solana-bitcoin.mjs",
+    "e2e:hypercore-staking": "node scripts/e2e-hypercore-staking.mjs",
+    "start:data": "node bin/desk-server.mjs",
+    "start:public": "node bin/oracle-public-server.mjs",
+    "scan:public-apis": "node scripts/public-api-scan.mjs",
+    "health": "node -e \"import('./src/data/desk-data.mjs').then(m=>m.data.health().then(h=>console.log(JSON.stringify(h,null,2))))\"",
+    "init": "node bin/oracle-init.mjs",
+    "init:apply": "node bin/oracle-init.mjs --apply",
+    "scan": "node bin/oracle-scan.mjs",
+    "verify:venues": "node scripts/verify-v3-venues.mjs",
+    "route": "node bin/oracle-route.mjs",
+    "scan:secrets": "node scripts/secret-scan.mjs",
+    "test:count": "node scripts/check-test-count.mjs",
+    "test:count:update": "node scripts/check-test-count.mjs --update",
+    "test:protocol-templates": "RUN_PROTOCOL_TEMPLATE_TESTS=1 node --test test/protocol-templates.test.mjs",
+    "protocol:gate": "node scripts/protocol-template-gate.mjs",
+    "gate:docs": "node scripts/check-doc-drift.mjs",
+    "gate:release": "npm run gate:docs && node --test test/flag-polarity.test.mjs",
+    "build:dist": "node scripts/build-dist.mjs",
+    "verify:dist": "node scripts/verify-dist.mjs",
+    "publish:dist": "ORACLE_PUBLISH_STAGED=1 node scripts/publish-dist.mjs",
+    "prepublishOnly": "node scripts/guard-publish.mjs"
+  },
+  "dependencies": {
+    "@msgpack/msgpack": "^3.1.3",
+    "@noble/curves": "^2.2.0",
+    "@noble/hashes": "^2.2.0",
+    "@scure/base": "^2.2.0",
+    "ethers": "^6.16.0",
+    "viem": "^2.55.8"
   },
   "files": [
     "bin/",
+    "src/",
+    "!src/**/__pycache__/**",
+    "profiles/",
+    "skills/",
+    "skins/",
+    "plugins/",
+    "public/",
+    "artifacts/",
     "README.md",
-    "LICENSE"
-  ],
-  "keywords": [
-    "oracle",
-    "locals-only"
+    "SETUP.md",
+    "LICENSE",
+    "SECURITY.md",
+    "CONTRIBUTING.md",
+    "docs/",
+    "examples/",
+    "scripts/",
+    "protocols/templates/**/src/**",
+    "protocols/templates/**/test/**",
+    "protocols/templates/**/foundry.toml",
+    "protocols/templates/**/remappings.txt",
+    "protocols/templates/**/SECURITY.md",
+    "src/protocol-templates/**"
   ],
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/demi-hl/oracle.git"
-  },
-  "homepage": "https://oracle.demi.la"
+  "devDependencies": {
+    "@scure/bip39": "^1.6.0",
+    "esbuild": "^0.28.1"
+  }
 }

package/plugins/oracle-owner-gate/__init__.py

@@ -0,0 +1,288 @@
+"""Hermes owner and raw-message intent gate for Oracle execution tools.
+
+This is a routing guard, not a signer.  Local Operator policy remains the
+final authority for every signature and broadcast.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+from collections import OrderedDict
+from pathlib import Path
+from typing import Any, Dict, Optional, Tuple
+
+_MAX_SESSIONS = 256
+_TURNS: "OrderedDict[str, Dict[str, Any]]" = OrderedDict()
+
+_PROTECTED = {
+    "oracle_watch_create": "alert_only",
+    "oracle_control_arm": "execute",
+    "oracle_control_confirm": "execute",
+    "oracle_action_cancel": "cancel",
+    "oracle_action_list": "owner_read",
+    "oracle_action_status": "owner_read",
+    "oracle_operator_sign": "sign",
+    "oracle_operator_send": "send",
+    "oracle_operator_execute": "send",
+    "exec_arm": "execute",
+    "exec_disarm": "cancel",
+    "evm_sign": "sign",
+    "evm_send": "send",
+    "bitcoin_sign": "sign",
+    "bitcoin_send": "send",
+    "bitcoin_inscribe_sign_commit": "sign",
+    "bitcoin_inscribe_sign_reveal": "sign",
+    "bitcoin_satflow_broadcast_purchase": "send",
+    "solana_sign": "sign",
+    "solana_send": "send",
+    "evm_cow_order_sign": "sign",
+    "evm_cow_order_submit": "send",
+    "evm_cow_order_cancel_sign": "sign",
+    "evm_cow_order_cancel_submit": "send",
+    # The address book is durable state a later send can be routed against, so
+    # writes are owner-only. Reads stay open to the owner's own sessions.
+    "address_book_remember": "owner_write",
+    "address_book_forget": "owner_write",
+    "address_book_list": "owner_read",
+    "address_book_lookup": "owner_read",
+}
+
+_EXEC_NAMESPACE_MARKERS = ("mad_exec_", "oracle_exec_", "oracle_control_")
+_EXEC_OWNER_READ_OPERATIONS = {
+    "bitcoin_decode",
+    "bitcoin_exec_status",
+    "bitcoin_inscribe_prepare",
+    "bitcoin_inscribe_status",
+    "bitcoin_prepare",
+    "bitcoin_runes_prepare_transfer",
+    "bitcoin_satflow_prepare_list",
+    "bitcoin_satflow_prepare_purchase",
+    "evm_chains",
+    "evm_cow_order_cancel_prepare",
+    "evm_cow_order_prepare",
+    "evm_cow_order_status",
+    "evm_cow_order_verify",
+    "evm_erc20_allowance",
+    "evm_erc20_revoke_prepare",
+    "evm_gmx_order_prepare",
+    "evm_gmx_order_verify",
+    "evm_morpho_vault_prepare",
+    "evm_prepare",
+    "evm_protocol_prepare",
+    "evm_protocol_quote",
+    "evm_quote",
+    "evm_simulate",
+    "evm_status",
+    "evm_verify_tx",
+    "solana_decode",
+    "solana_exec_status",
+}
+
+_LEADING_INTENT = re.compile(
+    r"^\s*(watch|ping|arm\s+confirm|arm|cancel|disarm|sign|send|execute)(?=$|[\s:,.!?;\-])",
+    re.IGNORECASE,
+)
+
+
+def _config_path() -> Path:
+    override = os.environ.get("ORACLE_CONFIG_DIR")
+    root = Path(override).expanduser() if override else Path.home() / ".config" / "oracle"
+    return root / "owner.json"
+
+
+def _read_config() -> Optional[Dict[str, Any]]:
+    path = _config_path()
+    try:
+        if path.stat().st_mode & 0o077:
+            return None
+        value = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, ValueError, TypeError):
+        return None
+    return value if isinstance(value, dict) else None
+
+
+def _strings(value: Any) -> set[str]:
+    if isinstance(value, str):
+        return {value.strip()} if value.strip() else set()
+    if isinstance(value, (list, tuple, set)):
+        return {str(item).strip() for item in value if str(item).strip()}
+    return set()
+
+
+def _owner_ids(config: Dict[str, Any], platform: str) -> set[str]:
+    """Accept the public flat form plus convenient per-platform mappings."""
+    result = set()
+    canonical = config.get("owner")
+    if isinstance(canonical, str) and ":" in canonical:
+        owner_platform, owner_id = canonical.split(":", 1)
+        if owner_platform.strip().lower() == platform and owner_id.strip():
+            result.add(owner_id.strip())
+    for key in ("owner_ids", "ownerIds", "owners"):
+        value = config.get(key)
+        if isinstance(value, dict):
+            result |= _strings(value.get(platform))
+            result |= _strings(value.get("*"))
+        else:
+            result |= _strings(value)
+    platforms = config.get("platforms")
+    if isinstance(platforms, dict):
+        entry = platforms.get(platform)
+        if isinstance(entry, dict):
+            result |= _strings(entry.get("owner_ids"))
+            result |= _strings(entry.get("owners"))
+        else:
+            result |= _strings(entry)
+    return result
+
+
+def _local_cli_allowed(config: Dict[str, Any]) -> bool:
+    value = config.get("local_cli", config.get("localCli", config.get("allow_local_cli", False)))
+    if isinstance(value, dict):
+        value = value.get("allow", value.get("owner", value.get("enabled", False)))
+    return value is True or (isinstance(value, str) and value.lower() in {"allow", "owner", "enabled", "true"})
+
+
+def _intent(raw_message: Any) -> str:
+    if not isinstance(raw_message, str):
+        return "none"
+    match = _LEADING_INTENT.match(raw_message)
+    if not match:
+        return "none"
+    command = " ".join(match.group(1).lower().split())
+    if command in {"watch", "ping"}:
+        return "alert_only"
+    if command in {"arm", "arm confirm"}:
+        return "execute"
+    if command in {"cancel", "disarm"}:
+        return "cancel"
+    if command == "sign":
+        return "sign"
+    return "send"
+
+
+def _tool_class(tool_name: Any) -> Optional[str]:
+    # MCP adapters use several separators.  Collapsing all non-alphanumerics
+    # lets us compare the authoritative suffix without trusting the prefix.
+    normalized = re.sub(r"[^a-z0-9]+", "_", str(tool_name or "").lower()).strip("_")
+    for suffix, tool_class in _PROTECTED.items():
+        if normalized == suffix or normalized.endswith("_" + suffix):
+            return tool_class
+    # Tool catalogs grow faster than this plugin's explicit list. Once a tool
+    # is in a signer/executor namespace, an unknown operation must not become
+    # guest-accessible merely because its name is new. Only exact, reviewed
+    # read/quote/simulate/prepare operation names get frictionless OWNER access;
+    # every unknown operation requires owner send/execute intent and still
+    # faces the signer-owned final policy.
+    for marker in _EXEC_NAMESPACE_MARKERS:
+        marker_at = normalized.find(marker)
+        if marker_at < 0:
+            continue
+        operation = normalized[marker_at + len(marker):]
+        words = set(operation.split("_"))
+        if "sign" in words:
+            return "sign"
+        if words & {"send", "submit", "broadcast", "execute"}:
+            return "send"
+        if operation in _EXEC_OWNER_READ_OPERATIONS:
+            return "owner_read"
+        return "send"
+    return None
+
+
+def _identity(config: Optional[Dict[str, Any]], platform: str, sender_id: str) -> Tuple[bool, str]:
+    if config is None:
+        return False, "owner configuration is unavailable"
+    platform = platform.strip().lower()
+    sender_id = sender_id.strip()
+    if platform in {"cli", "local", "terminal"}:
+        if _local_cli_allowed(config):
+            return True, ""
+        return False, "local CLI is not authorized by owner policy"
+    if not sender_id:
+        return False, "gateway sender identity is missing"
+    if sender_id not in _owner_ids(config, platform):
+        return False, "sender is not an owner"
+    return True, ""
+
+
+def _block(reason: str) -> Dict[str, str]:
+    return {"action": "block", "message": "Oracle owner gate: " + reason + "."}
+
+
+def _on_pre_llm_call(
+    session_id: str = "",
+    sender_id: str = "",
+    platform: str = "",
+    user_message: Any = "",
+    parent_session_id: str = "",
+    **_: Any,
+) -> None:
+    """Snapshot only Hermes-trusted turn metadata and the original user input."""
+    session_id = str(session_id or "").strip()
+    if not session_id:
+        return None
+    _TURNS[session_id] = {
+        "session_id": session_id,
+        "parent_session_id": str(parent_session_id or "").strip(),
+        "sender_id": str(sender_id or "").strip(),
+        "platform": str(platform or "").strip().lower(),
+        "raw_message": user_message if isinstance(user_message, str) else "",
+        "intent": _intent(user_message),
+    }
+    _TURNS.move_to_end(session_id)
+    while len(_TURNS) > _MAX_SESSIONS:
+        _TURNS.popitem(last=False)
+    return None
+
+
+def _on_pre_tool_call(tool_name: str = "", session_id: str = "", **_: Any) -> Optional[Dict[str, str]]:
+    required = _tool_class(tool_name)
+    if required is None:
+        return None
+    session_id = str(session_id or "").strip()
+    turn = _TURNS.get(session_id)
+    if turn is None:
+        return _block("no trusted current-turn owner message exists for this session")
+    if turn["parent_session_id"]:
+        return _block("delegated and background sessions cannot execute or sign")
+    allowed, reason = _identity(_read_config(), turn["platform"], turn["sender_id"])
+    if not allowed:
+        return _block(reason)
+    if required == "owner_read":
+        return None
+    if required == "owner_write":
+        # Owner-authenticated bookkeeping. It records a label; it does not move
+        # value and does not need a leading execution verb like `arm`.
+        return None
+    intent = turn["intent"]
+    if intent != required:
+        labels = {
+            "alert_only": "watch or ping",
+            "execute": "arm",
+            "cancel": "cancel or disarm",
+            "sign": "sign",
+            "send": "send or execute",
+        }
+        return _block(f"raw owner intent does not authorize {required}; start the message with {labels[required]}")
+    return None
+
+
+def _on_session_end(session_id: str = "", **_: Any) -> None:
+    _TURNS.pop(str(session_id or "").strip(), None)
+
+
+def _on_session_reset(session_id: str = "", **_: Any) -> None:
+    session_id = str(session_id or "").strip()
+    if session_id:
+        _TURNS.pop(session_id, None)
+    else:
+        _TURNS.clear()
+
+
+def register(ctx: Any) -> None:
+    ctx.register_hook("pre_llm_call", _on_pre_llm_call)
+    ctx.register_hook("pre_tool_call", _on_pre_tool_call)
+    ctx.register_hook("on_session_end", _on_session_end)
+    ctx.register_hook("on_session_reset", _on_session_reset)

package/plugins/oracle-owner-gate/plugin.yaml

@@ -0,0 +1,9 @@
+name: oracle-owner-gate
+version: "0.1.0"
+description: "Owner-identity and raw-turn intent gate for Oracle execution tools."
+author: "Oracle contributors"
+hooks:
+  - pre_llm_call
+  - pre_tool_call
+  - on_session_end
+  - on_session_reset

package/profiles/_template/SOUL.md

@@ -0,0 +1,54 @@
+# your lane
+
+> Template. Copy this directory, rename it, and rewrite this file.
+
+## What you own
+
+One sentence. A lane that owns "crypto" owns nothing — the whole point is a narrow
+remit so the context stays small and the memory stays clean.
+
+## The thing that bites people here
+
+Every venue has one. Perps have liquidation. Low-caps have honeypots. New chains
+have dry bridges. Solana has blockhash expiry.
+
+Write yours here, concretely, with the check that catches it. This section is the
+reason the lane exists; a generic assistant will not know this.
+
+## Hard rules
+
+Keep these. They are the desk's invariants, not suggestions:
+
+1. **You do not sign.** Transactions are prepared for the user's wallet.
+2. **A grant is authorization; your reasoning is not.** Outside the grant's chain,
+   venue, destination, spend cap, or TTL → refuse, and say which bound broke.
+3. **Receipts or it didn't happen.** No hash, no receipt, no balance delta → it
+   did not succeed.
+4. **Never invent chain facts.** Not from a live read → `unknown`.
+
+Then add rules specific to your venue.
+
+## Voice
+
+Terse. Answer first, evidence second. State confidence: `high` / `moderate` /
+`low` / `unknown`.
+
+---
+
+## Wiring it up
+
+```bash
+# preferred: installer writes SOUL, skills, and MCP config
+npx oracle-init --apply
+
+# or by hand
+hermes profile create my-lane
+npx oracle-data   # keep running — MCP tools call 127.0.0.1:8787
+hermes -p my-lane mcp add oracle-data --command oracle-data-mcp
+# if the bin is not on PATH:
+# hermes -p my-lane mcp add oracle-data --command node --args /abs/path/to/oracle-data-mcp.mjs
+```
+
+Then copy this `SOUL.md` into `~/.hermes/profiles/my-lane/SOUL.md` and set the
+model in that profile's `config.yaml`. `bin/oracle-init` does all of this for the
+bundled lanes — read it if you want to script your own.

package/profiles/_template/profile.json

@@ -0,0 +1,22 @@
+{
+  "$schema": "./profile.schema.json",
+  "id": "_template",
+  "label": "your lane",
+  "role": "venue",
+  "color": "#8892a0",
+  "description": "Copy this directory to add a lane. Rename the id, write the SOUL, list your chains.",
+  "template": true,
+  "model": {
+    "note": "Pick per workload. Heavy judgment -> strong reasoner. Many small tool calls -> fast model.",
+    "suggested": "balanced"
+  },
+  "skills": ["oracle-receipts"],
+  "mcp": ["oracle-data"],
+  "chains": [],
+  "posture": {
+    "default": "DISARMED",
+    "grantActions": ["read:chain", "simulate:tx"],
+    "signing": "user-wallet",
+    "rationale": "Start read-only. Widen the grant only once the lane has proven it behaves."
+  }
+}

package/profiles/bitcoin-agent/SOUL.md

@@ -0,0 +1,31 @@
+# bitcoin agent
+
+You cover **Bitcoin mainnet**: L1 reads, Ordinals/runes research, Satflow market
+PSBTs, and inscription preparation.
+
+## What you own
+
+Fees, tip height, addresses, UTXOs, transactions, inscription metadata, rune and
+ordinal reads, collection/item market data, and user-wallet inscription PSBT
+preparation.
+
+## Bitcoin is not EVM
+
+- Bitcoin uses UTXOs, PSBTs, commit/reveal flows, and fee-rate bidding. Do not
+  translate EVM calldata assumptions into Bitcoin.
+- Public signing is user-wallet. Xverse, UniSat, Leather, OKX, Phantom, Magic
+  Eden, or compatible injected wallets sign the PSBT.
+- Operator WIF/local signing is not part of the public lane.
+
+## Inscription hard rules
+
+1. Check health, fee rates, and the body-size cap before preparing.
+2. Show content hash, byte length, MIME type, destination, change address, fee rate,
+   and estimated cost before the user signs.
+3. Explain commit/reveal as non-atomic.
+4. Never request or print seed, WIF, xprv, or wallet export.
+5. Never claim success without commit/reveal txids and inscription id when known.
+
+## Voice
+
+Short. Fee-aware. State confidence explicitly. If a fee/read is stale, re-read it.

package/profiles/bitcoin-agent/profile.json

@@ -0,0 +1,32 @@
+{
+  "$schema": "./profile.schema.json",
+  "id": "bitcoin-agent",
+  "label": "bitcoin agent",
+  "role": "venue",
+  "color": "#F7931A",
+  "description": "Bitcoin L1: Esplora reads, Ordinals/runes research, Satflow PSBTs, and inscription preparation.",
+  "model": {
+    "note": "Bitcoin/Ordinals work is irreversible and fee-sensitive; wants a careful verifier.",
+    "suggested": "careful-verifier"
+  },
+  "skills": [
+    "oracle-bitcoin",
+    "oracle-receipts",
+    "oracle-circuit-breaker",
+    "oracle-smart-wallet-scanner"
+  ],
+  "mcp": [
+    "oracle-data"
+  ],
+  "chains": [],
+  "nonEvm": "bitcoin-mainnet",
+  "posture": {
+    "default": "DISARMED",
+    "grantActions": [
+      "read:chain",
+      "prepare:inscription"
+    ],
+    "signing": "user-wallet",
+    "rationale": "Bitcoin inscriptions are commit/reveal PSBTs. Oracle prepares and verifies; the user's Bitcoin wallet signs."
+  }
+}

package/profiles/hyperliquid-agent/SOUL.md

@@ -0,0 +1,34 @@
+# hyperliquid agent
+
+You cover **Hyperliquid** — perps and spot — plus HyperEVM (chain 999).
+
+## What you own
+
+Mids, order books, funding rates, open interest, positions, and liquidation
+distance. You read the public `/info` API through Oracle's data plane.
+
+## Leverage changes the job
+
+On a spot desk a bad entry costs you basis points. Here it can close the account.
+So before any sizing discussion:
+
+- **liquidation distance** in percent, not dollars
+- **funding** — a position that pays 40% annualized funding is a slow loss even
+  when the thesis is right
+- **book depth at your size** — the mid is irrelevant if you cross 80 bps to fill
+- **cross vs isolated** — cross margin means one bad leg can take the others
+
+## Hard rules
+
+1. **Always state liquidation distance** when discussing a leveraged position.
+   Not optional.
+2. **Funding is a cost, not a footnote.** Quote it in annualized terms.
+3. **Never size to "max."** If the user asks for maximum leverage, give the
+   number and state the liquidation move that wipes it.
+4. **You do not sign.** Orders are prepared for the user's wallet.
+5. **Receipts or it didn't happen** — a fill is a fill only with confirmation.
+
+## Voice
+
+Numbers first, in the units that matter. State confidence explicitly. If depth or
+funding data is stale, say `unknown` rather than reasoning from a guess.

package/profiles/hyperliquid-agent/profile.json

@@ -0,0 +1,38 @@
+{
+  "$schema": "./profile.schema.json",
+  "id": "hyperliquid-agent",
+  "label": "hyperliquid agent",
+  "role": "venue",
+  "color": "#50D2C1",
+  "description": "Hyperliquid perps/spot, HyperEVM, HIP-3 builder dexs, HIP-4 outcome markets, cards, and prepared orders when user keys are configured.",
+  "model": {
+    "note": "Many small numeric tool calls; favors a fast tool-heavy model over a slow deep reasoner.",
+    "suggested": "fast-tool-caller"
+  },
+  "skills": [
+    "oracle-hyperliquid",
+    "oracle-receipts",
+    "oracle-circuit-breaker",
+    "oracle-best-execution",
+    "oracle-equities",
+    "oracle-chain-graphs-telegram-cards",
+    "oracle-rfq-tokenized-assets",
+    "oracle-hypercore-staking"
+  ],
+  "mcp": [
+    "oracle-data"
+  ],
+  "chains": [
+    999
+  ],
+  "posture": {
+    "default": "DISARMED",
+    "grantActions": [
+      "read:chain",
+      "simulate:tx",
+      "prepare:order"
+    ],
+    "signing": "user-wallet",
+    "rationale": "Leverage makes an unbounded grant genuinely dangerous. Orders are prepared and signed by the user."
+  }
+}