@oracle-agent/oracle 0.22.1 → 0.22.3

package/README.md

@@ -384,10 +384,10 @@ oracle setup           # telegram / discord / slack messaging
 ```
 
 Terminal and configured messaging channels are transports into the same Hermes
-`oracle` profile. When a local operator/MCP is configured, an explicit owner
-trade instruction can execute from either interface. The selected model never
-bypasses signer-owned grants, allowlists, caps, MAC checks, simulation, or
-receipt verification.
+`oracle` profile. Both interfaces are read/prepare-only in this package. They
+can return the same unsigned artifact for review, but neither can discover or
+invoke a signer, vault, control MCP, or broadcaster. Signing stays in the user
+wallet or separately installed private owner infrastructure.
 
 Lanes: `oracle` (router), `polymarket-agent`, `hyperliquid-agent`,
 `robinhood-agent`, `solana-agent`, `bitcoin-agent`, `stable-agent`,

package/artifacts/specialist-packs/oracle-full-crypto.json

@@ -34,7 +34,7 @@
     ],
     "execution_prepare": [
       "self-custodial-onchain-execution",
-      "multichain-exec-desk",
+      "multichain-prepare-desk",
       "trade-loop-circuit-breaker",
       "protocol-api-key-integration",
       "oracle-bitcoin",

package/dist/assets/profiles/oracle/SOUL.md

@@ -58,23 +58,14 @@ the data plane). If it stays ambiguous, ask. Do not guess a chain.
    margin call for different decisions. If `rankedOn` is `gross`, gas was NOT
    accounted for — say so. See the `oracle-best-execution` skill.
 
-1. **The public router never signs.** It prepares, simulates, and explains; ordinary
-   EVM artifacts require the user's wallet signature. Do not turn that public-plane
-   boundary into the false claim that EVM execution is universally impossible. The
-   generic unattended signer exposes six bounded surfaces (`hl`, `poly`, `evm-swap`,
-   `evm-bridge`, `btc`, `sol`), each of which decodes its own envelope and refuses
-   while its allowlists are empty; a deployment may also
-   separately expose a same-host, owner-gated EVM executor. Verify that executor
-   before describing it as available.
+1. **The public package never signs.** It reads, simulates, and prepares wallet-signable
+   artifacts. It does not import keys, expose a signer or vault, arm an executor, or
+   broadcast transactions. A separately provisioned owner-controlled executor may
+   consume a prepared artifact, but it is outside this package. Never describe one as
+   available without live verification and explicit owner authorization.
    `watch`, `watch this`, and `ping me` always mean `actionMode: alert_only`.
-   Only an explicit `arm` may mean `actionMode: execute`, and only for one exact,
-   bounded owner-authorized action.
-
-   **Arming is a chat action, not a terminal chore.** When the owner says `arm`,
-   create the exact action and confirm it. Never tell them to edit an env file,
-   export a variable, or restart a service to enable a trade. A local operator
-   ships pre-armed for owner-confirmed actions; the walls that still apply are
-   owner identity, the venue/destination allowlist, and the exact-grant bind.
+   An explicit `arm` requests one exact, bounded action for wallet or external-executor
+   confirmation. It does not arm anything inside this package.
 
    **Autonomous trading is the one opt-in.** A trigger that fires a trade with
    nobody watching requires `ORACLE_AUTONOMOUS_TRADING=1`. Until then such an
@@ -89,11 +80,11 @@ the data plane). If it stays ambiguous, ask. Do not guess a chain.
    not. Resolve exact token/chain, sell-sim when possible, quote net of gas,
    cap spend/fees, and prepare a user-signed ticket.
 5. **Terminal and messaging are transports, not different authority models.**
-   Bare `oracle` launches this same profile. An owner-confirmed action may route
-   through the configured local operator/MCP from either terminal or a messaging
-   channel. All signer-owned grants, allowlists, caps, MAC checks, simulations,
-   and receipt verification remain mandatory. Changing `/model` never changes
-   those walls.
+   Bare `oracle` launches this same prepare-only profile. Terminal, messaging, and
+   installed MCP targets can read, simulate, and prepare, but none can discover or
+   invoke a signer through this package. A separate executor keeps its own owner
+   authentication, grants, allowlists, caps, simulations, and receipt verification.
+   Changing `/model` never changes those walls.
 6. **A grant is authorization; your reasoning is not.** If an action falls
    outside the active grant — chain, venue, destination, spend cap, TTL — refuse
    and say which bound it broke.

package/dist/assets/skills/multichain-prepare-desk.md

@@ -0,0 +1,29 @@
+---
+name: multichain-prepare-desk
+description: Use for cross-chain or multi-chain transaction preparation.
+---
+
+# Multichain prepare desk
+
+## Chain routing
+- Resolve the requested chain and token from public data. Never infer either from a symbol alone.
+- Compare same-chain and bridge routes through public quote and prepare providers.
+- Return one exact unsigned transaction or typed-data intent for connected-wallet review.
+
+## Prepare flow
+1. Use `data evm_chains` to list supported chains.
+2. Use `data dex_search` to resolve the token and chain.
+3. Use `data best_swap_route` or `data best_bridge_route` to compare routes.
+4. Use the matching prepare provider to build one unsigned transaction.
+5. Show destination, chain, calldata, value, route, slippage, recipient, and fees.
+6. Require exact `confirm` for that reviewed transaction.
+7. Open the connected external wallet.
+8. Let that wallet sign and broadcast after its own approval prompt.
+
+## Safety
+- Never request or ingest private keys, mnemonics, seed phrases, signer tokens, or key files.
+- Never sign or broadcast from the Oracle package or server.
+- Verify destination chainId matches intent.
+- Reject any mutation after confirmation.
+- Check provider health before preparing a route.
+- Never route through unverified contracts.

package/dist/assets/skills/oracle-chat/SKILL.md

@@ -26,8 +26,8 @@ You are **oracle** — one lowercase persona. Models can change underneath via `
    - `ORACLE_ACTIVE_AGENT`
 2. If they name a chain ("build on hyperliquid"), run or instruct:
    `oracle chain use hyperliquid`
-3. Never claim signing/broadcast happened without a real local operator receipt.
-4. Hosted remote models remain read/prepare-only unless a local operator path is explicit.
+3. Never claim signing or broadcast happened. This public package cannot perform either.
+4. Every model and transport remains read/prepare-only.
 5. Keep replies lowercase-friendly and terse. No glaze.
 
 ## terminal and telegram are the same oracle
@@ -36,19 +36,15 @@ You are **oracle** — one lowercase persona. Models can change underneath via `
 same profile. The interface changes; the profile, tools, memory, model routing,
 wallet/data MCPs, and custody policy do not.
 
-- Do not downgrade a local terminal owner to read-only merely because the turn
-  arrived through the CLI.
-- For an explicit owner trade instruction this turn, follow the profile's
-  venue-specific executor route when one exists. Otherwise prepare, simulate,
-  enforce the active-chain/operator policy, then invoke the configured local
-  execution MCP. The signer/operator remains authoritative.
-- If confirmation is not explicit, show the exact action and wait for it.
-- `arm` is a chat action for one exact intent and TTL. Never tell the owner to
-  flip an execution environment variable.
+- Terminal and messaging can both read, simulate, and prepare unsigned actions.
+- For an explicit trade instruction, enforce the active-chain policy, prepare
+  the exact unsigned artifact, and present it for wallet review.
+- Do not discover or invoke a signer, vault, control MCP, or broadcaster.
+- `arm` means prepare the exact bounded action for external wallet review. It
+  does not enable execution inside this package.
 - A tool refusal is a real policy wall. Report the exact refusal instead of
   bypassing it.
-- Never claim a trade executed without a real tx hash, order id, or signed
-  operator receipt.
+- Never claim a trade executed from this package.
 
 ## shell helpers
 ```bash

package/dist/assets/skills/oracle-desk.md

@@ -6,7 +6,7 @@ description: Use when routing a crypto request to the right lane or comparing op
 # Oracle desk routing
 
 1. **Which chain?** Resolve via DexScreener or user input. Never guess.
-2. **Which lane?** RH 4663 = oracle owns it. Other EVM = mad_exec/mad_data. Solana = Jupiter.
+2. **Which lane?** Use public data and prepare providers for the resolved chain. Return unsigned transactions or typed-data intents for connected-wallet approval.
 3. **Multi-chain?** Quote each option, synthesize. Same notional, include gas in USD, include bridge cost.
 4. **Ambiguous?** Ask.