@oracle-agent/oracle 0.24.3 → 0.24.5

package/README.md

@@ -328,6 +328,9 @@ Oracle keeps capability and authorization separate:
 - `ORACLE_AUTONOMOUS_TRADING=1` is direct execution for trusted owner-controlled
   local code only. It is never model/agent authority and should not be framed as
   equivalent to the `oracle-signer` agent-process path.
+- `ORACLE_AUTONOMOUS_MINT=1` is a separate switch for fail-closed NFT mint
+  one-shots only. It does not unlock swaps, bridges, or perps. Trading does not
+  imply mint.
 - A deployment may separately install a same-host, owner-gated EVM executor.
   Oracle must verify that executor before describing bounded EVM execution as
   available. Missing deployment capability means "unavailable here," not

package/dist/assets/protocols/templates/safe-erc20/README.md

@@ -0,0 +1,9 @@
+# safe-erc20
+
+```bash
+forge install foundry-rs/forge-std --no-git
+forge install OpenZeppelin/openzeppelin-contracts@v5.0.2 --no-git
+forge test
+```
+
+Libs are not vendored. Gate auto-installs when missing.

package/dist/assets/protocols/templates/safe-erc20/SECURITY.md

@@ -0,0 +1,16 @@
+# SafeERC20 template security notice
+
+**Not a paid security-firm audit.**
+
+This template is:
+- fixed-supply ERC20
+- Ownable2Step + pause
+- no tax / blacklist / upgrade proxy
+- covered by Foundry unit tests in `test/`
+
+Before mainnet capital:
+1. Keep or expand Foundry tests green
+2. Run static analysis (Slither/Aderyn) if available
+3. Book an independent Solidity auditor for any real TVL
+
+Oracle only prepares unsigned deploys after the JS gate confirms `forge test` passes.

package/dist/assets/protocols/templates/safe-erc20/foundry.toml

@@ -0,0 +1,12 @@
+[profile.default]
+src = "src"
+out = "out"
+libs = ["lib"]
+solc = "0.8.24"
+optimizer = true
+optimizer_runs = 200
+ffi = false
+fs_permissions = [{ access = "read", path = "./" }]
+
+[fmt]
+line_length = 100

package/dist/assets/protocols/templates/safe-erc20/remappings.txt

@@ -0,0 +1,2 @@
+@openzeppelin/contracts/=lib/openzeppelin-contracts/contracts/
+forge-std/=lib/forge-std/src/

package/dist/assets/protocols/templates/safe-erc20/src/SafeERC20.sol

@@ -0,0 +1,53 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.24;
+
+import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
+import {ERC20Burnable} from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Burnable.sol";
+import {ERC20Pausable} from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Pausable.sol";
+import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol";
+import {Ownable2Step} from "@openzeppelin/contracts/access/Ownable2Step.sol";
+
+/**
+ * @title SafeERC20
+ * @notice Opinionated fixed-supply ERC20 for Oracle protocol-builder v1.
+ *
+ * Security posture (templates, NOT a firm audit):
+ * - Fixed supply minted once to `initialHolder` in constructor (no hidden mint).
+ * - Ownable2Step ownership (no single-tx accidental transfer).
+ * - Pausable emergency stop (owner only).
+ * - No transfer tax, no blacklist, no max-tx, no trading cooldown.
+ * - No upgradeability / no proxy.
+ * - Burn optional by holders only (ERC20Burnable).
+ *
+ * This is a reviewed starter template with Foundry tests. It is NOT a paid
+ * security-firm audit. Do not put mainnet TVL on custom forks without one.
+ */
+contract SafeERC20 is ERC20, ERC20Burnable, ERC20Pausable, Ownable2Step {
+    constructor(
+        string memory name_,
+        string memory symbol_,
+        uint256 initialSupply,
+        address initialHolder,
+        address initialOwner
+    ) ERC20(name_, symbol_) Ownable(initialOwner) {
+        require(initialHolder != address(0), "SafeERC20: holder zero");
+        require(initialOwner != address(0), "SafeERC20: owner zero");
+        require(initialSupply > 0, "SafeERC20: supply zero");
+        _mint(initialHolder, initialSupply);
+    }
+
+    function pause() external onlyOwner {
+        _pause();
+    }
+
+    function unpause() external onlyOwner {
+        _unpause();
+    }
+
+    function _update(address from, address to, uint256 value)
+        internal
+        override(ERC20, ERC20Pausable)
+    {
+        super._update(from, to, value);
+    }
+}

package/dist/assets/protocols/templates/safe-erc20/test/SafeERC20.t.sol

@@ -0,0 +1,72 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.24;
+
+import {Test} from "forge-std/Test.sol";
+import {SafeERC20} from "../src/SafeERC20.sol";
+
+contract SafeERC20Test is Test {
+    SafeERC20 internal token;
+    address internal owner = makeAddr("owner");
+    address internal holder = makeAddr("holder");
+    address internal alice = makeAddr("alice");
+    address internal bob = makeAddr("bob");
+
+    uint256 internal constant SUPPLY = 1_000_000 ether;
+
+    function setUp() public {
+        token = new SafeERC20("Safe", "SAFE", SUPPLY, holder, owner);
+    }
+
+    function test_fixedSupply_noHiddenMint() public view {
+        assertEq(token.totalSupply(), SUPPLY);
+        assertEq(token.balanceOf(holder), SUPPLY);
+        assertEq(token.balanceOf(owner), 0);
+    }
+
+    function test_transfer_noTax() public {
+        vm.prank(holder);
+        token.transfer(alice, 100 ether);
+        assertEq(token.balanceOf(alice), 100 ether);
+        assertEq(token.balanceOf(holder), SUPPLY - 100 ether);
+    }
+
+    function test_pause_blocksTransfers() public {
+        vm.prank(owner);
+        token.pause();
+        vm.prank(holder);
+        vm.expectRevert();
+        token.transfer(alice, 1 ether);
+    }
+
+    function test_onlyOwner_canPause() public {
+        vm.prank(alice);
+        vm.expectRevert();
+        token.pause();
+    }
+
+    function test_ownable2Step_requiresAccept() public {
+        vm.prank(owner);
+        token.transferOwnership(alice);
+        // still owner until accept
+        assertEq(token.owner(), owner);
+        vm.prank(alice);
+        token.acceptOwnership();
+        assertEq(token.owner(), alice);
+    }
+
+    function test_burn_reducesSupply() public {
+        vm.prank(holder);
+        token.burn(10 ether);
+        assertEq(token.totalSupply(), SUPPLY - 10 ether);
+    }
+
+    function test_rejectZeroHolder() public {
+        vm.expectRevert(bytes("SafeERC20: holder zero"));
+        new SafeERC20("X", "X", SUPPLY, address(0), owner);
+    }
+
+    function test_rejectZeroSupply() public {
+        vm.expectRevert(bytes("SafeERC20: supply zero"));
+        new SafeERC20("X", "X", 0, holder, owner);
+    }
+}

package/dist/assets/protocols/templates/safe-erc721-drop/README.md

@@ -0,0 +1,3 @@
+# safe-erc721-drop
+
+Fixed, non-upgradeable ERC721 public mint. Dependencies are pinned to OpenZeppelin Contracts 5.0.2 by the Oracle gate. Run `forge test` before review.

package/dist/assets/protocols/templates/safe-erc721-drop/SECURITY.md

@@ -0,0 +1,3 @@
+# SafeERC721Drop security notice
+
+**Not a paid security-firm audit.** Fixed source, immutable cap/treasury/price/wallet cap, sequential public mint, owner-only withdrawal, and no proxy, upgrade hook, or delegatecall. Obtain an independent audit before mainnet use.

package/dist/assets/protocols/templates/safe-erc721-drop/foundry.toml

@@ -0,0 +1,11 @@
+[profile.default]
+src = "src"
+out = "out"
+libs = ["lib"]
+solc = "0.8.24"
+optimizer = true
+optimizer_runs = 200
+ffi = false
+
+[fmt]
+line_length = 100

package/dist/assets/protocols/templates/safe-erc721-drop/remappings.txt

@@ -0,0 +1,2 @@
+@openzeppelin/contracts/=lib/openzeppelin-contracts/contracts/
+forge-std/=lib/forge-std/src/

package/dist/assets/protocols/templates/safe-erc721-drop/src/SafeERC721Drop.sol

@@ -0,0 +1,55 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.24;
+
+import {ERC721} from "@openzeppelin/contracts/token/ERC721/ERC721.sol";
+import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol";
+
+contract SafeERC721Drop is ERC721, Ownable {
+    uint256 public immutable cap;
+    address payable public immutable treasury;
+    uint256 public immutable mintPrice;
+    uint256 public immutable perWalletCap;
+    uint256 public totalMinted;
+    mapping(address => uint256) public mintedBy;
+
+    event Withdrawal(address indexed treasury, uint256 amount);
+
+    constructor(
+        string memory name_,
+        string memory symbol_,
+        uint256 cap_,
+        address treasury_,
+        uint256 mintPrice_,
+        uint256 perWalletCap_,
+        address initialOwner
+    ) ERC721(name_, symbol_) Ownable(initialOwner) {
+        require(cap_ > 0, "cap zero");
+        require(treasury_ != address(0), "treasury zero");
+        require(mintPrice_ > 0, "price zero");
+        require(perWalletCap_ > 0 && perWalletCap_ <= cap_, "wallet cap invalid");
+        cap = cap_;
+        treasury = payable(treasury_);
+        mintPrice = mintPrice_;
+        perWalletCap = perWalletCap_;
+    }
+
+    function mint(uint256 quantity) external payable {
+        require(quantity > 0, "quantity zero");
+        require(totalMinted + quantity <= cap, "collection cap");
+        require(mintedBy[msg.sender] + quantity <= perWalletCap, "wallet cap");
+        require(msg.value == mintPrice * quantity, "wrong payment");
+        mintedBy[msg.sender] += quantity;
+        uint256 first = totalMinted + 1;
+        totalMinted += quantity;
+        for (uint256 tokenId = first; tokenId < first + quantity; tokenId++) {
+            _safeMint(msg.sender, tokenId);
+        }
+    }
+
+    function withdraw() external onlyOwner {
+        uint256 amount = address(this).balance;
+        (bool ok,) = treasury.call{value: amount}("");
+        require(ok, "withdraw failed");
+        emit Withdrawal(treasury, amount);
+    }
+}

package/dist/assets/protocols/templates/safe-erc721-drop/test/SafeERC721Drop.t.sol

@@ -0,0 +1,58 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.24;
+import {Test} from "forge-std/Test.sol";
+import {SafeERC721Drop} from "../src/SafeERC721Drop.sol";
+
+contract SafeERC721DropTest is Test {
+    SafeERC721Drop drop;
+    address owner = makeAddr("owner");
+    address treasury = makeAddr("treasury");
+    address alice = makeAddr("alice");
+
+    function setUp() public {
+        drop = new SafeERC721Drop("Safe", "SAFE", 3, treasury, 1 ether, 2, owner);
+        vm.deal(alice, 10 ether);
+    }
+
+    function testMintPaymentAndWalletCap() public {
+        vm.prank(alice);
+        drop.mint{value: 2 ether}(2);
+        assertEq(drop.balanceOf(alice), 2);
+        vm.prank(alice);
+        vm.expectRevert("wallet cap");
+        drop.mint{value: 1 ether}(1);
+    }
+
+    function testRejectsWrongPayment() public {
+        vm.prank(alice);
+        vm.expectRevert("wrong payment");
+        drop.mint{value: 0.5 ether}(1);
+    }
+
+    function testCollectionCap() public {
+        address bob = makeAddr("bob");
+        vm.deal(bob, 2 ether);
+        vm.prank(alice);
+        drop.mint{value: 2 ether}(2);
+        vm.prank(bob);
+        drop.mint{value: 1 ether}(1);
+        address carol = makeAddr("carol");
+        vm.deal(carol, 1 ether);
+        vm.prank(carol);
+        vm.expectRevert("collection cap");
+        drop.mint{value: 1 ether}(1);
+    }
+
+    function testOnlyOwnerWithdrawsToTreasury() public {
+        vm.prank(alice);
+        drop.mint{value: 1 ether}(1);
+        vm.prank(alice);
+        vm.expectRevert();
+        drop.withdraw();
+        uint256 beforeBalance = treasury.balance;
+        vm.prank(owner);
+        drop.withdraw();
+        assertEq(treasury.balance, beforeBalance + 1 ether);
+        assertEq(address(drop).balance, 0);
+    }
+}

package/dist/assets/protocols/templates/safe-vesting/README.md

@@ -0,0 +1,3 @@
+# safe-vesting
+
+Fixed wrapper around OpenZeppelin Contracts 5.0.2 `VestingWallet`, with beneficiary, start, and duration fixed at construction. The beneficiary remains the OpenZeppelin owner/recipient identity, but ownership transfer and renunciation are permanently disabled. No separate administrator or proxy authority.

package/dist/assets/protocols/templates/safe-vesting/SECURITY.md

@@ -0,0 +1,3 @@
+# SafeVesting security notice
+
+**Not a paid security-firm audit.** This is a fixed OpenZeppelin VestingWallet wrapper. Beneficiary, start, and duration are constructor-set. The beneficiary is the owner/recipient identity required by `VestingWallet`, and the wrapper disables ownership transfer and renunciation. There is no separate administrator, proxy, upgrade, or delegatecall.

package/dist/assets/protocols/templates/safe-vesting/foundry.toml

@@ -0,0 +1,11 @@
+[profile.default]
+src = "src"
+out = "out"
+libs = ["lib"]
+solc = "0.8.24"
+optimizer = true
+optimizer_runs = 200
+ffi = false
+
+[fmt]
+line_length = 100

package/dist/assets/protocols/templates/safe-vesting/remappings.txt

@@ -0,0 +1,2 @@
+@openzeppelin/contracts/=lib/openzeppelin-contracts/contracts/
+forge-std/=lib/forge-std/src/

package/dist/assets/protocols/templates/safe-vesting/src/SafeVesting.sol

@@ -0,0 +1,19 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.24;
+import {VestingWallet} from "@openzeppelin/contracts/finance/VestingWallet.sol";
+
+contract SafeVesting is VestingWallet {
+    error BeneficiaryImmutable();
+
+    constructor(address beneficiary, uint64 startTimestamp, uint64 durationSeconds)
+        VestingWallet(beneficiary, startTimestamp, durationSeconds)
+    {}
+
+    function transferOwnership(address) public pure override {
+        revert BeneficiaryImmutable();
+    }
+
+    function renounceOwnership() public pure override {
+        revert BeneficiaryImmutable();
+    }
+}

package/dist/assets/protocols/templates/safe-vesting/test/SafeVesting.t.sol

@@ -0,0 +1,72 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.24;
+import {Test} from "forge-std/Test.sol";
+import {SafeVesting} from "../src/SafeVesting.sol";
+import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
+
+contract TestToken is ERC20 {
+    constructor() ERC20("Test", "TEST") {}
+
+    function mint(address to, uint256 amount) external {
+        _mint(to, amount);
+    }
+}
+
+contract SafeVestingTest is Test {
+    SafeVesting vesting;
+    address beneficiary = makeAddr("beneficiary");
+    uint64 start;
+
+    function setUp() public {
+        start = uint64(block.timestamp + 100);
+        vesting = new SafeVesting(beneficiary, start, 1000);
+        vm.deal(address(vesting), 10 ether);
+    }
+
+    function testFixedScheduleAndBeneficiary() public view {
+        assertEq(vesting.owner(), beneficiary);
+        assertEq(vesting.start(), start);
+        assertEq(vesting.duration(), 1000);
+    }
+
+    function testBeneficiaryCannotBeChangedOrRenounced() public {
+        vm.startPrank(beneficiary);
+        vm.expectRevert(SafeVesting.BeneficiaryImmutable.selector);
+        vesting.transferOwnership(makeAddr("replacement"));
+        vm.expectRevert(SafeVesting.BeneficiaryImmutable.selector);
+        vesting.renounceOwnership();
+        vm.stopPrank();
+        assertEq(vesting.owner(), beneficiary);
+    }
+
+    function testLinearReleaseSemantics() public {
+        vesting.release();
+        assertEq(beneficiary.balance, 0);
+        vm.warp(start + 500);
+        vesting.release();
+        assertEq(beneficiary.balance, 5 ether);
+        vm.warp(start + 1000);
+        vesting.release();
+        assertEq(beneficiary.balance, 10 ether);
+    }
+
+    function testAnyoneCanTriggerButOnlyBeneficiaryReceives() public {
+        vm.warp(start + 1000);
+        address caller = makeAddr("caller");
+        vm.prank(caller);
+        vesting.release();
+        assertEq(caller.balance, 0);
+        assertEq(beneficiary.balance, 10 ether);
+    }
+
+    function testERC20ReleaseUsesSameSchedule() public {
+        TestToken token = new TestToken();
+        token.mint(address(vesting), 1000 ether);
+        vm.warp(start + 250);
+        vesting.release(address(token));
+        assertEq(token.balanceOf(beneficiary), 250 ether);
+        vm.warp(start + 1000);
+        vesting.release(address(token));
+        assertEq(token.balanceOf(beneficiary), 1000 ether);
+    }
+}

package/dist/assets/skills/oracle-desk-product/SKILL.md

@@ -97,7 +97,7 @@ does not prove npm users receive it. A locally hosted model/data/policy loop doe
 a bundled signer. A merged feature is not public until the npm artifact containing it is
 published and inspected.
 
-**Current verified state as of 2026-08-13:** public npm `@oracle-agent/oracle@0.24.3`
+**Current verified state as of 2026-08-13:** public npm `@oracle-agent/oracle@0.24.5`
 ships the optional encrypted local vault + short-lived loopback signer. Hosted/default
 Oracle stays prepare-only. Self-host after `oracle sign init|import` is **auto-armed**
 for user-initiated actions. Public still charges the disclosed fee card; Administrator