@xpr-agents/openclaw 0.4.2 → 0.4.4

package/README.md

@@ -173,8 +173,17 @@ npm i -g @proton/cli
 # 2. Point at the chain
 proton chain:set proton                  # mainnet (use `proton-test` for testnet)
 
-# 3. Don't have an XPR account yet?
-proton account:create myagent            # or sign up at https://webauth.com
+# 3. Create the agent account (if you don't have one yet).
+#    Most operators: sign up at https://webauth.com — it mints a fresh
+#    account, gives you a 12-word seed phrase, and supports KYC.
+#    Then extract the K1 private key from the seed via:
+#    - https://explorer.xprnetwork.org/wallet/utilities/format-keys
+#      ("Mnemonic to Private Key" section), or
+#    - WebAuth mobile app → Backup Wallet → reveal private key
+#
+#    Alternatively, if you already control a funded XPR account, use:
+#       proton account:create myagent
+#    This creates the account + key pair in one step — no seed extraction.
 
 # 4. Load the key (interactive — pastes are hidden)
 proton key:add                           # paste your PVT_K1_ key; stored encrypted
@@ -192,6 +201,8 @@ proton key:list                          # shows your account + public key
 #   proton key:unlock <your-keychain-password>
 ```
 
+After your first run, lock down the agent's `owner` permission so a leaked active key can't take over the account: `npx @xpr-agents/openclaw xpr-agents-setup-security --account myagent`. Full rationale: [`docs/SECURITY.md`](https://github.com/XPRNetwork/xpr-agents/blob/main/docs/SECURITY.md).
+
 ### Required environment variables
 
 ```env

package/package.json

@@ -1,8 +1,11 @@
 {
   "name": "@xpr-agents/openclaw",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "description": "OpenClaw plugin for XPR Network Trustless Agent Registry - autonomous agent operation, escrow jobs, feedback, and validation",
   "author": "XPR Network",
+  "bin": {
+    "xpr-agents-setup-security": "scripts/setup-security.sh"
+  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/XPRNetwork/xpr-agents.git",

package/scripts/setup-security.sh

@@ -0,0 +1,504 @@
+#!/usr/bin/env bash
+# setup-security.sh — Pillar 2 lockdown for an XPR Agents account.
+#
+# Delegates the agent's `owner` permission to a separate human-controlled
+# account, so even if the agent's active key is compromised the attacker
+# cannot rotate the account away from you.
+#
+# Idempotent: if owner is already controlled by a non-raw-key account
+# permission, exits cleanly with no changes.
+#
+# Refuses to run unattended — TTY required, explicit yes/no on every
+# prompt, type-to-confirm account names, hard-fails on any precondition
+# (account doesn't exist, key not in keychain, etc).
+#
+# See docs/SECURITY.md for the full security model.
+
+set -eu
+
+# ── Colors ─────────────────────────────────────
+if [ -t 1 ]; then
+  RED=$'\033[31m'
+  GREEN=$'\033[32m'
+  YELLOW=$'\033[33m'
+  BOLD=$'\033[1m'
+  NC=$'\033[0m'
+else
+  RED=''; GREEN=''; YELLOW=''; BOLD=''; NC=''
+fi
+
+err()    { printf "${RED}${BOLD}ERROR:${NC} %s\n" "$*" >&2; }
+warn()   { printf "${YELLOW}!${NC} %s\n" "$*"; }
+ok()     { printf "${GREEN}✓${NC} %s\n" "$*"; }
+info()   { printf "  %s\n" "$*"; }
+step()   { printf "\n${BOLD}[%s]${NC} %s\n" "$1" "$2"; }
+abort()  { err "$*"; exit 1; }
+
+# ── Hard preconditions ─────────────────────────
+
+# Require a TTY. We will NOT run this from a pipe, a heredoc, or under
+# automation. The whole point is human-in-the-loop.
+if [ ! -t 0 ] || [ ! -t 1 ]; then
+  err "setup-security.sh requires an interactive terminal."
+  err "Do not pipe input or run this from automation."
+  exit 1
+fi
+
+# Require proton CLI on PATH.
+if ! command -v proton >/dev/null 2>&1; then
+  err "proton CLI not found on PATH."
+  info "Install it: npm i -g @proton/cli"
+  info "Then add the npm global bin to PATH:"
+  info "  export PATH=\"\$(npm config get prefix)/bin:\$PATH\""
+  exit 1
+fi
+
+# Require XPR_ACCOUNT or --account arg.
+AGENT_ACCOUNT="${XPR_ACCOUNT:-}"
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --account) AGENT_ACCOUNT="$2"; shift 2 ;;
+    --help|-h)
+      cat <<'EOF'
+Usage: ./setup-security.sh [--account <agent-account>]
+
+Locks down the agent's `owner` permission so that only a human-controlled
+XPR account can change permissions. Run once per agent. Idempotent.
+
+The agent's `active` key stays in the proton CLI keychain — daily signing
+is unchanged. Only the `owner` permission moves to your human account.
+
+See docs/SECURITY.md for the full rationale.
+EOF
+      exit 0 ;;
+    *) shift ;;
+  esac
+done
+
+if [ -z "$AGENT_ACCOUNT" ]; then
+  err "Agent account not specified."
+  info "Pass --account <name> or set XPR_ACCOUNT in env."
+  exit 1
+fi
+
+# Validate name shape (EOSIO: 1-12 chars, .12345abcdefghijklmnopqrstuvwxyz)
+if ! printf '%s' "$AGENT_ACCOUNT" | grep -qE '^[.1-5a-z]{1,12}$'; then
+  abort "'$AGENT_ACCOUNT' is not a valid XPR Network account name (1-12 chars from .12345a-z)."
+fi
+
+# ── Banner ─────────────────────────────────────
+cat <<EOF
+
+========================================================================
+  ${BOLD}XPR AGENTS — SECURITY SETUP${NC} (Pillar 2: lock down owner)
+========================================================================
+
+  Target agent account: ${BOLD}${AGENT_ACCOUNT}${NC}
+
+  This script will delegate '$AGENT_ACCOUNT's owner permission to a
+  separate human-controlled XPR account. After this:
+
+    • Your human account controls recovery if the agent's key leaks.
+    • The agent's active key stays in the proton CLI keychain — daily
+      signing is unchanged.
+    • The agent's owner permission will have NO raw keys — only your
+      human account can change permissions.
+
+  This is recommended but not automatic. See docs/SECURITY.md for the
+  full security model.
+
+EOF
+
+# ── Step 1: Read current account state ─────────
+step "1/6" "Reading current state for '$AGENT_ACCOUNT'..."
+
+if ! ACCOUNT_JSON=$(proton account "$AGENT_ACCOUNT" --json 2>/dev/null); then
+  # Fallback: --json may not be supported on older proton CLI versions
+  if ! ACCOUNT_OUT=$(proton account "$AGENT_ACCOUNT" 2>&1); then
+    err "Failed to look up account '$AGENT_ACCOUNT'."
+    info "Does the account exist? Check: proton account $AGENT_ACCOUNT"
+    info "Are you on the right chain? Check: proton chain"
+    exit 1
+  fi
+  # No JSON support — fall back to text parsing. Less robust.
+  ACCOUNT_JSON=""
+fi
+
+# Extract permissions. Prefer JSON if available.
+if [ -n "$ACCOUNT_JSON" ]; then
+  OWNER_KEYS=$(printf '%s' "$ACCOUNT_JSON" | node -e "
+    let s=''; process.stdin.on('data',d=>s+=d); process.stdin.on('end',()=>{
+      try {
+        const a = JSON.parse(s);
+        const owner = (a.permissions||[]).find(p=>p.perm_name==='owner');
+        if (!owner) { console.log(''); return; }
+        const keys = (owner.required_auth?.keys||[]).map(k=>k.key);
+        console.log(keys.join(','));
+      } catch(e) { console.log(''); }
+    });
+  " <<< "$ACCOUNT_JSON")
+  OWNER_ACCOUNTS=$(printf '%s' "$ACCOUNT_JSON" | node -e "
+    let s=''; process.stdin.on('data',d=>s+=d); process.stdin.on('end',()=>{
+      try {
+        const a = JSON.parse(s);
+        const owner = (a.permissions||[]).find(p=>p.perm_name==='owner');
+        if (!owner) { console.log(''); return; }
+        const accts = (owner.required_auth?.accounts||[]).map(x=>x.permission.actor+'@'+x.permission.permission);
+        console.log(accts.join(','));
+      } catch(e) { console.log(''); }
+    });
+  " <<< "$ACCOUNT_JSON")
+  ACTIVE_KEYS=$(printf '%s' "$ACCOUNT_JSON" | node -e "
+    let s=''; process.stdin.on('data',d=>s+=d); process.stdin.on('end',()=>{
+      try {
+        const a = JSON.parse(s);
+        const active = (a.permissions||[]).find(p=>p.perm_name==='active');
+        if (!active) { console.log(''); return; }
+        const keys = (active.required_auth?.keys||[]).map(k=>k.key);
+        console.log(keys.join(','));
+      } catch(e) { console.log(''); }
+    });
+  " <<< "$ACCOUNT_JSON")
+else
+  abort "proton account output format not recognized. Update proton CLI: npm i -g @proton/cli"
+fi
+
+info "owner perm keys:     ${OWNER_KEYS:-(none)}"
+info "owner perm accounts: ${OWNER_ACCOUNTS:-(none)}"
+info "active perm keys:    ${ACTIVE_KEYS:-(none)}"
+
+# Idempotency check: if owner has no raw keys, we're already done.
+if [ -z "$OWNER_KEYS" ] && [ -n "$OWNER_ACCOUNTS" ]; then
+  ok "Already secured. owner is controlled by: $OWNER_ACCOUNTS"
+  info "No changes needed. If you want to change the owner-controlling account,"
+  info "run a manual updateauth — see docs/SECURITY.md."
+  exit 0
+fi
+
+if [ -z "$OWNER_KEYS" ]; then
+  abort "owner permission has no keys AND no accounts? This is unusual. Check: proton account $AGENT_ACCOUNT"
+fi
+
+# We have raw keys on owner. Proceed.
+warn "owner permission currently has raw keys. This is the default after account creation."
+warn "If that key leaks, an attacker can rotate you out of your own account."
+
+# ── Step 2: Verify we can sign as <agent>@owner ─
+step "2/6" "Verifying we can sign as ${AGENT_ACCOUNT}@owner..."
+
+KEYLIST=$(proton key:list 2>/dev/null || true)
+MATCHED_OWNER_KEY=""
+IFS=',' read -ra OWNER_KEY_ARR <<< "$OWNER_KEYS"
+for k in "${OWNER_KEY_ARR[@]}"; do
+  if printf '%s' "$KEYLIST" | grep -qF "\"publicKey\": \"$k\""; then
+    MATCHED_OWNER_KEY="$k"
+    break
+  fi
+done
+
+if [ -z "$MATCHED_OWNER_KEY" ]; then
+  err "None of the owner-permission keys are loaded in the proton CLI keychain."
+  info "Owner keys on chain: $OWNER_KEYS"
+  info ""
+  info "Load the owner private key (PVT_K1_...) into the keychain:"
+  info "  proton key:add"
+  info ""
+  info "For WebAuth-created accounts: the K1 backup key is in your wallet"
+  info "(WebAuth → Settings → Backup → reveal key)."
+  exit 1
+fi
+ok "Found matching key for ${AGENT_ACCOUNT}@owner: $MATCHED_OWNER_KEY"
+
+# Determine the K1 we'll put on active. If active is currently a WA key
+# (WebAuth biometric, unusable for autonomous signing), we replace it with
+# the K1 currently on owner. If active is already a K1, we leave it alone.
+NEW_ACTIVE_KEY=""
+ACTIVE_NEEDS_REWRITE="no"
+
+ACTIVE_HAS_WA="no"
+IFS=',' read -ra ACTIVE_KEY_ARR <<< "$ACTIVE_KEYS"
+for k in "${ACTIVE_KEY_ARR[@]}"; do
+  case "$k" in
+    PUB_WA_*) ACTIVE_HAS_WA="yes" ;;
+  esac
+done
+
+if [ "$ACTIVE_HAS_WA" = "yes" ]; then
+  # WebAuth case — must rewrite active to the K1.
+  NEW_ACTIVE_KEY="$MATCHED_OWNER_KEY"
+  ACTIVE_NEEDS_REWRITE="yes"
+  info "active permission is WebAuth-only (PUB_WA_...) — agent can't sign autonomously."
+  info "Will replace active with the K1 currently on owner: $MATCHED_OWNER_KEY"
+elif [ -z "$ACTIVE_KEYS" ]; then
+  err "active permission has no keys. This is unusual — check manually:"
+  info "  proton account $AGENT_ACCOUNT"
+  exit 1
+else
+  # Active already has K1(s). Leave alone.
+  NEW_ACTIVE_KEY="$(printf '%s' "$ACTIVE_KEYS" | cut -d, -f1)"
+  ACTIVE_NEEDS_REWRITE="no"
+  info "active permission already has K1 key: $NEW_ACTIVE_KEY"
+  info "No change to active needed."
+fi
+
+# Verify the K1 we want on active is in the keychain (whether we're
+# rewriting or leaving alone — either way, the agent needs to sign with
+# it daily).
+if ! printf '%s' "$KEYLIST" | grep -qF "\"publicKey\": \"$NEW_ACTIVE_KEY\""; then
+  err "Final active key ($NEW_ACTIVE_KEY) is not in the proton CLI keychain."
+  err "The agent would not be able to sign after this change. Aborting."
+  info "Load the matching PVT_K1_ key first: proton key:add"
+  exit 1
+fi
+ok "Final active key ($NEW_ACTIVE_KEY) is in the keychain."
+
+# ── Step 3: Ask for human account ──────────────
+step "3/6" "Your personal XPR account"
+
+cat <<EOF
+
+  ${YELLOW}This account will control recovery of '$AGENT_ACCOUNT' forever.${NC}
+
+  It MUST be an account you fully control TODAY. Strongly recommended:
+    • KYC-verified (gives the agent +30 trust score via the claim system)
+    • WebAuth-secured (Face ID / fingerprint signing, key never on a server)
+    • Not an account you share with anyone
+    • Not the same account as the agent itself
+
+  Be CAREFUL: a typo here delegates owner to a nonexistent or someone
+  else's account, and you will lose control of '$AGENT_ACCOUNT' forever.
+
+EOF
+
+read -rp "  Your personal XPR account name: " HUMAN_ACCOUNT
+HUMAN_ACCOUNT="$(printf '%s' "$HUMAN_ACCOUNT" | tr -d '[:space:]')"
+
+if [ -z "$HUMAN_ACCOUNT" ]; then
+  abort "No account name given. Aborting."
+fi
+if ! printf '%s' "$HUMAN_ACCOUNT" | grep -qE '^[.1-5a-z]{1,12}$'; then
+  abort "'$HUMAN_ACCOUNT' is not a valid XPR Network account name (1-12 chars from .12345a-z)."
+fi
+if [ "$HUMAN_ACCOUNT" = "$AGENT_ACCOUNT" ]; then
+  abort "The human account cannot be the same as the agent account. That defeats the entire purpose."
+fi
+
+info ""
+info "Looking up '$HUMAN_ACCOUNT' on chain..."
+if ! HUMAN_JSON=$(proton account "$HUMAN_ACCOUNT" --json 2>/dev/null); then
+  err "Account '$HUMAN_ACCOUNT' not found on chain."
+  info "Did you typo it? Verify at:"
+  info "  https://explorer.xprnetwork.org/account/$HUMAN_ACCOUNT"
+  info ""
+  abort "Refusing to delegate owner to a nonexistent account."
+fi
+
+# Extract human account info for display
+HUMAN_BALANCE=$(printf '%s' "$HUMAN_JSON" | node -e "
+  let s=''; process.stdin.on('data',d=>s+=d); process.stdin.on('end',()=>{
+    try {
+      const a = JSON.parse(s);
+      console.log(a.core_liquid_balance || '0 XPR');
+    } catch(e) { console.log('?'); }
+  });
+" <<< "$HUMAN_JSON")
+HUMAN_CREATED=$(printf '%s' "$HUMAN_JSON" | node -e "
+  let s=''; process.stdin.on('data',d=>s+=d); process.stdin.on('end',()=>{
+    try {
+      const a = JSON.parse(s);
+      console.log((a.created || '').slice(0,10) || '?');
+    } catch(e) { console.log('?'); }
+  });
+" <<< "$HUMAN_JSON")
+HUMAN_ACTIVE_KEYS=$(printf '%s' "$HUMAN_JSON" | node -e "
+  let s=''; process.stdin.on('data',d=>s+=d); process.stdin.on('end',()=>{
+    try {
+      const a = JSON.parse(s);
+      const active = (a.permissions||[]).find(p=>p.perm_name==='active');
+      const keys = (active?.required_auth?.keys||[]).map(k=>k.key);
+      console.log(keys.join(',') || '(no raw keys)');
+    } catch(e) { console.log('?'); }
+  });
+" <<< "$HUMAN_JSON")
+
+ok "Account exists"
+info "  Created:           $HUMAN_CREATED"
+info "  XPR balance:       $HUMAN_BALANCE"
+info "  active perm keys:  $HUMAN_ACTIVE_KEYS"
+
+# Warn if human account isn't WebAuth-secured (recommendation, not a block)
+case "$HUMAN_ACTIVE_KEYS" in
+  *PUB_WA_*) info "  ✓ active key is WebAuth (biometric) — good." ;;
+  *) warn "  active key is NOT WebAuth-biometric. This is allowed but weaker." ;;
+esac
+
+# ── Step 4: Critical confirmation ──────────────
+step "4/6" "${BOLD}${RED}CRITICAL CONFIRMATION${NC}"
+
+cat <<EOF
+
+  Open this URL in your browser ${BOLD}right now${NC}:
+      ${BOLD}https://explorer.xprnetwork.org/account/$HUMAN_ACCOUNT${NC}
+
+  Visually verify on the explorer:
+    ☐ The account name is exactly '$HUMAN_ACCOUNT' (no typos)
+    ☐ The balance / activity look like YOUR account
+    ☐ You can sign transactions from this account today
+
+  If ANY of these are wrong, hit ${BOLD}Ctrl+C${NC} now and start over.
+
+  After this script completes, '$AGENT_ACCOUNT' is controlled by '$HUMAN_ACCOUNT'
+  forever — only '$HUMAN_ACCOUNT' can change it back.
+
+EOF
+
+read -rp "  Type the agent account name '${AGENT_ACCOUNT}' to confirm target: " CONFIRM_AGENT
+if [ "$CONFIRM_AGENT" != "$AGENT_ACCOUNT" ]; then
+  abort "Agent account didn't match. Aborting (no changes made)."
+fi
+
+read -rp "  Type the human account name '${HUMAN_ACCOUNT}' to confirm controller: " CONFIRM_HUMAN
+if [ "$CONFIRM_HUMAN" != "$HUMAN_ACCOUNT" ]; then
+  abort "Human account didn't match. Aborting (no changes made)."
+fi
+
+# ── Step 5: Show transaction plan ──────────────
+step "5/6" "Transaction plan"
+
+cat <<EOF
+
+  Will push ONE atomic transaction to '$AGENT_ACCOUNT' with the
+  following updateauth actions:
+
+EOF
+
+if [ "$ACTIVE_NEEDS_REWRITE" = "yes" ]; then
+  cat <<EOF
+  ${BOLD}action 1: active → K1${NC}
+    permission: active
+    parent:     owner
+    threshold:  1
+    keys:       [$NEW_ACTIVE_KEY]
+    accounts:   []
+    (was: $ACTIVE_KEYS)
+EOF
+fi
+
+cat <<EOF
+
+  ${BOLD}action $([ "$ACTIVE_NEEDS_REWRITE" = "yes" ] && echo 2 || echo 1): owner → human account${NC}
+    permission: owner
+    parent:     (root)
+    threshold:  1
+    keys:       []
+    accounts:   [${HUMAN_ACCOUNT}@active]
+    (was raw key: $MATCHED_OWNER_KEY)
+
+  Signed by: ${AGENT_ACCOUNT}@owner (from your proton CLI keychain)
+
+  ${RED}${BOLD}This is irreversible from the agent side.${NC} After this lands,
+  only ${HUMAN_ACCOUNT}@active can change ${AGENT_ACCOUNT}'s permissions.
+
+EOF
+
+read -rp "  Type ${BOLD}'yes I understand'${NC} to proceed (anything else aborts): " FINAL
+if [ "$FINAL" != "yes I understand" ]; then
+  abort "Aborted at final confirmation. No changes made."
+fi
+
+# ── Step 6: Build and push transaction ─────────
+step "6/6" "Pushing transaction..."
+
+# Build the actions array
+ACTIONS_JSON=""
+if [ "$ACTIVE_NEEDS_REWRITE" = "yes" ]; then
+  ACTIONS_JSON="{\"account\":\"eosio\",\"name\":\"updateauth\",\"authorization\":[{\"actor\":\"${AGENT_ACCOUNT}\",\"permission\":\"owner\"}],\"data\":{\"account\":\"${AGENT_ACCOUNT}\",\"permission\":\"active\",\"parent\":\"owner\",\"auth\":{\"threshold\":1,\"keys\":[{\"key\":\"${NEW_ACTIVE_KEY}\",\"weight\":1}],\"accounts\":[],\"waits\":[]}}},"
+fi
+ACTIONS_JSON="${ACTIONS_JSON}{\"account\":\"eosio\",\"name\":\"updateauth\",\"authorization\":[{\"actor\":\"${AGENT_ACCOUNT}\",\"permission\":\"owner\"}],\"data\":{\"account\":\"${AGENT_ACCOUNT}\",\"permission\":\"owner\",\"parent\":\"\",\"auth\":{\"threshold\":1,\"keys\":[],\"accounts\":[{\"permission\":{\"actor\":\"${HUMAN_ACCOUNT}\",\"permission\":\"active\"},\"weight\":1}],\"waits\":[]}}}"
+
+TX_JSON="{\"actions\":[${ACTIONS_JSON}]}"
+
+# Push. Capture both stdout and stderr.
+if ! TX_RESULT=$(proton transaction:push "$TX_JSON" 2>&1); then
+  err "Transaction failed:"
+  printf '%s\n' "$TX_RESULT"
+  err ""
+  err "No permission changes were made (EOSIO transactions are atomic)."
+  err "If this is recoverable, re-run the script. Otherwise check:"
+  info "  proton account $AGENT_ACCOUNT"
+  exit 1
+fi
+
+# Extract tx id from the result (proton CLI prints it)
+TX_ID=$(printf '%s' "$TX_RESULT" | grep -oE '[a-f0-9]{64}' | head -1)
+if [ -n "$TX_ID" ]; then
+  ok "tx $TX_ID submitted"
+else
+  warn "Transaction submitted but tx id not parsed from output."
+  info "Output: $TX_RESULT"
+fi
+
+# Wait a beat for the tx to land
+sleep 3
+
+# Re-fetch and verify end-state
+info ""
+info "Verifying final state..."
+if ! POST_JSON=$(proton account "$AGENT_ACCOUNT" --json 2>/dev/null); then
+  err "Failed to re-fetch account state. Verify manually:"
+  info "  proton account $AGENT_ACCOUNT"
+  info "  https://explorer.xprnetwork.org/account/$AGENT_ACCOUNT"
+  exit 1
+fi
+
+POST_OWNER_KEYS=$(printf '%s' "$POST_JSON" | node -e "
+  let s=''; process.stdin.on('data',d=>s+=d); process.stdin.on('end',()=>{
+    try {
+      const a = JSON.parse(s);
+      const owner = (a.permissions||[]).find(p=>p.perm_name==='owner');
+      const keys = (owner?.required_auth?.keys||[]).map(k=>k.key);
+      console.log(keys.join(','));
+    } catch(e) { console.log(''); }
+  });
+" <<< "$POST_JSON")
+POST_OWNER_ACCOUNTS=$(printf '%s' "$POST_JSON" | node -e "
+  let s=''; process.stdin.on('data',d=>s+=d); process.stdin.on('end',()=>{
+    try {
+      const a = JSON.parse(s);
+      const owner = (a.permissions||[]).find(p=>p.perm_name==='owner');
+      const accts = (owner?.required_auth?.accounts||[]).map(x=>x.permission.actor+'@'+x.permission.permission);
+      console.log(accts.join(','));
+    } catch(e) { console.log(''); }
+  });
+" <<< "$POST_JSON")
+
+if [ -n "$POST_OWNER_KEYS" ]; then
+  err "owner still has raw keys after the change: $POST_OWNER_KEYS"
+  err "Pillar 2 is NOT in place. Investigate via the explorer."
+  exit 1
+fi
+
+if [ "$POST_OWNER_ACCOUNTS" != "${HUMAN_ACCOUNT}@active" ]; then
+  err "owner is not what we expected. Got: $POST_OWNER_ACCOUNTS"
+  err "Investigate via the explorer."
+  exit 1
+fi
+
+ok "owner now controlled by: ${HUMAN_ACCOUNT}@active (no raw keys)"
+ok "Pillar 2 is in place."
+
+cat <<EOF
+
+${GREEN}${BOLD}Done.${NC} '$AGENT_ACCOUNT' is secured.
+
+  • Daily signing: still works (active key is in the proton CLI keychain).
+  • Recovery: signed from ${HUMAN_ACCOUNT}@active if you ever need to rotate active.
+
+  Verify visually:
+    https://explorer.xprnetwork.org/account/$AGENT_ACCOUNT
+
+  Next steps (optional):
+    • Dry-run the recovery: see docs/SECURITY.md → "Optional: test recovery".
+    • Claim the agent via your KYC'd human account for +30 trust score.
+
+EOF

package/skills/xpr-agent-operator/SKILL.md

@@ -208,13 +208,14 @@ When a job involves token swaps, OTC deals, or any financial trade:
 ## Safety Rules
 
 1. **Never reveal private keys** — Your blockchain key lives in the proton CLI's encrypted keychain (loaded once via `proton key:add`) and never enters this process's memory. Do not attempt to read it, dump it, or print it. Recommend operators use a dedicated agent account, not their personal account.
-2. **Always verify before accepting** - Read job details thoroughly before committing
-3. **Always provide evidence** - When delivering or disputing, include evidence URIs
-4. **Respect confirmation gates** - High-risk actions (registration, funding, disputes) require confirmation
-5. **Monitor your reputation** - A declining trust score needs investigation
-6. **Don't over-commit** - Only accept jobs you can realistically complete
-7. **Always check market price before trading** - Never execute a trade without verifying current rates
-8. **Never sell tokens below market rate** - Protect your holdings from bad deals
+2. **Two-pillar security model** — Your account should be secured at two layers: (a) **active key** lives in the proton CLI keychain — you sign every transaction via shell-out (Pillar 1). (b) **owner permission** should point at the operator's separate human XPR account, not a raw key (Pillar 2). If the operator hasn't done Pillar 2, recommend they run `./setup-security.sh` (standalone scaffold) or `npx @xpr-agents/openclaw xpr-agents-setup-security --account <name>` (harness). The boot-time security warning from start.sh will flag this. See `docs/SECURITY.md`.
+3. **Always verify before accepting** - Read job details thoroughly before committing
+4. **Always provide evidence** - When delivering or disputing, include evidence URIs
+5. **Respect confirmation gates** - High-risk actions (registration, funding, disputes) require confirmation
+6. **Monitor your reputation** - A declining trust score needs investigation
+7. **Don't over-commit** - Only accept jobs you can realistically complete
+8. **Always check market price before trading** - Never execute a trade without verifying current rates
+9. **Never sell tokens below market rate** - Protect your holdings from bad deals
 
 ## Tool Quick Reference