feat: deploy-uni-hook skill (Uniswap v4 hook generate+audit+simulate+deploy)

[aaronjmars]

What

Ports the deploy-uni-hook skill (proven on the aeon-uni instance) into canon, plus the dashboard support it needs. Turns a one-line brief into a live Uniswap v4 hook + test pool on any v4 chain.

• Two build modes: pre-audited templates (dynamic / noop / skim) or a from-scratch freeform hook. Hook flags are auto-derived from the generated code and CREATE2-mined (HookMiner) so the address carries the right permission bits.
• Deploy is gated: static audit -> dangerous-pattern scan -> behavioral forge test -> fork simulation. A failure at any gate blocks the broadcast.
• Safe by default: every run is a dry-run (generate, compile, mine, simulate, never broadcast) unless the brief is prefixed arm:.

Mainnet triple-lock

A mainnet broadcast needs all three, or it degrades with a named code:

1. arm: on the brief, and
2. an explicit chain:<mainnet> (never defaulted), and
3. the operator-level HOOK_MAINNET_OK=1 secret.

Testnet (base-sepolia default) needs only arm:. Also enforced pre-broadcast: a funding floor, a MAX_GAS_GWEI ceiling, and a spend cap.

Other hardening (all live-validated on aeon-uni)

• Authenticated Alchemy RPC (falls back to public; RPC_URL override), host-only redaction in logs.
• Deploy receipt: address, decoded hook flags, explorer link, tx hashes.
• Explorer auto-verify with retry/backoff to survive the CREATE2 factory-tx indexing race (immediate post-broadcast verify 404s on mainnet until the internal creation tx is indexed).
• Idempotency: computes the canonical flag-matching CREATE2 address and short-circuits ALREADY_DEPLOYED instead of mining a fresh one.

Dashboard

• Catalog the two new HOOK_* secrets on the Access Keys vault (HOOK_DEPLOYER_PRIVATE_KEY burner, HOOK_MAINNET_OK lock), each with a key glyph so they don't render as a grey initials badge.
• New per-skill run-input hint (varHint): parsed from each SKILL.md var: and shown as help text under the Skill-settings input. General mechanism, no per-slug special-casing; empty for skills that don't set it.

Config

• enabled: false, workflow_dispatch only, Opus-pinned (claude-opus-5) - freeform hook generation is the hard part.
• requires: [HOOK_DEPLOYER_PRIVATE_KEY?, ALCHEMY_API_KEY?, ETHERSCAN_API_KEY?, HOOK_MAINNET_OK?] - all optional; a dry-run needs none.

Runtime wiring (mirrors the vuln-scanner staging pattern)

The skill's ./hook-deploy.sh exits 3 unless a pre-run step stages the toolchain - the claude -p sandbox denies in-run toolchain installs, and an in-run PATH export doesn't survive Claude's per-call fresh shells. So, exactly like vuln-scanner:

• scripts/stage-deploy-uni-hook.sh - a workflow step (full capability) that installs Foundry, builds a v4 project (v4-core + v4-periphery + templates) at $HOOKBUILD_DIR, appends ~/.foundry/bin to $GITHUB_PATH, and copies the key-safe ./hook-deploy.sh + chains.tsv to the repo root. Self-guards to the skill; best-effort (never fails the run).
• aeon.yml workflow - a Stage deploy-uni-hook toolchain step gated on steps.skill.outputs.name == 'deploy-uni-hook', right after the vuln-scanner staging step.
• scripts/skill_mode.sh - grants the write tier the forge / cast / ./hook-deploy.sh bare-names so the sandbox doesn't deny the skill's own tool use.
• .gitignore - the repo-root run-time copies (/hook-deploy.sh, /chains.tsv), which are copies of the templates, never sources.

Validated locally

Canon Actions are disabled, so every relevant CI gate was run by hand and is green:

• ci-apps: dashboard typecheck clean, test 176/176, build clean, apps/cli typecheck clean.
• ci-skills-json / ci-packs-json: regenerated via bin/generate-*-json (66 skills; crypto pack 13 -> 14).
• ci-readme-catalog: OK (summary + full-catalog tables + counts synced).
• ci-skill-category: OK (category: crypto).
• ci-okf: OK (108 concepts conform).
• ci-tests: validate-config 7/7; config invariants CLEAN.
• ci-skill-packs: OK (community registry unaffected).
• ci-tests (workflow + scripts): test_skill_mode.sh ALL PASS, test_skill_requires.sh PASS, actionlint clean on aeon.yml, bash -n clean on both scripts.

Notes for the operator

• The deployer key is a throwaway burner - it only ever holds a small gas float; never fund it with real value or reuse it.
• To run on canon you would set the secrets on the dashboard and flip enabled: true. Mainnet stays locked until HOOK_MAINNET_OK=1 is set explicitly.