feat(plugins): Solana DePIN node — solana-core + depin-attest + depin-uptime-watch

.gitignore

@@ -4,4 +4,21 @@ zeroclaw/
 __pycache__/
 *.pyc
 target/
+.tmp-target/
 *.wasm
+.superpowers/
+
+# Demo secrets + local runtime (never commit)
+demo/keys/
+demo/*.mp4
+demo/recording/
+demo/.env
+demo/zeroclaw-config/config.toml
+demo/zeroclaw-config/.secret_key
+demo/zeroclaw-config/data/
+demo/zeroclaw-config/plugins/
+demo/dist/
+.env
+.env.*
+!.env.example
+!demo/.env.example

SUBMISSION.md

@@ -0,0 +1,79 @@
+# Superteam Earn — submission pack
+
+**Bounty:** Build Solana-native plugins for Zeroclaw (Superteam Brasil)  
+**Author:** darkty0x  
+**Tracks:** C (DePIN) + E (shared `solana-core`)
+
+## Links (paste into Earn)
+
+| Deliverable | URL / path |
+| --- | --- |
+| **PR (primary)** | https://github.com/zeroclaw-labs/zeroclaw-plugins/pull/126 |
+| **Public fork / branch** | https://github.com/darkty0x/zeroclaw-plugins/tree/feat/solana-depin-core |
+| **Demo video (≤3 min)** | `~/Desktop/zeroclaw-depin-demo.mp4` (~2:25 — terminal attest/sign/submit + Telegram channel scenes + explorer). Upload to Drive/YouTube/Streamable, then paste URL |
+| **Telegram bot (live channel)** | https://t.me/zeroclaw_plugin_bot |
+| **On-chain proof (devnet)** | https://explorer.solana.com/tx/3vY2Q2aEn9YWy7T9H4JaD1VBdCPhmkn16W9Ukf3wSWZsRwmPnV2WFd3A762yiH7N3NPE7wQ8j3QrvjKs5NGoP5CE?cluster=devnet |
+
+## One-page write-up
+
+### What we shipped
+
+- `solana-core` — wasm-friendly Solana substrate (no `solana-sdk`): keys, memo ix, durable nonce, injectable JSON-RPC, shaped output helpers.
+- `depin-attest` (**T1**) — unsigned durable-nonce memo attestation from a sensor reading.
+- `depin-uptime-watch` (**T0**) — `OK` / `STALE` / `MISSING` freshness verdict for Telegram cron.
+
+### Custody tier and why
+
+| Plugin | Tier | Why |
+| --- | --- | --- |
+| `depin-attest` | **T1** | Prepares work that still needs a human wallet signature. No private key, no `sendTransaction`. |
+| `depin-uptime-watch` | **T0** | Read-only RPC. Safe to cron into Telegram. |
+
+T2 (agent holds keys / submits) is out of scope on purpose: DePIN uptime should not require trusting the agent with funds.
+
+### Threat model (fail closed)
+
+Malicious chat cannot inject `private_key`, override `payer` / `nonce_account` / `rpc_url`, set absurd readings, or request fund movement (`submit` / `sendTransaction`). Unknown fields refuse before RPC. Executable transcripts: `plugins/*/tests/injection.rs` + README sections.
+
+### What fought us on wasm32-wasip2
+
+`solana-sdk` / `solana-client` are a non-starter inside a WIT component. What worked: `bs58` + `base64` + `sha2` + hand-rolled legacy message / durable-nonce layout, JSON-RPC behind an injectable `HttpClient`, and `waki` only in the wasm shim. Each plugin vendors `solana-core` so isolated CI (`plugins/<name>` + `wit/v0`) still builds. `wit/v0` is experimental (no `.frozen`) — we pin the repo world and expect rebuilds.
+
+### What we'd build next
+
+Pi SOP pack (BME280 → attest → Telegram approve → session-key sign), memo schema v2, fleet watch rollup, optional separate T2 submit crate (never inside these plugins).
+
+### Demo script (≤3 min, no slides)
+
+1. Title + plugin discovery (terminal).  
+2. Terminal: durable-nonce `depin_attest` → human sign/submit → explorer Success.  
+3. **Telegram `@zeroclaw_plugin_bot`:** user asks to attest `pi-greenhouse-7` → agent returns `✅` T1 card (incl. `unsigned_tx_base64`) → uptime watch `🟢 OK`.  
+4. On-chain explorer still.  
+5. Custody close: “T0/T1 only — plugin never held a key.”
+
+Render locally:
+
+```bash
+demo/recording/.venv/bin/python demo/scripts/render-long-demo-video.py \
+  --log demo/recording/depin-demo.txt \
+  --explorer demo/recording/explorer.png \
+  --out demo/recording/zeroclaw-depin-demo-2min.mp4
+```
+
+## Discord / X (tiebreak)
+
+**Discord `#solana-bounty` (or ZeroClaw Discord):**  
+> Opened https://github.com/zeroclaw-labs/zeroclaw-plugins/pull/126 — Track C DePIN + Track E `solana-core`. Durable-nonce attest (T1) + uptime watch (T0). Looking for maintainer eyes on the wasm/vendoring approach.
+
+**X thread starter:**  
+> Shipping Solana DePIN tools for @ZeroClaw: unsigned durable-nonce attestations that survive Telegram approval queues + a T0 uptime watch.  
+> PR: https://github.com/zeroclaw-labs/zeroclaw-plugins/pull/126  
+> No keys in the agent. #Solana #DePIN #ZeroClaw
+
+## Earn checklist
+
+- [ ] PR link submitted  
+- [ ] Demo video URL submitted (≤3 min, real agent + Telegram)  
+- [ ] README / this write-up linked or pasted  
+- [ ] Posted in ZeroClaw Discord  
+- [ ] At least one public X update during the bounty  

demo/.env.example

@@ -0,0 +1,8 @@
+# Copy to demo/.env and fill in
+TELEGRAM_BOT_TOKEN=
+OPENAI_API_KEY=
+# or: ANTHROPIC_API_KEY=
+DEPIN_RPC_URL=https://api.devnet.solana.com
+DEPIN_PAYER=
+DEPIN_NONCE_ACCOUNT=
+DEPIN_PAYER_KEYPAIR=./demo/keys/payer.json

demo/README.md

@@ -0,0 +1,50 @@
+# DePIN demo (local)
+
+Reproduce the Superteam Brasil bounty flow: Telegram → `depin_attest` (T1) → human sign/submit → Explorer → `depin_uptime_watch` (T0).
+
+**Demo video:** https://github.com/darkty0x/zeroclaw-plugins/releases/download/demo-depin-2026-07-22/zeroclaw-depin-demo-2min.mp4
+
+## Layout
+
+| Path | Purpose |
+|---|---|
+| `runner/` | Host e2e: build unsigned tx → sign with payer keypair → submit → uptime |
+| `config.example.toml` | Plugin config fragment (public pubkeys only) |
+| `.env.example` | Env template — copy to `demo/.env` / `demo/keys/env.sh` |
+| `zeroclaw-config/agents/depin/workspace/` | `SOUL.md` / `TOOLS.md` for reliable tool cards |
+
+Local-only (gitignored): `keys/`, `zeroclaw-config/config.toml`, `recording/`, plugin `.wasm` installs.
+
+## Quick start
+
+```bash
+# Keys + env (gitignored)
+cp demo/.env.example demo/.env   # fill DEPIN_* + TELEGRAM_BOT_TOKEN
+# place payer.json + create durable nonce → demo/keys/
+
+source demo/keys/env.sh
+cargo +1.96.1 run --manifest-path demo/runner/Cargo.toml --release
+```
+
+Telegram (with your own ZeroClaw channel + bot token):
+
+```text
+Attest device pi-greenhouse-7 metric temperature reading 21.4 unit celsius
+```
+
+Expect `✅ DePIN attestation ready (T1)`. Then human-submit and:
+
+```text
+Check uptime for pi-greenhouse-7
+```
+
+## Agent knobs
+
+- `channels.show_tool_calls = false`
+- `agents.depin.precheck.enabled = false`
+- Ollama `llama3.2:3b`, `temperature = 0`
+- Workspace `SOUL.md` / `TOOLS.md` — one tool per turn, reply with the card verbatim
+
+## Custody
+
+Plugins are **T0/T1 only**: no keys in the agent, no `sendTransaction` from WASM.

demo/config.example.toml

@@ -0,0 +1,25 @@
+# ZeroClaw plugin config fragments for the DePIN demo
+
+[plugins.entries.depin-attest]
+enabled = true
+
+[plugins.entries.depin-attest.config]
+rpc_url = "https://api.devnet.solana.com"
+payer = "AEwRQB58maXfKWB8tEFegarFK7RPKwcYa9PQbtuAerAo"
+nonce_account = "BnxcNvZjMUX5pJBtCdyGnAPJ1Dwf8QoboAQ6TkTJShwF"
+allowed_metrics = "temperature,humidity,uptime,pressure,air_quality"
+max_abs_reading = "1000"
+
+[plugins.entries.depin-uptime-watch]
+enabled = true
+
+[plugins.entries.depin-uptime-watch.config]
+rpc_url = "https://api.devnet.solana.com"
+payer = "AEwRQB58maXfKWB8tEFegarFK7RPKwcYa9PQbtuAerAo"
+max_age_secs = "900"
+memo_prefix = "ZCDEPIN"
+scan_limit = "25"
+
+[channels_config.telegram]
+bot_token = "REPLACE_ME"
+allowed_users = ["*"]