feat(plugins): Solana Edge Trio — token-risk-check (T0), depin-attest (T1) + shared core (Track E)

[mauyaa]

Summary

Two Solana tool plugins, one shared core, targeting three suggested tracks with depth over breadth:

Track	Component	Custody tier	Secrets held
D — onchain intelligence & safety	plugins/token-risk-check	T0 — Read	RPC key (optional Jupiter API key) at most
C — DePIN & the physical edge ⭐	plugins/depin-attest	T1 — Build	None
E — shared core	crates/zeroclaw-solana-core	n/a (library)	n/a

Neither plugin ever holds a signing key. token-risk-check never mutates state at all. depin-attest returns an unsigned, durable-nonce transaction for a human or the host to sign — it structurally cannot be prompt-injected into naming a different destination, because its arguments have no account-shaped field in the first place.

Both plugins are built on one hand-rolled, zero-solana-sdk core (crates/zeroclaw-solana-core, submitted as the Track E entry, independently cargo test-able with no wasm toolchain), vendored as a self-contained copy inside each plugin's own vendor/ directory so plugins/token-risk-check/ and plugins/depin-attest/ each build standalone.

What it does

• token-risk-check (T0): given a mint, reports mint/freeze authority status, dangerous Token-2022 extensions (permanent delegate, transfer hook, transfer fee, non-transferable), holder concentration, and LP status (via Jupiter's Tokens API v2, best-effort behind an optional key) — a red/amber/green verdict with reasons.
• depin-attest (T1): packages an edge-node sensor/health reading into an unsigned transaction targeting the well-known SPL Memo program, using a durable nonce instead of a recent blockhash — the structural fix for the bounty's own "blockhash expiry in an approval queue" trap, and the nonce doubles as the replay guard.

Verified against the real thing, not just cargo test

Every plugin here was checked against real, unmodified target-application code, not assumed to work from the spec alone:

• Both .wasm components were loaded and executed inside a real wasmtime component-model host built from this repo's own vendored wit/v0.
• token-risk-check made a real wasi:http call to https://api.mainnet-beta.solana.com against a real mainnet Token-2022 mint (PYUSD), independently confirmed live to carry 866 bytes of TLV extension data, and correctly identified its permanent-delegate and transfer-hook extensions from bytes the parser had never seen before.
• Both plugins were installed via the actual zeroclaw-labs/zeroclaw binary's own plugin install/info/list (built locally with plugins-wasm-cranelift) — real production code, zero errors, correct capabilities/permissions reported back.
• token-risk-check was invoked for real inside a live zeroclaw agent turn against Gemini: the model independently decided to call token_risk_check by name with the correct mint argument, and the real WASM component executed inside the real host's tool registry.
• 58 host-run tests across the three components (40 core, 12 token-risk-check, 6 depin-attest), cargo fmt/clippy clean, wasm32-wasip2 --release builds clean for both plugins.

Full transcripts, including the one real interop bug this surfaced (a wasmtime-version-specific linker quirk in a throwaway test harness, unrelated to this repo's pinned wasmtime = "45.0.3"), are in each plugin's own README.

Threat model / prompt injection

Each plugin's README carries a required prompt-injection transcript demonstrating fail-closed behavior — malformed or attacker-controlled arguments (a malicious "mint" string, a smuggled account override) are rejected before any network call or transaction is built, never silently coerced.

What fought us on wasm32-wasip2

Detailed per-crate in crates/zeroclaw-solana-core's own README and each plugin's README — short version: solana-sdk/solana-client don't target wasm32-wasip2 at all, so the core hand-rolls base58, borsh, versioned-transaction construction, and durable-nonce handling, differentially tested against the real spl-token-2022 and solana-short-vec crates (dev-only deps, never shipped in the wasm binary) rather than trusted blind.

What's next

• A real DePIN sensor source for depin-attest, wired end-to-end: plugins/depin-attest/README.md now has a wiring diagram and a real cron.jobs SOP config chaining the host's actual gpio_read peripheral tool into depin_attest — verified against zeroclaw-hardware's real source. What's not done is running it against physical Pi hardware (this was built on a machine with none, and rppal is Linux-only by design).
• Demo video and X thread to follow.

Note on crates/zeroclaw-solana-core

This repo has no top-level crates/ convention, so this directory is included for direct review as the Track E entry (cd crates/zeroclaw-solana-core && cargo test, no wasm toolchain needed) — the copies actually used by the two plugins live in their own vendor/ directories and are byte-identical snapshots of it, not forks. Happy to drop the top-level copy if maintainers would rather review it purely through the vendored copies.