tx-preflight: simulate a Solana transaction and report its observed effect

[ace-coderr]

Draft — opening early for visibility while the builder plugins land.

What this is

A T1 tool plugin that answers one question before a human approves a
transaction: what will this actually do?

An agent that builds a transaction and asks for approval hands the human a
description the model wrote. Poison the model and the approval card reads
"refund the customer 25 USDC" while the bytes underneath move 2,140 and install
a delegate. tx-preflight simulates against the operator's own RPC and reports
the observed effect — net amounts, authority grants, accounts closed — checked
against limits declared in config.

Holds no key. Signs nothing. Submits nothing.

Notes for reviewers

First tool plugin to declare http_client. Every HTTP plugin in the repo
is a channel, and redact-text makes no network calls, so this path had never
been exercised. It works: runtime.rs::create_plugin calls
with_granted_http() and selects tool_linker_http(). Flagging it in case
that was unintentional.

Guardrails live in __config, deliberately. The wallet being protected,
the RPC endpoint, and every spending limit are read from the injected config,
never from execute args — the runtime strips caller-supplied __config
first, so a poisoned agent cannot name its own wallet and collect a clean PASS
on a drain. There's a test for that.

solana-sdk doesn't build for wasm32-wasip2 inside a WIT component, so the
wire format is parsed by hand in cupel-core
(MIT/Apache-2.0, no path deps): legacy and v0 messages, address lookup tables,
SPL Token and Token-2022 layouts. 81 tests, all offline. Reusable by other
plugins in this repo.

Fails closed everywhere. Unverifiable and malicious produce the same
verdict word. Output is capped at ~160 tokens.

Status

• tx-preflight — host tests, both clippy gates, wasm32-wasip2 release build
• spl-transfer-build
• solana-pay-request
• README with prompt-injection transcript
• Demo video

Built against wit/v0 at e112ce6. Happy to rebase if the ABI moves.