Receipts GuardSAFE

🧠 Curated collection of 1209+ best OpenClaw skills — weekly updated by MyClaw.ai

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: receipts-guard
description: ERC-8004 identity, x402 payments, and arbitration protocol for autonomous agent commerce. The three rails for the machine economy.
metadata: {"openclaw":{"emoji":"⚖️","requires":{"anyBins":["node"]},"version":"0.7.1"}}
---

# RECEIPTS Guard v0.7.1 - The Three Rails

> "The rails for the machine economy."

ERC-8004 identity + x402 payments + arbitration protocol. The infrastructure for agent commerce.

**The Three Rails:**
| Rail | Standard | Purpose |
|------|----------|---------|
| **Identity** | ERC-8004 | On-chain agent identity anchoring |
| **Trust** | ERC-8004 Reputation | Arbitration outcomes build reputation |
| **Payment** | x402 | Paid arbitration, automated settlements |

**Local-first. Chain-anchored. Cloud-deployable. Security-hardened.**

## What's New in v0.7.1 (Security Hardening)

- **🔐 HTTP Authentication** - API Key and DID Request Signing
- **🛡️ Authorization Checks** - Counterparty verification for /accept
- **🌐 CORS Hardening** - Configurable origin whitelist (blocked by default)
- **⚡ Rate Limiting** - 100 requests/minute per IP
- **✅ Input Validation** - Payment address, cost, deadline validation

## What's New in v0.7.0

- **⛓️ ERC-8004 Integration** - Anchor identity to Ethereum/Base registries
- **💰 x402 Payments** - Paid arbitration with USDC/ETH
- **☁️ Cloud Deployment** - Dockerfile + Fly.io Sprites support
- **🌐 HTTP Server Mode** - REST API for cloud agents

### From v0.6.0:
- **🪪 Self-Sovereign Identity** - DID-based identity with Ed25519 signatures
- **🔑 Key Rotation** - Old key signs new key, creating unbroken proof chain
- **👤 Human Controller** - Twitter-based recovery backstop

### From v0.5.0:
- **⚖️ Full Arbitration Protocol** - propose → accept → fulfill → arbitrate → ruling
- **📜 PAO (Programmable Agreement Object)** - Canonical termsHash, mutual signatures
- **📊 LPR (Legal Provenance Review)** - Timeline visualization for arbiters

## Quick Start

```bash
# === ARBITRATION FLOW ===

# 1. Create proposal
node capture.js propose "I will deliver API docs by Friday" "AgentX" \
  --arbiter="arbiter-prime" --deadline="2026-02-14"

# 2. Accept proposal (as counterparty)
node capture.js accept --proposalId=prop_abc123

# 3. Fulfill agreement
node capture.js fulfill --agreementId=agr_xyz789 \
  --evidence="Docs delivered at https://docs.example.com"

# --- OR if there's a dispute ---

# 4. Open arbitration
node capture.js arbitrate --agreementId=agr_xyz789 \
  --reason="non_delivery" --evidence="No docs received by deadline"

# 5. Submit evidence (both parties)
node capture.js submit --arbitrationId=arb_def456 \
  --evidence="Screenshot of empty inbox" --type=screenshot

# 6. Issue ruling (as arbiter)
node capture.js ruling --arbitrationId=arb_def456 \
  --decision=claimant --reasoning="Evidence shows non-delivery past deadline"

# 7. View timeline
node capture.js timeline --agreementId=agr_xyz789
```

## Commands

### Identity (v0.6.0)

#### `identity init` - Create Identity
```bash
node capture.js identity init --namespace=remaster_io --name=receipts-guard \
  --controller-twitter=@Remaster_io
```

Creates:
- Ed25519 keypair
- DID document: `did:agent:<namespace>:<name>`
- Human controller configuration

#### `identity show` - Display Identity
```bash
node capture.js identity show [--full]
```

Shows identity summary or full DID document with `--full`.

#### `identity rotate` - Rotate Keys
```bash
node capture.js identity rotate [--reason=scheduled|compromise|device_change]
```

- Old key signs new key (proof chain)
- Old key archived for historical signature verification
- Unbroken chain = same identity

#### `identity verify` - Verify Identity or Signature
```bash
# Verify DID key chain
node capture.js identity verify --did=did:agent:acme:trade-bot

# Verify signature
node capture.js identity verify \
  --signature="ed25519:xxx:timestamp" \
  --termsHash="sha256:abc123..."
```

#### `identity set-controller` - Set Human Controller
```bash
node capture.js identity set-controller --twitter=@handle
```

Links a human controller for emergency recovery.

#### `identity recover` - Emergency Recovery
```bash
node capture.js identity recover --controller-proof=<TWITTER_URL> --confirm
```

Human controller posts recovery authorization, all old keys revoked.

#### `identity publish` - Publish DID Document
```bash
node capture.js identity publish [--platform=moltbook|ipfs|local]
```

#### `identity anchor` - Anchor to ERC-8004 (v0.7.0)
```bash
node capture.js identity anchor --chain=ethereum|base|sepolia
```

Registers identity on-chain to ERC-8004 Identity Registry:
- Requires `RECEIPTS_WALLET_PRIVATE_KEY` environment variable
- Stores transaction hash in DID document
- Mainnet: credibility anchor
- Base: x402-native, lower fees

**Deployed Registries:**
| Chain | Identity Registry | Status |
|-------|-------------------|--------|
| Ethereum | `0x8004A169FB4a3325136EB29fA0ceB6D2e539a432` | Live |
| Sepolia | `0x8004A818BFB912233c491871b3d84c89A494BD9e` | Testnet |
| Base | Coming soon | TBD |

#### `identity resolve` - Resolve DID (v0.7.0)
```bash
node capture.js identity resolve --did=did:agent:namespace:name [--chain=CHAIN]
```

Resolves DID from local storage or on-chain registry.

---

### ERC-8004 Integration (v0.7.0)

The ERC-8004 standard provides three registries for agent trust:

1. **Identity Registry** - NFT-based agent identifiers
2. **Reputation Registry** - On-chain feedback and scores
3. **Validation Registry** - Work verification by validators

RECEIPTS integrates with existing registries while providing superior off-chain agreement lifecycle management.

**Chain Configuration:**
```bash
# Environment variables
export ETHEREUM_RPC=https://eth.llamarpc.com
export BASE_RPC=https://mainnet.base.org
export RECEIPTS_WALLET_PRIVATE_KEY=0x... # Never commit this!
```

---

### x402 Payment Integration (v0.7.0)

x402 enables paid arbitration - arbiters get compensated for their work.

#### Proposal with Payment Ter

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

not all pinned

Secrets in source

none-found

Findings (2)

<key>k5Ey9KFlkqpj+SDkUw+5ED9lTA3En/qUi0zdrydUCH3kMWTE3Eh65NXnFCaxlY2omY2JHnlEoK7Li7oOEvM7eG5VPdcO/sFlMfoCRdnLYdepJ+uLzYwOWR8W4yQVve/clxVFTVRL4DFleKInGdpAxIbHZT2yi4ADAMENls1N1XSLojRuqXePXDeAT/4Mv4TTx0s

ethers, tweetnacl

Gates applied: no_behavioural_pass.