feat(autonomi): land the task-routed prototype (0.1.4 install/freshness repair)

.claude-plugin/marketplace.json

@@ -0,0 +1,24 @@
+{
+  "name": "withautonomi",
+  "owner": {
+    "name": "Autonomi",
+    "url": "https://autonomi.com"
+  },
+  "plugins": [
+    {
+      "name": "autonomi",
+      "source": "./",
+      "description": "Read from, store on, build on and run the Autonomi network — permanent, accountless, encrypted data storage with free reads. The agent never sees a wallet key.",
+      "version": "0.1.4",
+      "author": {
+        "name": "Autonomi",
+        "url": "https://autonomi.com"
+      },
+      "homepage": "https://developers.autonomi.com",
+      "repository": "https://github.com/WithAutonomi/skills",
+      "license": "MIT OR Apache-2.0",
+      "keywords": ["autonomi", "storage", "permanent-storage", "decentralised-storage", "content-addressed", "ant"],
+      "category": "development"
+    }
+  ]
+}

.claude-plugin/plugin.json

@@ -0,0 +1,13 @@
+{
+  "name": "autonomi",
+  "description": "Read from, store on, build on and run the Autonomi network — permanent, accountless, encrypted data storage with free reads. The agent never sees a wallet key.",
+  "version": "0.1.4",
+  "author": {
+    "name": "Autonomi",
+    "url": "https://autonomi.com"
+  },
+  "homepage": "https://developers.autonomi.com",
+  "repository": "https://github.com/WithAutonomi/skills",
+  "license": "MIT OR Apache-2.0",
+  "keywords": ["autonomi", "storage", "permanent-storage", "decentralised-storage", "content-addressed", "ant"]
+}

.github/SECURITY.md

@@ -2,14 +2,19 @@
 
 ## Scope
 
-This repository is an **operator skill**: documentation and skill files that instruct an AI agent to run and use Autonomi nodes. It builds no custody, key-management, or signing tooling. The posture below reflects that.
+This repository holds the `autonomi` Agent Skill: Markdown instructions an AI agent follows to read from, store on, build on and run the Autonomi network through the upstream `ant` command-line client. It builds no custody, key-management or signing tooling of its own. The posture below reflects that.
 
 ## Security posture
 
-- **Non-custodial by construction.** Nodes are configured with a **public** wallet (rewards) address only. The current skill generates, stores, requests, logs, and transmits no private key, seed phrase, `SECRET_KEY`, or `AUTONOMI_WALLET_KEY` (ADR-0004). Any future spend/custody capability requires a separately approved substrate that keeps secrets outside the agent context; ADR-0004 deliberately leaves that substrate's implementation location open.
-- **No secrets in the repo.** Never commit a private key or secret in code, examples, fixtures, or logs. If one is ever exposed, treat it as compromised: abandon/rotate the affected address and remove the secret from history.
-- **Source-bound, no invented Autonomi surface.** Autonomi-specific commands, flags, constants, figures, and install behaviour carry explicit provenance under ADR-0006; ordinary operating-system/shell observation commands are not presented as Autonomi facts and **must be** reviewed for every claimed platform. The current Windows guidance has known unverified gaps recorded in `planning/HANDOFF.md`. Installs are detect-first and do not mutate an existing working setup by default (ADR-0009). This limits the chance of the skill instructing an unsafe or fabricated action.
-- **Distribution verification is a required target, not a current guarantee.** Upstream releases provide ML-DSA-65 / FIPS-204 signatures and `SHA256SUMS`, but the current script-based install route does not verify them before execution. Until every supported route performs and proves checksum/signature verification, contributors and documentation must not claim verified delivery (ADR-0008).
+- **The agent never sees a private key.** The current prototype has the agent work only with public things — wallet addresses, balances, transaction hashes, and status. It never asks for, accepts, reads, prints, logs, transmits, or generates a private key or seed phrase. A paid write needs the wallet's key available to the upstream `ant` tool as `SECRET_KEY`; the person provisions that outside the conversation in the environment where the tool runs, or runs the paid command in their own terminal. This is not an agent-custody substrate. Any future agent-created wallet or custody capability requires a separately approved substrate that keeps secrets outside agent context and provides recovery; ADR-0004 deliberately leaves its location open. If a key appears in agent context by any route, the instruction is to stop, not use or repeat it, and tell the person to create a new wallet and move the funds.
+- **Nodes are non-custodial by construction.** A node is given a public address to be paid into (`--rewards-address`) and nothing else; it cannot spend.
+- **Spending is approved.** Quote, show, wait by default. The person may lift that explicitly within a limit they set, and every spend is still reported.
+- **The token is identified by contract address only**, carried in the skill's *Verified against* table and cross-checked against the official documentation. The agent never names an exchange, bridge, venue, or address from memory.
+- **No secrets in the repo.** Never commit a private key, seed phrase, `SECRET_KEY`, or `AUTONOMI_WALLET_KEY` in code, examples, fixtures, or logs. If one is exposed, treat it as compromised: create a new wallet, move the funds, and remove the secret from history.
+- **Install is detect-first and read-before-run.** The agent uses an existing working `ant` when present. Otherwise it fetches the official installer and reads it before running it (never `curl | sh`), or takes a manual path that verifies the release archive against the published `SHA256SUMS.txt`. Later `ant update` operations verify the release's ML-DSA-65 signature against a key built into the binary. The installer scripts themselves do not verify checksums today; the skill says so rather than claiming otherwise.
+- **Source-bound, with no invented Autonomi surface.** Autonomi-specific commands, flags, constants, figures, and install behaviour carry explicit provenance under ADR-0006. Temporary team-confirmed exceptions are labelled pending upstream authority. Ordinary operating-system and shell behaviour is not presented as an Autonomi fact and must be checked for every claimed platform. The current Windows path is source-read but untested, as recorded in `planning/HANDOFF.md`.
+- **Distribution verification is a required target, not a current guarantee.** Upstream releases provide ML-DSA-65 / FIPS-204 signatures and `SHA256SUMS`, but the script-based install route does not verify them before execution. Until every supported route performs and proves checksum/signature verification, contributors and documentation must not claim universally verified delivery (ADR-0008).
+- **The node-management daemon stays on loopback.** It has no authentication; the skill never exposes it.
 
 ## Reporting a vulnerability
 
@@ -21,7 +26,8 @@ Include what you found, how to reproduce it, and the impact. We'll acknowledge,
 
 ## Especially valuable to report
 
-- Any path where the skill could cause a private key to be generated, stored, logged, or transmitted.
-- Any instruction that would put a key on a node or in a repo, or that overstates custody/spend safety.
-- Invented or unverifiable commands, flags, or figures, or install/uninstall steps that mutate a system unexpectedly.
-- Anything that would break safe distribution — bad metadata or install manifest, or failed signature/checksum verification.
+- Any instruction — or any plausible reading of one — that would lead an agent to request, handle, generate, store, log or transmit a private key or seed phrase.
+- Any path by which a spend could happen without the person's approval, or a public upload without the person choosing public.
+- A venue, address or price the skill could be read as supplying from memory rather than from the verified table or a fetched official page.
+- Invented or unverifiable commands, flags or figures; install or uninstall steps that mutate a system unexpectedly; anything that would make the agent work around a blocked download rather than stop.
+- Anything that would break safe distribution — bad frontmatter, a stale install path, or a failure of the checksum path.

.github/pull_request_template.md

@@ -9,43 +9,47 @@ The aim: a reviewer — human or agent — can understand this PR and sanity-che
 
 ## Description
 
-<!-- The detail: key files/modules touched, decisions made, and what a reviewer should look at first. -->
+<!-- The detail: key files touched, decisions made, and what a reviewer should look at first. -->
 
 ## ADR alignment
 
 <!-- The decisions this rests on or changes — see docs/adr/. -->
 
-- Aligns with: <!-- e.g. ADR-0004 (non-custodial), ADR-0006 (source-binding), ADR-0010 (human register) -->
-- Architectural change? <!-- If yes, this PR must add or update a Proposed ADR, or link the one it implements. Never edit an Accepted ADR — supersede it (docs/adr/README.md). -->
+- Aligns with: <!-- e.g. ADR-0006 (provenance), ADR-0008 (skill-led distribution), ADR-0010 (human register), ADR-0013 (freshness) -->
+- Architectural change? <!-- If yes, this PR must add or update a Proposed ADR, or link the one it implements. Never edit an Accepted ADR — supersede it (docs/adr/README.md). The prototype's known divergence from ADR-0002/0003/0004/0005 is recorded in docs/DESIGN.md; don't widen it silently. -->
 
-## Fits the vision, design & personas
+## Fits the vision, design & the person
 
 <!-- A quick gut-check that we're not drifting from who we serve or what we're building. A short note is enough. -->
 
-- [ ] Consistent with VISION (purpose, audience, principles) and DESIGN.
-- [ ] Considered the operator personas it affects (see DESIGN §13) and the plain-language register / escalation model (ADR-0010).
-- Note: <!-- e.g. "default mode only; no change to human-facing copy" -->
+- [ ] Consistent with VISION (purpose, audience, principles) and the prototype note in DESIGN.
+- [ ] Considered the person on the other end — not necessarily a developer or crypto-literate — and the plain-language register / escalation model (ADR-0010, ADR-0014).
+- Note: <!-- e.g. "reference wording only; no change to what the agent does" -->
 
 ## Security
 
-- [ ] No secrets in the diff — no private key, seed phrase, `SECRET_KEY`, or `AUTONOMI_WALLET_KEY` in code, examples, or logs.
-- [ ] Non-custodial boundary intact — nodes take a public wallet (rewards) address only; nothing instructs putting a key on a node or in the repo (ADR-0004).
-- [ ] Install stays detect-first and does not mutate an existing working setup by default; any download/verify step is documented and source-bound (ADR-0009).
+- [ ] No secrets in the diff — no private key, seed phrase, `SECRET_KEY`, or `AUTONOMI_WALLET_KEY` value in code, examples, or logs.
+- [ ] The key line is intact — the agent never asks for, accepts, reads, prints, transmits, or generates a private key; nodes take a public address only; a paid write uses a `SECRET_KEY` the person provisions outside the conversation, or the person runs the command; a key appearing in context means stop, new wallet, move funds.
+- [ ] Spending stays quote-show-wait by default; public uploads happen only when the person chose public; venues, addresses, and prices come from the verified table or a fetched official page, never memory.
+- [ ] Install stays detect-first and read-before-run (no `curl | sh`) and does not mutate an existing working setup without affirmative remit; any download/verify step is documented and traced (ADR-0009, ADR-0014).
 
 ## Quality & verification
 
-- [ ] Every Autonomi-specific command, flag, constant, figure, and install behaviour has explicit provenance; temporary team-confirmed exceptions are labelled pending upstream authority, and platform-specific shell/OS behaviour is checked rather than guessed (ADR-0006).
+- [ ] Every Autonomi-specific command, flag, constant, URL, figure, and install behaviour has explicit provenance; temporary team-confirmed exceptions are labelled pending upstream authority, and platform-specific shell/OS behaviour is checked rather than guessed (ADR-0006).
 - [ ] `python3 scripts/adr-governance.py` passes.
-- [ ] Gauntlet (for merge-candidate skill changes): clean-context test + adversarial review — <!-- done / not yet / N/A -->
-- [ ] Docs updated (DESIGN / README / references) if a surface or behaviour changed.
+- [ ] Static checks from `planning/TESTING.md` §3 run (spec validation, vocabulary lint, fact check, length).
+- [ ] Gauntlet (for merge-candidate skill changes): clean-context run of the relevant scenario on a real host + adversarial review — <!-- done / not yet / N/A -->
+- [ ] Docs updated (README / DESIGN note / TESTING / HANDOFF) if a surface or behaviour changed.
 
 ## Distribution & metadata
 
-<!-- Only if this touches SKILL.md, the frontmatter, or the install manifest. -->
+<!-- Only if this touches skills/autonomi/. -->
 
-- [ ] Frontmatter valid and complete — name, description, version, license, keywords.
-- [ ] Install manifest (`metadata.openclaw.install`) correct; install and clean-uninstall paths documented; the current signature/checksum verification status is stated accurately, and any implemented verification remains intact (ADR-0008).
-- [ ] Won't break packaging, and should pass distribution-channel security scans (e.g. ClawHub).
+- [ ] Frontmatter valid per agentskills.io — `name` matches the folder, `description` ≤ 1024 chars, `compatibility` ≤ 500, `license`, `metadata.version`.
+- [ ] `skills/autonomi/VERSION`, frontmatter `metadata.version`, `.claude-plugin/plugin.json`, and `.claude-plugin/marketplace.json` were bumped together when a shipped file changed.
+- [ ] The loaded skill component contains only `SKILL.md`, `VERSION`, and `references/` under `skills/autonomi/`; repo-side files possibly cached with a channel package are not loaded as skill instructions; no hard-coded tool version appears outside the dated *Verified against* table.
+- [ ] Supported install/update channels and the current signature/checksum verification status are stated accurately; OpenClaw/ClawHub is not claimed as supported while its installer contract is unmet (ADR-0008).
+- [ ] Expected to pass the skill-directory scanners (no piped installs, no secrets, no service changes); `.claude-plugin/` manifests remain valid if the skill's name or description changed.
 
 ## For reviewers