Skip to content

Reposition plugin-tereno as a pre-signature security layer - #9

Merged
RobMartello merged 9 commits into
masterfrom
security-repositioning
Jul 24, 2026
Merged

RobMartello merged 9 commits into
masterfrom
security-repositioning

Conversation

@RobMartello

Copy link
Copy Markdown
Owner

Repositions the plugin from a marketplace/passive-income framing to a pre-signature security layer for ElizaOS agents on Base. The cooperative/earn loop is preserved but demoted to a bottom game-theory section. Tereno's backend stays closed; the plugin + SDK remain the public interface.

What changed (one commit per item)

Verification

  • bun run build clean · bun test 12/12 · dist excludes tests · npm pack ships dist + README + LICENSE + images.

Notes

  • Not published to npm yet (separate step).
  • Hosted Tereno API is Base mainnet-only; Sepolia quickstart is via self-host (documented). Dry-run works with no wallet.
  • Round 2 (separate): additive POST /api/v1/telemetry + admin metrics panel in the Tereno backend.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VbuXSuoo8er83LwCkqhxd5

RobMartello and others added 9 commits July 24, 2026 13:59
…ost/recommendedAction)

Add normalizeVerdict() mapping the raw Tereno CapabilityResult into a stable
TerenoVerdict with decision, riskLevel, reason, exposure (incl. unlimited-approval
flag), cost and recommendedAction. Full raw payload preserved for compatibility.

Closes #3

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VbuXSuoo8er83LwCkqhxd5
- TERENO_FAIL_MODE (closed default): financial checks abort on guard
  failure/timeout/budget-exhaustion; open degrades to review (never auto-sign).
- TERENO_DRY_RUN: validate and shape the flow with no x402 payment.
- TERENO_PREVIEW: free coverage/cost/config preview, no wallet needed.
- Mark check-transaction/contract/change as financial; reorder actions
  security-first, demote the cooperative loop.

Closes #4
Closes #5

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VbuXSuoo8er83LwCkqhxd5
Fire-and-forget POST to /api/v1/telemetry with a strict allowlist: pluginVersion,
walletHash (sha256, never the address), network, event, checkType, completed,
paid, costUsd, cacheHit, repeat, error. Never transmits private keys, prompts,
secrets or tx content. Opt-out via TERENO_TELEMETRY=off. Sends x-tereno-client
attribution header and an init beacon on plugin load.

Closes #6

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VbuXSuoo8er83LwCkqhxd5
Lead with the pre-signature security use case and the standardized verdict;
add a free dry-run quickstart and a network note (hosted Tereno = Base mainnet;
Sepolia via self-host). Move the cooperative/earn loop to a bottom game-theory
section. Remove passive-income/marketplace framing from the top.

Closes #2

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VbuXSuoo8er83LwCkqhxd5
A minimal ElizaOS 'Sentinel' agent that runs a Tereno pre-signature check before
every tx/contract and obeys recommendedAction. Ships character.json, .env.example
and a README; starts in free dry-run (no wallet), with a documented go-live path.

Closes #7

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VbuXSuoo8er83LwCkqhxd5
- Tests (bun): normalizeVerdict, fail-open/closed, telemetry privacy allowlist.
- Extract pure telemetryPayload() + TELEMETRY_KEYS; export failVerdict for tests.
- Exclude *.test.ts from the tsc build; add test script.
- GitHub Actions CI (install, build, test).
- package.json v0.2.0, security-first description + keywords, new pluginParameters
  (fail mode, dry-run, telemetry); ship images/logo.png for the registry.

Closes #8

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VbuXSuoo8er83LwCkqhxd5
Add the Tereno logo (optimized from new_baazar_icon.png, 57KB) at the top of the
README and upgrade to for-the-badge shields + CI/license/fail-closed badges.
Renders on both GitHub and npm. Ships images/logo.png in the package.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VbuXSuoo8er83LwCkqhxd5
@RobMartello
RobMartello merged commit dd01a1b into master Jul 24, 2026
1 check passed
@RobMartello
RobMartello deleted the security-repositioning branch July 24, 2026 18:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment