MuHaven RWA Portfolio (rehearsal)

SKILL.md

---
name: muhaven-rwa-skill
display_name: MuHaven RWA Portfolio
version: 0.1.0
schema_version: "1.0"
description: |
  Confidential real-world-asset (RWA) portfolio agent built on MuHaven's
  Fhenix-CoFHE-encrypted token primitives. Read your encrypted balances,
  stage yield claims, draft buys + claims for human confirmation. Position
  tools NEVER auto-submit — every state-mutating action goes through a
  three-tier confirmation surface (inline button ≤$200, Mini App + 6-digit
  OTP $200-$5K, deep-link passkey >$5K).
license: MIT
homepage: https://muhaven.app
documentation: https://github.com/hasToDev/muhaven/tree/master/packages/openclaw-skill
support: https://github.com/hasToDev/muhaven/issues
authors:
  - name: MuHaven
    email: hello@muhaven.app
    url: https://muhaven.app
maintainers:
  - hello@muhaven.app
keywords:
  - fhe
  - fhenix
  - rwa
  - muhaven
  - openclaw
  - confidential-defi
  - erc-3643
runtime:
  type: node
  node: ">=20"
  entry: dist/index.cjs
permissions:
  network:
    egress_allowlist:
      - https://api.muhaven.app
      - https://muhaven.app
    deny_default: true
  filesystem:
    read: []
    write: []
  process:
    spawn: []
  secrets:
    storage: os_keychain
    references:
      - name: muhaven_jwt
        owner: muhaven-broker
        scope:
          - mcp.read.*
          - mcp.propose.*
mcp:
  bundled: "@muhaven/mcp"
  # Exact version pin — `pnpm pack` rewrites `workspace:*` in package.json
  # to this exact value, which ClawHub consumers resolve from npm. The
  # `verify-subset.ts` triple-match enforces parity between this field,
  # `manifest.json#mcp.bundled_version`, and `packages/mcp/package.json#version`.
  # An earlier `bundled_minor_pin: true` claim was removed 2026-05-11
  # pre-publish review: the runtime + CI gates enforce exact equality,
  # not semver-minor-range; the field name implied a softer pin than the
  # code actually delivered.
  bundled_version: 0.1.2
  toolset_subset:
    - muhaven.read.portfolio
    - muhaven.read.yields
    - muhaven.read.distribution
    - muhaven.read.tokens
    - muhaven.read.audit
    - muhaven.read.protection_coverage
    - muhaven.read.kyc_attestation
    - muhaven.position.buy
    - muhaven.position.claim
    - muhaven.policy.pause
    - muhaven.policy.session_key_status
  toolset_excluded:
    - muhaven.position.sell
    - muhaven.position.rebalance
    - muhaven.policy.set_tier
    - muhaven.policy.audit_export
    - muhaven.issuer.distribute_yield
    - muhaven.issuer.kyc_add
    - muhaven.issuer.kyc_remove
    - muhaven.issuer.unpause_token
    - muhaven.issuer.audit_query
    - muhaven.governance.propose
    - muhaven.governance.cast_vote
  toolset_excluded_reason: |
    Exclusions are deliberate per ADR-C — the OpenClaw surface is
    investor-buy-and-claim, not portfolio-management. `set_tier` requires
    the dashboard passkey ceremony (cannot be a Telegram callback);
    `audit_export` is operator-shaped and lives behind the dashboard.
    `sell` + `rebalance` raise the blast radius of a single misclick on
    a Telegram inline button — defer to Wave 5 once we have soak data.
    `issuer.*` (Wave 4 P7) is issuer-only — the OpenClaw surface is
    investor-facing; issuer flows live on HavenBot in-dashboard +
    standalone `@muhaven/mcp` install.
    `governance.*` (Wave 4 P11) requires the dashboard ConfirmModal +
    cofhe encrypt ceremony, neither of which the Telegram-bot surface
    can drive. Investors who want to vote follow the dashboard flow.
sandbox:
  runtime: nemoclaw
  forward_compat:
    - issue: "openclaw#28298"
      compat_field: permissions
    - issue: "openclaw#28360"
      compat_field: sandbox
publishing:
  registry: clawhub
  trusted_publishing:
    provider: github
    workflow: ".github/workflows/openclaw-skill-publish.yml"
    oidc_audience: "openclaw://clawhub-trusted-publish"
  signing:
    provider: sigstore
    artifact: "muhaven-rwa-skill-{version}.tgz"
    bundle: "muhaven-rwa-skill-{version}.tgz.sigstore"
  required_reviewers: 2
threat_model_ref: "../../development/DEV_WAVE_4/THREAT_MODEL_P0.md"
---

# MuHaven RWA Portfolio — OpenClaw skill

This skill bundles a curated subset of `@muhaven/mcp` plus an OpenClaw-shaped
config bundle. It runs in OpenClaw's NemoClaw runtime (or any MCP host that
honours the manifest's `permissions` block) and connects to the live
MuHaven backend at `https://api.muhaven.app`.

## What it does

- **Reads your encrypted RWA portfolio** — balances stay encrypted with
  Fhenix CoFHE; the skill never sees plaintext.
- **Stages buy + claim intents** for the OpenClaw surface — the skill
  never auto-submits. Every intent emits a structured confirmation
  request to one of three tiers based on amount.
- **Surfaces audit log** for compliance / forensics.
- **`/pause` kill-switch** uninstalls the on-chain `@zerodev/permissions`
  validator within one Arb block.

## What it intentionally cannot do

- Move funds without your passkey. The skill issues unsigned UserOp
  envelopes; signing happens in the `muhaven-broker` daemon (≤$200 inline
  callback) or in your dashboard / Mini App (>$200 tiers).
- Speak to anything outside the egress allowlist. `manifest.json`'s
  `network.deny_default: true` means a tampered binary cannot exfiltrate
  to a third party.
- Read or write your filesystem. `permissions.filesystem.{read,write}: []`.
- Spawn child processes. `permissions.process.spawn: []`.
- Store any secret. JWT lives in `muhaven-broker`'s OS-keychain entry; the
  skill calls the broker over Unix-socket / named-pipe IPC.

## How to install

1. Install plain OpenClaw + ClawHub CLI globally:
   ```bash
   npm install -g openclaw@latest clawhub
   openclaw --version    # confirm install
   clawhub --version
   ```
   (Runtime decision 2026-05-11: plain OpenClaw under
   `sandbox.fallback: host_native`. NemoClaw remains the preferred
   runtime claim in `manifest.json` for forward-compat; today's deploy
   targets plain OpenClaw.)
2. Install the broker daemon **separately as a global** so its bin
   lands on `$PATH` regardless of ClawHub's bin-handling:
   ```bash
   npm install -g @muhaven/mcp@0.1.2
   muhaven-broker --version    # sanity check
   ```
   (ClawHub install resolves the skill's transitive `@muhaven/mcp` dep
   into a runtime-local `node_modules`. The `muhaven-broker` bin may
   not surface on `$PATH` without this separate global install.)
3. Install the skill:
   ```bash
   clawhub install muhaven-rwa-skill@0.1.0
   ```
4. Start the broker daemon: `muhaven-broker` (see `@muhaven/mcp` README).
5. Authenticate: `muhaven-broker login` — opens browser to
   `https://muhaven.app/link?code=XXXX-XXXX`, complete passkey.
6. Optional: link your Telegram account for the `/agent/openclaw/*`
   confirmation surface. From the dashboard `/agent` page → Telegram
   tab → "Link Telegram" → message the bot at `@muhaven_bot` with the
   one-time link code.

## Confirmation tiers

The skill never executes a state-mutating action without a confirmation.
Three tiers based on intent notional (USDC):

| Range | Surface | Why |
|---|---|---|
| **≤ $200** | Telegram inline keyboard "Confirm" button | Low blast radius. Same trust model as a $200 mobile wallet payment — single-tap inline. |
| **$200 – $5,000** | Mini App with 6-digit OTP sent via separate Telegram message | Defends against a chat-stuffing attack where the LLM emits a `Confirm` button users tap on autopilot. OTP is out-of-band. |
| **> $5,000** | Deep-link to dashboard `https://muhaven.app/agent/confirm?intent=…` for passkey signature | Phishing-resistant by construction — WebAuthn RP-ID is bound to the dashboard origin; a Telegram-based MITM cannot complete passkey. |

Tier boundaries are audit-logged in `agent_audit_events` with the
amount-bucket the intent fell into. Investors can lower the boundaries
in the dashboard `/agent` policy tab; they cannot raise them above the
hardcoded ceilings (regulatory + Reg BI Care Obligation).

## Hardening invariants (do NOT relax without audit)

- `permissions.network.deny_default: true` — every new endpoint requires a
  manifest update + signed re-publish.
- `permissions.secrets.storage: os_keychain` — paste-token UX is forbidden.
- `runtime.type: node` — no shell, no Python, no JIT-compiled blob.
- `mcp.toolset_subset` is the only set of tools the skill will dispatch
  to — additions require an ADR + signed re-publish.
- Sigstore signing + GitHub OIDC trusted publishing — long-lived ClawHub
  tokens are not used. ClawHavoc (Feb 2026) precedent.
- `required_reviewers: 2` — single-maintainer publish is rejected at the
  policy gate. Two-maintainer release is the lesson from the Anthropic
  MCP SDK STDIO arbitrary-command CVEs (Apr 2026).

## Tool inventory (subset of `@muhaven/mcp`)

See `manifest.json` and the upstream descriptors in
`@muhaven/mcp/src/tools/descriptions.ts`. The skill only re-advertises
the `mcp.toolset_subset` listed in this frontmatter; descriptor SHA-256
hashes are pinned in `tool-hashes.json` and verified on every skill
load (mcp-context-protector pattern, post-MCPoison).

## Reference docs

- ADR-C in `development/research-docs/WAVE_4_AGENTIC_RESEARCH_RESULT.md`
- `development/DEV_WAVE_4/TOOL_NAMESPACE.md` for the full naming surface
- `development/DEV_WAVE_4/THREAT_MODEL_P0.md` for OWASP LLM + Agentic mappings

## License

MIT. See `LICENSE` in the repository root.