{"id":50312473,"url":"https://github.com/keep-starknet-strange/starkclaw","last_synced_at":"2026-05-28T22:01:46.976Z","repository":{"id":338262481,"uuid":"1156993847","full_name":"keep-starknet-strange/starkclaw","owner":"keep-starknet-strange","description":"Starknet mobile agent wallet built for bounded delegation: session keys, policy guardrails, and audit trails.","archived":false,"fork":false,"pushed_at":"2026-03-06T13:55:16.000Z","size":61168,"stargazers_count":8,"open_issues_count":9,"forks_count":4,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-03-06T14:52:37.414Z","etag":null,"topics":["agentic-commerce","openclaw","starknet"],"latest_commit_sha":null,"homepage":"","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/keep-starknet-strange.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"agents.md","dco":null,"cla":null}},"created_at":"2026-02-13T09:52:16.000Z","updated_at":"2026-03-06T13:49:27.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/keep-starknet-strange/starkclaw","commit_stats":null,"previous_names":["keep-starknet-strange/starkclaw"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/keep-starknet-strange/starkclaw","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/keep-starknet-strange%2Fstarkclaw","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/keep-starknet-strange%2Fstarkclaw/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/keep-starknet-strange%2Fstarkclaw/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/keep-starknet-strange%2Fstarkclaw/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/keep-starknet-strange","download_url":"https://codeload.github.com/keep-starknet-strange/starkclaw/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/keep-starknet-strange%2Fstarkclaw/sbom","scorecard":{"id":1244439,"data":{"date":"2026-03-06T13:49:36Z","repo":{"name":"github.com/keep-starknet-strange/starkclaw","commit":"cc8d121d0ce95eac0dbc28752f7601887a1fa2bc"},"scorecard":{"version":"v5.3.0","commit":"c22063e786c11f9dd714d777a687ff7c4599b600"},"score":6.8,"checks":[{"name":"Code-Review","score":5,"reason":"Found 9/17 approved changesets -- score normalized to 5","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#code-review"}},{"name":"Dependency-Update-Tool","score":10,"reason":"update tool detected","details":["Info: detected update tool: Dependabot: .github/dependabot.yml:1"],"documentation":{"short":"Determines if the project uses a dependency update tool.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#dependency-update-tool"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#packaging"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#dangerous-workflow"}},{"name":"Maintained","score":0,"reason":"project was created within the last 90 days. Please review its contents carefully","details":["Warn: Repository was created within the last 90 days."],"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#maintained"}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Info: Found linked content: SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#security-policy"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#binary-artifacts"}},{"name":"Token-Permissions","score":10,"reason":"GitHub workflow tokens follow principle of least privilege","details":["Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql.yml:19","Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:20","Info: jobLevel 'contents' permission set to 'read': .github/workflows/signer-client.yml:35","Info: jobLevel 'contents' permission set to 'read': .github/workflows/signer-client.yml:72","Info: topLevel 'contents' permission set to 'read': .github/workflows/ci.yml:10","Info: topLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:12","Info: topLevel 'contents' permission set to 'read': .github/workflows/dependency-review.yml:8","Info: topLevel permissions set to 'read-all': .github/workflows/scorecard.yml:11","Info: topLevel 'contents' permission set to 'read': .github/workflows/session-parity-audit.yml:14","Info: topLevel 'contents' permission set to 'read': .github/workflows/session-signature-v2-conformance.yml:23","Info: topLevel 'contents' permission set to 'read': .github/workflows/signer-client.yml:27","Info: topLevel 'contents' permission set to 'read': .github/workflows/spec-conformance-dispatch.yml:26","Info: topLevel 'contents' permission set to 'read': .github/workflows/spec-conformance.yml:31","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#token-permissions"}},{"name":"Pinned-Dependencies","score":5,"reason":"dependency not pinned by hash detected -- score normalized to 5","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/keep-starknet-strange/starkclaw/ci.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/keep-starknet-strange/starkclaw/ci.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/keep-starknet-strange/starkclaw/ci.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/keep-starknet-strange/starkclaw/ci.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/keep-starknet-strange/starkclaw/ci.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/session-parity-audit.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/keep-starknet-strange/starkclaw/session-parity-audit.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/session-parity-audit.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/keep-starknet-strange/starkclaw/session-parity-audit.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/session-parity-audit.yml:68: update your workflow using https://app.stepsecurity.io/secureworkflow/keep-starknet-strange/starkclaw/session-parity-audit.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/signer-client.yml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/keep-starknet-strange/starkclaw/signer-client.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/signer-client.yml:43: update your workflow using https://app.stepsecurity.io/secureworkflow/keep-starknet-strange/starkclaw/signer-client.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/signer-client.yml:61: update your workflow using https://app.stepsecurity.io/secureworkflow/keep-starknet-strange/starkclaw/signer-client.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/signer-client.yml:76: update your workflow using https://app.stepsecurity.io/secureworkflow/keep-starknet-strange/starkclaw/signer-client.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/signer-client.yml:79: update your workflow using https://app.stepsecurity.io/secureworkflow/keep-starknet-strange/starkclaw/signer-client.yml/main?enable=pin","Warn: downloadThenRun not pinned by hash: .github/workflows/ci.yml:46","Info:  13 out of  24 GitHub-owned GitHubAction dependencies pinned","Info:   1 out of   3 third-party GitHubAction dependencies pinned","Info:   0 out of   1 downloadThenRun dependencies pinned","Info:   3 out of   3 npmCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#pinned-dependencies"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#cii-best-practices"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: MIT License: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#license"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#signed-releases"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#fuzzing"}},{"name":"Vulnerabilities","score":2,"reason":"8 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GHSA-2g4f-4pwh-qvx6","Warn: Project is vulnerable to: GHSA-67mh-4wv8-2f99","Warn: Project is vulnerable to: GHSA-23c5-xmqv-rm74","Warn: Project is vulnerable to: GHSA-3ppc-4f35-3m26","Warn: Project is vulnerable to: GHSA-7r86-cg39-jmmj","Warn: Project is vulnerable to: GHSA-mw96-cpmx-2vgc","Warn: Project is vulnerable to: GHSA-83g3-92jg-28cx","Warn: Project is vulnerable to: GHSA-qffp-2rhf-9h96"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#vulnerabilities"}},{"name":"SAST","score":10,"reason":"SAST tool is run on all commits","details":["Info: SAST configuration detected: CodeQL","Info: all commits (28) are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#sast"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#branch-protection"}},{"name":"Contributors","score":10,"reason":"project has 4 contributing companies or organizations","details":["Info: found contributions from: Web3Arabs, starknet foundation, starkware, web3arabs"],"documentation":{"short":"Determines if the project has a set of contributors from multiple organizations (e.g., companies).","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#contributors"}},{"name":"CI-Tests","score":10,"reason":"19 out of 19 merged PRs checked by a CI test -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project runs tests before pull requests are merged.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#ci-tests"}}]},"last_synced_at":"2026-03-06T14:52:38.094Z","repository_id":338262481,"created_at":"2026-03-06T14:52:38.094Z","updated_at":"2026-03-06T14:52:38.094Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33627943,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-05-28T02:00:06.440Z","response_time":99,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["agentic-commerce","openclaw","starknet"],"created_at":"2026-05-28T22:01:45.744Z","updated_at":"2026-05-28T22:01:46.970Z","avatar_url":"https://github.com/keep-starknet-strange.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Starkclaw\n\nOn-chain safety rails for agentic commerce on Starknet.\n\nStarkclaw is a mobile reference implementation of a simple idea:\n\n**Don't give an AI your wallet. Give it a _session key_ with hard limits, and enforce those limits on-chain.**\n\nWhen you let an \"agent\" sign transactions, prompt-injection isn't a UX problem anymore. It's a custody problem.\nStarknet account abstraction gives us the primitives to put the rules where the money lives: inside the account contract.\n\nThis repo exists to make that concrete, fast: a working vertical slice you can run, fork, and build on.\n\n## Send Your Agent\n\nStarkclaw follows the [BYOA (Bring Your Own Agent)](./BYOA.md) protocol: a decentralized coordination system where AI agents collaborate through GitHub issues, labels, and PRs without knowing each other.\n\n**Give your AI coding agent this single instruction:**\n\n\u003e Clone https://github.com/keep-starknet-strange/starkclaw, read BYOA.md, and execute the protocol. You are an OpenClaw agent.\n\nThat's it. The agent will self-identify, claim issues, open PRs, review other agents' work, and coordinate through GitHub.\nNo setup. No onboarding. No external tooling beyond `gh`.\n\nWorks with Claude Code, Codex, Cursor, or any agent that can run GitHub CLI workflows.\n\n## What Works Today\n\n**Current app mode: Demo (UI-only, fully mocked).**\n\nThe mobile app currently runs in **demo mode** with premium UX:\n- Onboarding flow (agent setup, account creation)\n- Transfer/trading preview + confirmations with policy checks (mocked)\n- Policy editor (caps, allowlists, emergency lockdown)\n- Alerts + inbox + activity timeline\n- Agent proposals (approve/reject) with clear context\n\n**No RPC calls, no wallets, no contract interaction yet.**\nThe UI is production-grade; backend wiring is in progress ([#2](https://github.com/keep-starknet-strange/starkclaw/issues/2)).\n\n## What's Being Built (Live Mode)\n\nThe building blocks for **live Starknet execution** exist in `apps/mobile/lib/` but are still being wired to full user flows:\n\n- Starknet RPC client with retry/fallback\n- Wallet lifecycle (deterministic address, secure storage, deploy flow)\n- Session key policy management (create/register/revoke)\n- Agent transfer execution with on-chain policy enforcement\n- Activity logging with explorer links\n\n**Target MVP** (when live mode is wired):\n- Mobile wallet generates deterministic Starknet account address (fund-first, deploy-later)\n- Deploy AA account from app (Sepolia)\n- Create/register on-chain session key policies:\n  - Expiry window (`valid_after`, `valid_until`)\n  - Per-24h spend cap (`spending_token`, `spending_limit`)\n  - Allowed contract (v1: narrow scope for constrained transfers)\n- Agent screen:\n  - Proposes transfers with deterministic preview\n  - Executes via session key signature enforced by account contract\n  - Demonstrates **on-chain denial** when over cap (not prompt-level rule)\n- Activity log + explorer links\n\nThe point is not \"the AI behaved\".\nThe point is \"the AI _couldn't_ misbehave outside the policy, even if it tried\".\n\n## What This Is Not (Yet)\n\n- Not audited\n- Not wired end-to-end for live Starknet execution (demo-first)\n- Not wired to a production LLM provider by default (agent UX currently deterministic/mocked)\n- Not production-ready for mainnet funds\n\n## How It Works (No Hand-Waving)\n\nStarkclaw uses Starknet session-account lineage (canonical source: `keep-starknet-strange/starknet-agentic/contracts/session-account`) with a split key model:\n\n- **Owner key (master)**:\n  - Deploys the account\n  - Registers / revokes session keys\n  - Emergency revokes all session keys\n- **Session key (delegated)**:\n  - Signs transactions with a policy attached on-chain\n  - Is disposable, time-bounded, and revocable\n\nOn-chain enforcement (in `__execute__`) includes:\n\n- `allowed_contract` (v1): session key calls must target the allowed contract (or zero-address = any)\n- `spending_limit` + 24h window (v1): value-moving ERC-20 selectors are debited on-chain\n  - Includes `transfer`, `approve`, `increase_allowance` variants to block approval-bypass patterns\n\nSignature convention:\n\n- Owner tx signature: `[r, s]`\n- Session key tx signature: `[session_key_pubkey, r, s, valid_until]`\n\nThe policy is the source of truth. The \"agent\" UI is just a safer way to produce intents.\n\n## Security Stack (Defense in Depth)\n\nStarkclaw does not rely on one guardrail. It composes independent controls:\n\n1. On-chain authority boundaries (owner vs delegated key capabilities)\n2. On-chain policy enforcement (targets, windows, spending rules)\n3. Signature-level binding and strict malformed-response rejection\n4. Remote signer hardening in SISNA mode (authenticated requests, strict validation, TLS pinning)\n5. Integration integrity checks (session-account parity checks + deterministic CI gates)\n\nPractical result:\n\n- If a prompt is manipulated, execution is still bounded by contract policy\n- If app-layer logic is buggy, on-chain checks still constrain spending behavior\n- If delegated key path is compromised, scope + revocation limit blast radius\n\nThis is the core power of the stack: **bounded, enforceable authority across layers**, not trust in model behavior.\n\n## Quickstart\n\n### Prereqs\n\n- Node.js + npm\n- Expo Go (fastest iteration)\n- Cairo tooling (for contracts):\n  - Scarb (`scarb`)\n  - Starknet Foundry (`snforge`, `sncast`)\n\n### Install\n\n```bash\nnpm ci --prefix apps/mobile\n```\n\n### Run\n\n```bash\n./scripts/app/dev\n```\n\n### Check (CI Equivalent)\n\n```bash\n./scripts/check\n```\n\n### Contract Tests\n\n```bash\n./scripts/contracts/test\n```\n\n## Running Live Mode (When Available)\n\n**Note:** The app currently runs in demo mode only. Live Starknet execution is being wired in [#2](https://github.com/keep-starknet-strange/starkclaw/issues/2).\n\nOnce live mode is available, the flow will be:\n\n### One-Time: Declare The Account Class\n\nCanonical path (session-account lineage from `starknet-agentic`):\n\n```bash\nSTARKNET_DEPLOYER_ADDRESS=0x... \\\nSTARKNET_DEPLOYER_PRIVATE_KEY=0x... \\\n./scripts/contracts/declare-session-account\n```\n\nNotes:\n- `STARKNET_RPC_URL` is optional\n- You need a funded deployer account for fees\n- `UPSTREAM_SESSION_ACCOUNT_PATH` is optional to override source location\n- `EXPECTED_SESSION_ACCOUNT_CLASS_HASH` is pinned by default; declare fails on mismatch\n- Existing wallets without persisted class-hash metadata remain on legacy hash addressing (no silent remap)\n\nLegacy fallback (migration/debug only, explicitly gated):\n\n```bash\nALLOW_LEGACY_AGENT_ACCOUNT=1 ./scripts/contracts/declare-agent-account\n```\n\n### In The App (Planned)\n\n1. Switch to Live mode in Settings\n2. Home: `Create Wallet`\n3. Home: `Faucet` (fund the displayed address)\n4. Home: `Refresh` until ETH balance is non-zero\n5. Home: `Deploy Account`\n6. Policies: `Create + Register` a session key\n7. Agent: Ask to send tokens and execute\n8. Denial test: Set a tiny cap, try to exceed it, confirm on-chain denial\n\nSee `STATUS.md` for current progress.\n\n## Connected Repositories\n\nStarkclaw is part of a multi-repo system. Key integration surfaces:\n\n1. [`keep-starknet-strange/starknet-agentic`](https://github.com/keep-starknet-strange/starknet-agentic)\n   - Canonical `session-account` lineage source\n   - Consumed through:\n     - `./scripts/contracts/check-session-account-parity.sh`\n     - `./scripts/contracts/declare-session-account`\n     - `UPSTREAM_SESSION_ACCOUNT_PATH`\n\n2. [`omarespejel/SISNA`](https://github.com/omarespejel/SISNA)\n   - Remote signer boundary for session-key signing flows\n   - Consumed through:\n     - `apps/mobile/lib/signer/**`\n     - `keyring-proxy-signer.ts` request auth + strict response checks\n     - transport hardening (TLS pinning + runtime guards)\n   - Production key-custody note:\n     - SISNA currently requires explicit\n       `KEYRING_ALLOW_INSECURE_IN_PROCESS_KEYS_IN_PRODUCTION=true`\n       when running with in-process keys in production.\n     - This is a temporary explicit-risk guard until external KMS/HSM\n       signer backend mode is available.\n\nIntegration rule of thumb:\n\n- Upstream contract/API changes must be reflected in parity checks, signer adapters, and mobile execution wiring before release.\n\n## Repo Layout\n\n- `apps/mobile/`: Expo app (Expo Router)\n- `contracts/`: Starknet account-contract tooling/docs\n- `scripts/`: deterministic commands (CI calls these)\n- `spec.md`: product spec\n- `IMPLEMENTATION_PLAN.md`: milestone plan\n- `STATUS.md`: current state + verification steps\n- `CLAUDE.md`, `agents.md`, `.claude/skills/**`: agentic-native context and skills\n\n## Agentic-Native Development (Yes, On Purpose)\n\nThis repository is structured so AI agents can work effectively without making the project unreviewable:\n\n- `STATUS.md` is the single source of truth for what's next and how to verify\n- `./scripts/check` is the contract between local dev and CI\n- Changes should land as small vertical slices with frequent commits\n- Secrets never belong in commits, logs, or prompts\n\nIf you want to contribute with AI assistance, start with `BYOA.md`, `CLAUDE.md`, and `agents.md`.\n\n## Versioning and Release Policy\n\n- Changelog: `CHANGELOG.md`\n- Versioning policy: `VERSIONING.md`\n\nUntil `1.0.0`, releases are pre-1.0 semantic and include explicit security callouts in release notes.\n\n## Contributing\n\nIf you're excited by \"agents that can spend, but only within guardrails\", we want you here.\n\nHigh-leverage contributions:\n\n- LLM provider adapter + streaming chat (keeping keys out of model context)\n- Better policy UX (multi-target allowlists, selector allowlists)\n- Devnet-first onboarding (lower friction than Sepolia declare/deploy)\n- UI polish (premium \"trustworthy wallet\" feel)\n- Security hardening + tests\n\nWorkflow:\n\n1. Pick an issue (or open one with a crisp problem statement)\n2. Keep PRs small and runnable\n3. Run `./scripts/check` before opening a PR\n4. Update `STATUS.md` when you change the verification story\n\n## Security\n\nThis is experimental software.\n\n- Do not use mainnet funds\n- Do not assume the contract or app is hardened against real adversaries\n- The core security claim is _bounded authority_ via on-chain policy, not \"the agent is safe\"\n\nIf you find a vulnerability, report it responsibly via [SECURITY.md](./SECURITY.md).\n\n## Acknowledgements\n\n- Canonical AA safety-rails lineage: `keep-starknet-strange/starknet-agentic/contracts/session-account`\n- Starknet.js for transaction building and signing\n\n## License\n\nMIT. See `LICENSE`.\n\nValidation: dependency-review live run check (2026-02-14).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkeep-starknet-strange%2Fstarkclaw","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkeep-starknet-strange%2Fstarkclaw","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkeep-starknet-strange%2Fstarkclaw/lists"}