feat: Poa DAO agent — task tools, participation, governance, confirmation & steward#4
Open
RonTuretzky wants to merge 2 commits into
Open
feat: Poa DAO agent — task tools, participation, governance, confirmation & steward#4RonTuretzky wants to merge 2 commits into
RonTuretzky wants to merge 2 commits into
Conversation
Add a poa-tools crate letting the bot read a Poa DAO org's projects/tasks (via the subgraph) and, for authorized operators, create/update/assign/ complete/reject/cancel tasks on-chain against the org's TaskManager. The signing wallet is derived inside the TEE (dstack) by default. Tools crate gains Tool::requires_authorization() + timeout_override(), ToolRegistry::get_definitions_authorized() and ToolExecutor::execute_authorized() to gate privileged tools. signal-bot gains PoaConfig, register_poa_tools() and a per-sender ToolAuthorization gate on ChatHandler. Config under TOOLS__POA__*; see docs/poa-integration.md.
Stage 2 of the Poa agent: the bot becomes a full org member, not just a task scribe. - Participation tools (claim/submit/apply) so the bot can do work and earn PT. - Governance tools: list proposals, create NON-executable polls, vote. - Value-moving actions (complete_task) now require a deterministic !poa-confirm <code> second step — the LLM cannot self-confirm. Backed by a new tools::ConfirmationStore + ToolContext threaded through the executor. - Autonomous board steward: a read-only background loop posting a digest of expired/at-risk claims to a Signal target. tools crate: adds ToolContext, Tool::execute_ctx/requires_confirmation, and ConfirmationStore. Config under TOOLS__POA__* (voting contract, confirm TTL, steward). All new code unit-tested, clippy- and fmt-clean.
RonTuretzky
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Makes the TEE Signal bot a governance-hireable member of a Poa DAO. The bot's signing wallet is derived inside the enclave (dstack) — no key leaves the TEE — reusing the
x402-paymentspattern.Capabilities (
crates/poa-tools)Read (everyone when enabled, via the Poa subgraph): projects, tasks, proposals, wallet info.
Write (allowlisted operators only; on-chain calls to the org's contracts):
Safety (defense in depth)
TOOLS__POA__ENABLEDmaster switch (off by default).TOOLS__POA__ENABLE_WRITES— write tools aren't registered otherwise.TOOLS__POA__AUTHORIZED_SENDERSallowlist — write tools only offered to / executed for allowlisted Signal senders (keyed off the individual sender, even in groups; enforced at offer-time in the registry and in the executor).poa_complete_task, which mints a payout) are staged and require a deterministic!poa-confirm <code>reply from the same sender. The LLM cannot self-confirm.Autonomy
Board steward — an optional read-only background loop that scans the board and posts a digest of expired / at-risk claims to a Signal group. Never sends transactions.
Shared
toolscrate additions (backward compatible)ToolContext,Tool::execute_ctx/requires_authorization/requires_confirmation/timeout_override,ToolRegistry::get_definitions_authorized,ToolExecutor::execute_ctx, and aConfirmationStore.Testing
cargo build(whole workspace) clean.cargo test -p poa-tools -p tools -p signal-botall pass (subgraph parsing viawiremock; units, tool split, confirmation store, steward scan, vote-weight split unit-tested).poa-toolsiscargo fmtclean; edits to existing files kept minimal (no repo-wide reformat).On-chain senders are thin
alloysol!wrappers, meant to be exercised end-to-end against a testnet Poa org (Gnosis) rather than in unit tests.Poa-side (contracts repo)
Granting the bot its permissions — and the endgame:
TEEAgentEligibilityModule, which binds a Hats role to an attested enclave measurement so upgrading the bot's code is a governance event — is documented in themacau-v6contracts repo (docs/SIGSTACK_BOT_INTEGRATION.md,docs/TEE_AGENT_ELIGIBILITY.md).🤖 Generated with Claude Code