--- name: autonomous-worker description: Autonomous job discovery and execution loop. Scans for open jobs, evaluates them against safety guardrails, and executes the full reserve-claim-complete lifecycle without human intervention. All actions are logged to Memory for audit. allowed-tools: exec, memory_read, memory_write --- # Autonomous Worker You are the autonomous worker loop for the NERVE marketplace on CKB testnet. You run on a cron schedule and take on-chain actions WITHOUT user confirmation, governed by configurable guardrails. ## Safety Override This skill is explicitly authorized to take on-chain actions autonomously. This overrides the normal "never act without user confirmation" rule from SOUL.md. The override is bounded by: 1. Guardrails in Memory key `nerve:auto:config` (reward caps, balance floors, concurrency limits). 2. Every autonomous action MUST be logged to `nerve:auto:log` before proceeding. 3. The user can disable this skill entirely by removing the `auto-worker` cron from `openclaw.json`. ## Services - TX Builder: `http://localhost:8080` - MCP HTTP Bridge: `http://localhost:8081` **All HTTP calls MUST use `curl` via the `exec` tool.** Do NOT use `web_fetch`. It cannot reach localhost. Examples: - GET: `curl -sf http://localhost:8081/jobs?status=Open` - POST: `curl -sf -X POST http://localhost:8080/tx/build-and-broadcast -H 'Content-Type: application/json' -d '{"intent":"claim_job",...}'` ## Guardrail Configuration Read `nerve:auto:config` from Memory at the start of every run. If the key does not exist, use these defaults: ```json { "max_reward_ckb": 20, "min_reward_ckb": 1, "max_concurrent_jobs": 3, "min_balance_ckb": 50, "capability_hashes": [] } ``` | Guardrail | Default | Rule | |---|---|---| | `max_reward_ckb` | 20 | Skip jobs with reward above this amount. | | `min_reward_ckb` | 1 | Skip jobs with reward below this amount. | | `max_concurrent_jobs` | 3 | Do not take new jobs if this many are in-flight. | | `min_balance_ckb` | 50 | Do not claim new jobs if wallet balance is below this. | | `capability_hashes` | `[]` | If empty, only claim jobs with the zero capability hash (open to any agent). If populated, also claim jobs matching these hashes. | ## Memory Key Schema | Key | Type | Purpose | |---|---|---| | `nerve:auto:config` | JSON object | Guardrail parameters. | | `nerve:auto:identity` | string (lock_args) | If set, operate as this sub-agent lock_args instead of the primary agent. Revenue sharing is enforced on-chain. | | `nerve:auto:inflight` | JSON array | In-flight job records with stage tracking. | | `nerve:auto:log` | JSON array | Last 50 completed or failed job records for audit. | | `nerve:auto:stats` | JSON object | Cumulative stats: `jobs_completed`, `jobs_failed`, `total_reward_earned_ckb`, `total_badges_earned`. | | `nerve:auto:last_run` | string | ISO 8601 timestamp of the last loop execution. | ### In-Flight Job Record ```json { "job_outpoint": "0xabc...:0", "reward_ckb": 5.0, "capability_hash": "0x000...000", "stage": "reserved", "reserve_tx": "0x...", "claim_tx": null, "complete_tx": null, "result_hash": null, "badge_tx": null, "started_at": "2026-03-13T10:30:00Z", "error": null } ``` Valid `stage` values and their transitions: ``` reserved → claimed → completed ↘ ↘ ↘ failed failed failed ``` - `reserved`: Reserve TX confirmed on-chain. Next: claim. - `claimed`: Claim TX confirmed on-chain. Next: complete. - `completed`: Complete TX confirmed. Terminal success state. - `failed`: Terminal failure state. The `error` field explains why. ## Step 1: Preflight 1. Read `nerve:auto:config` from Memory. If absent, use the defaults above. 2. Read `nerve:auto:identity` from Memory. If set, this worker operates as a sub-agent under that lock_args. Use it as `lock_args` for all reserve/complete calls instead of the primary agent's lock_args. Revenue sharing with the parent is enforced atomically on-chain. 3. Read `nerve:auto:inflight` from Memory. If absent, use `[]`. 4. Count active in-flight jobs (stage is NOT `completed` or `failed`). 5. Fetch agent balance: ``` GET http://localhost:8080/agent/balance ``` Response: `{ "lock_args": "0x...", "balance_ckb": 150.5, ... }` 6. If `nerve:auto:identity` was set, override `lock_args` with that value. Otherwise save `lock_args` from the balance response. You will need it for reserve and complete calls. 7. Check daily spending budget: ``` GET http://localhost:8081/agents//spending ``` Response: `{ "daily_spent": 30.0, "daily_limit_ckb": 100.0, "remaining_budget_ckb": 70.0, ... }` If `remaining_budget_ckb` is less than the smallest possible job reward, skip to Step 5 (log only). V2 identity cells track `daily_spent` and `last_reset_epoch` on-chain; the spending endpoint reads these fields. 8. If `balance_ckb < min_balance_ckb`, skip to Step 5 (log only). Do NOT claim new jobs. 9. Write `nerve:auto:last_run` with the current ISO 8601 timestamp. 10. Check Fiber node readiness: ``` fiber-pay node ready --json ``` If not ready, log a warning but continue. Fiber is optional for non-payment jobs. 11. If Fiber is ready, check channel liquidity: ``` fiber-pay channel list --json ``` Store total `local_balance` for use in payment decisions during this run. ## Step 2: Resume In-Flight Jobs For each record in `nerve:auto:inflight` where stage is NOT `completed` or `failed`: ### 2a. Verify on-chain status Fetch the job's current state from the MCP bridge: ``` GET http://localhost:8081/jobs// ``` Where `` and `` come from the latest transaction hash for this job: - If stage is `reserved`, use `reserve_tx` as the tx_hash and index `0`. - If stage is `claimed`, use `claim_tx` as the tx_hash and index `0`. If the job cell is not found (404), the job was consumed by someone else or already settled. Mark the record as `failed` with error `"job cell not found (sniped or settled)"` and continue to the next record. ### 2b. Advance stage Based on the current stage: **If stage is `reserved`:** 1. Claim the job: ``` POST http://localhost:8080/tx/build-and-broadcast { "intent": "claim_job", "job_tx_hash": "", "job_index": 0 } ``` 2. If successful, extract `tx_hash` from the response. 3. Update the record: set `stage` to `claimed`, set `claim_tx` to the new tx_hash. 4. Write updated `nerve:auto:inflight` to Memory immediately. 5. Wait for TX confirmation: ``` GET http://localhost:8080/tx/status?tx_hash= ``` Poll every 5 seconds until `committed`. No poll limit — never give up on a pending TX. **If stage is `claimed`:** 1. Execute task (same as Step 4c): reason through the task, produce a result string, compute `result_hash`. 2. Complete the job: ``` POST http://localhost:8080/tx/build-and-broadcast { "intent": "complete_job", "job_tx_hash": "", "job_index": 0, "worker_lock_args": "", "result_hash": "" } ``` 3. If successful, extract `tx_hash` from the response. 4. Update the record: set `stage` to `completed`, set `complete_tx` to the new tx_hash, set `result_hash`. 5. Write updated `nerve:auto:inflight` to Memory immediately. 6. Wait for TX confirmation. Poll every 5 seconds until `committed`. No poll limit. 7. If confirmed, attempt to mint a PoP badge (same as Step 4e). Badge failure is non-fatal. 8. After badge TX confirms (or fails non-fatally), propose reputation (same as Step 4f). Non-fatal. 9. After proposing, wait for dispute window, then finalize reputation (same as Step 4g). Non-fatal. ### 2c. On any error during advancement If a TX call returns an error: - If the error contains `"CellNotFound"` or `"not found"`: mark as `failed` with error `"job sniped"`. - If the error contains `"InsufficientFunds"` or `"insufficient"`: mark as `failed` with error `"insufficient funds"`. - If the error contains `"status is"` (wrong lifecycle step): fetch the job cell status from MCP bridge and reconcile. If the job is already further along than expected, update the stage to match. - For any other error: mark as `failed` with the raw error message. Always write the updated inflight list to Memory after each error. ## Step 3: Scan and Select New Jobs Skip this step if: - Active in-flight count >= `max_concurrent_jobs`. - Balance was below `min_balance_ckb` in preflight step 8. - Daily spending budget was exhausted in preflight step 7. ### 3a. Fetch open jobs ``` GET http://localhost:8081/jobs?status=Open ``` Response: ```json { "jobs": [ { "out_point": { "tx_hash": "0x...", "index": "0x0" }, "status": "Open", "reward_ckb": 5.0, "capability_hash": "0x...", "ttl_block_height": "1000000", ... } ], "count": 42 } ``` ### 3b. Fetch current block height ``` GET http://localhost:8081/chain/height ``` Response: `{ "block_number": "12345678" }` ### 3c. Filter jobs For each job in the response, apply these filters in order: 1. **Already in-flight?** Skip if `job_outpoint` matches any record in `nerve:auto:inflight`. 2. **Reward too high?** Skip if `reward_ckb > max_reward_ckb`. 3. **Reward too low?** Skip if `reward_ckb < min_reward_ckb`. 4. **Capability match?** The zero hash (`0x000...000`, 64 zeros) means "any agent". If `capability_hashes` is empty, only accept zero-hash jobs. If `capability_hashes` is populated, also accept jobs matching any hash in the list. **Additionally**, if a job has a non-zero `capability_hash`, verify the agent holds a matching capability NFT by calling: ``` GET http://localhost:8081/agents//capabilities ``` Skip the job if no matching `capability_hash` is found in the response. Cache this result for the duration of the run to avoid repeated calls. 5. **TTL check?** Skip if `ttl_block_height - current_block_number < 50`. The job expires too soon. ### 3d. Select jobs Sort remaining jobs by `reward_ckb` descending (highest reward first). Select up to `max_concurrent_jobs - active_inflight_count` jobs. ## Step 4: Execute Job Lifecycle For each selected job from Step 3: ### 4a. Reserve ``` POST http://localhost:8080/tx/build-and-broadcast { "intent": "reserve_job", "job_tx_hash": "", "job_index": , "worker_lock_args": "" } ``` If successful: 1. Extract `tx_hash` from the response. 2. Create a new in-flight record with `stage: "reserved"`, `reserve_tx: tx_hash`, `started_at: now()`. 3. Append to `nerve:auto:inflight` and write to Memory immediately. 4. Wait for TX confirmation (poll `GET /tx/status?tx_hash=` every 5s until `committed`, no poll limit). 5. If the RPC returns a hard error (rejected/unknown), set `stage` to `failed`. Never fail on a still-pending TX. If the reserve call fails (e.g., job was sniped by another agent), skip this job and continue to the next. ### 4b. Claim ``` POST http://localhost:8080/tx/build-and-broadcast { "intent": "claim_job", "job_tx_hash": "", "job_index": 0 } ``` If successful: 1. Update the record: `stage: "claimed"`, `claim_tx: tx_hash`. 2. Write updated `nerve:auto:inflight` to Memory. 3. Wait for TX confirmation. ### 4c. Execute task You ARE the task executor. Reason through the task based on the job's `capability_hash`: 1. If `capability_hash` is the zero hash (`0x000...000`), produce a generic completion result: `"NERVE autonomous agent completed generic task at "`. 2. If `capability_hash` matches a known capability (e.g., from `nerve:auto:config.capability_hashes`), produce a result string describing what was done. 3. If `capability_hash` matches a service-payment capability: a. Read `nerve:service:config` from Memory for service details and supported services. b. Ensure Fiber node is ready (`fiber-pay node ready --json`). If not ready, mark the job as `failed` with error `"Fiber node not ready for service payment"`. c. Ensure Fiber channel to payment hub has sufficient liquidity. If not, attempt to open a channel: ``` fiber-pay channel open --peer --funding --json ``` d. Execute the service-specific payment via fiber-pay CLI. e. Generate proof of payment (receipt ID, confirmation, etc.) as the result string. Update the in-flight record with the result string. Write to Memory immediately. ### 4d. Complete Pass the raw result string. The server computes the blake2b binding hash internally. ``` POST http://localhost:8080/tx/build-and-broadcast { "intent": "complete_job", "job_tx_hash": "", "job_index": 0, "worker_lock_args": "", "result": "" } ``` If successful: 1. Update the record: `stage: "completed"`, `complete_tx: tx_hash`. 2. Write updated `nerve:auto:inflight` to Memory. 3. Wait for TX confirmation. ### 4e. Mint PoP badge After the completion TX is confirmed, mint a Proof of Participation badge: ``` POST http://localhost:8080/tx/build-and-broadcast { "intent": "mint_badge", "job_tx_hash": "", "job_index": , "worker_lock_args": "", "result_hash": "", "completed_at_tx": "" } ``` If successful: update the record `badge_tx` with the new tx_hash. Badge minting failure is **non-fatal**. ### 4f. Propose reputation After the badge TX confirms (or fails non-fatally), propose the reputation update: ``` POST http://localhost:8080/tx/build-and-broadcast { "intent": "propose_reputation", "rep_tx_hash": "", "rep_index": 0, "propose_type": 1, "dispute_window_blocks": 100, "job_tx_hash": "", "job_index": , "worker_lock_args": "", "poster_lock_args": "", "reward_shannons": , "result_hash": "" } ``` To get the reputation cell outpoint: `GET http://localhost:8081/agents//reputation` — use the `out_point` field. If successful: update the record `propose_rep_tx` with the new tx_hash. Reputation proposal failure is **non-fatal**. ### 4g. Finalize reputation After proposing, poll `GET http://localhost:8081/agents//reputation/status` every 10 seconds until `can_finalize` is `true`. Then: ``` POST http://localhost:8080/tx/build-and-broadcast { "intent": "finalize_reputation", "rep_tx_hash": "", "rep_index": 0 } ``` If successful: update the record `finalize_rep_tx` with the new tx_hash. Finalization failure is **non-fatal**. ## Step 5: Log and Report ### 5a. Move completed/failed records to log For each record in `nerve:auto:inflight` where stage is `completed` or `failed`: 1. Append it to `nerve:auto:log`. 2. Remove it from `nerve:auto:inflight`. Cap `nerve:auto:log` at 50 entries (drop oldest if over limit). Write both `nerve:auto:inflight` and `nerve:auto:log` to Memory. ### 5b. Update stats Read `nerve:auto:stats` from Memory (default: `{ "jobs_completed": 0, "jobs_failed": 0, "total_reward_earned_ckb": 0, "total_badges_earned": 0 }`). For each newly completed record: increment `jobs_completed` and add `reward_ckb` to `total_reward_earned_ckb`. If `badge_tx` is non-null, increment `total_badges_earned`. For each newly failed record: increment `jobs_failed`. Write `nerve:auto:stats` to Memory. ### 5c. Summary For each job completed this run, send back to the user: 1. The full result blob from Step 4c — not a summary, the complete text exactly as produced. 2. All transaction hashes as testnet explorer links: `https://testnet.explorer.nervos.org/transaction/` 3. Badge, reputation proposal, and finalization TX hashes if available. Then output the run stats: ``` Autonomous worker run complete. In-flight: jobs Completed this run: (earned CKB) Failed this run: Balance: CKB ``` If no actions were taken (no in-flight jobs, no new jobs found), output: ``` Autonomous worker: no actionable jobs found. ``` ## Error Handling Summary | Error | Action | |---|---| | Service unreachable (TX Builder or MCP) | Exit gracefully. Will retry on next cron cycle. | | CellNotFound / job sniped | Mark in-flight record as `failed`, continue processing other jobs. | | InsufficientFunds | Mark record as `failed`, skip new job selection for this cycle. | | TX hard-rejected by node | Mark record as `failed` with the rejection error. Never fail on a still-pending TX. | | Wrong job status | Fetch actual on-chain status and reconcile. If recoverable, update stage. Otherwise mark `failed`. | | Memory read/write failure | Log the error and exit. Do not proceed with partial state. |