Three ZeroClaw plugins implement a non-custodial Solana payment rail: create a charge, verify it at finalized commitment, authenticate device heartbeats, and build unsigned hash-chained records. The AI never touches a key; the external order driver, relay adapter, and attestation signer are still integration work.
Payment truth comes from the chain and the watcher emits a structured verdict. The animation continues through the desired external-driver, relay, and signer steps so their contracts are easy to understand; those steps are not shipped as an autonomous loop.
This animation is an explainer, not the demo. It is a scripted illustration of the target flow — no agent, chain, signer, or hardware is running on this page. Only a separately linked video should be treated as demo evidence. Exact pinned ZeroClaw headless cron does not self-dispatch ordinary plugin steps; an external driver is required.
Standalone [workspace] crates matching the canonical
redact-text layout: pure host-testable core, thin wasm shim, structured logging, minimal permissions.
All three share kiosk-core — hand-rolled base58, shortvec, Solana Pay, mockable JSON-RPC. No solana-sdk.
"Charge 1.5 USDC for a cold drink" → versioned JSON, Solana Pay URL, unique reference, and a PKPAY1 reference/item memo. Recipient, mint, prices and caps come from operator config — the model cannot touch them.
Asks the chain whether the expected payment truly landed — recipient, mint, amount, reference/item memo, and finality all verified. Its heartbeat mode authenticates authority, device account, and device id before reporting liveness.
Hash-chained unsigned messages for sensor readings, sale receipts, and uptime. A durable nonce lets one pending artifact survive approval; the driver must finalize it before building the next. A transfer is not expressible; signing, submission, and finality are external.
Every plugin is useful standalone from a laptop. Hardware unlocks the flagship, it never gatekeeps the product.
The exact pinned, plugin-enabled ZeroClaw host plus any configured channel. The charge and watcher work without physical hardware; a localnet harness lands and validates a reference-bearing test-token transfer.
Freelancers invoicing in stablecoins, sellers on Telegram/Discord, anyone waiting on a payment, anyone who needs "prove this happened later."
Roadmap integration: any Linux box or Pi + a BME280 on I2C. The checked-in SOP documents the cadence, but pinned headless cron does not execute its ordinary sensor/plugin steps without an external driver.
Pharmacy fridges (cold-chain compliance), food storage, greenhouses, server closets, landlord/tenant disputes.
Roadmap integration: Pi 4 + relay on GPIO17 wired to a lock, dispenser, or plug.
Trusted host-local order persistence and exclusive claiming exist; the driver,
bounded relay_pulse adapter, crash-recovery journal, and delivery
sensor do not.
Self-service machines of any kind, after the missing hardware and signer adapters are implemented and evidenced.
The rule: the LLM is untrusted wherever money or actuation is concerned. The shipped plugins create and verify bounded artifacts; any future driver must use those structured verdicts and preserve the same boundary. Click each attack.
| Capability | Palinurus | #126 suite | best of others ×5 | ProofKiosk |
|---|---|---|---|---|
| Attestation + durable nonce | yes | yes | some | yes |
| Real sensor on real GPIO | simulated | no | no | wiring guide; not evidenced |
| Payments (Solana Pay) | no | no | no | shipped |
| Physical actuation | no | no | no | target contract; adapter absent |
| Payment verification loop | no | uptime only | no | plugins ready; external driver needed |
| Attestation batching | 1 tx / reading | 1 tx / reading | 1 tx / reading | not shipped |
| Zero-hardware on-ramp | yes | no | no | rung 1 of 3 |
# exact ZeroClaw commit e112ce6… (source 0.8.2) + plugin backend ./scripts/install-pinned-zeroclaw.sh export PATH="$PWD/.build/zeroclaw-install/bin:$PATH" # exact host runs valid charge, paid-watch, and unsigned-attest paths rustup target add wasm32-wasip2 ./scripts/host-smoke.sh # canonical host schema: one natural-key row per plugin [plugins] enabled = true auto_discover = true [[plugins.entries]] name = "kiosk-charge" [plugins.entries.config] merchant_address = "YOUR_WALLET" usdc_mint = "YOUR_SPL_MINT" token_decimals = "6" price_list = "cold_drink:1.5, snack:0.75" # local test-token payment: separate customer → merchant, finalized npm ci MODE=localnet ./scripts/devnet-setup.sh source .devnet/payment.env npm run devnet:pay