a2a-Market-Stake-Freeze

Provide stake freeze and release rules for participants during negotiation and order execution. Use when implementing stake locking policy, slashing triggers...

Security Scan

The skill's description and instructions align with a stake-locking policy helper, but it claims an existing runtime implementation and references npm commands without providing code or declaring required tooling—an internal inconsistency that warrants caution.

Purpose & Capability

Name, description, and SKILL.md all describe stake freeze/release policy guidance and implementation scaffolding — purpose and content are broadly consistent. However, the SKILL.md claims a 'Status: implemented in local runtime package' and lists specific runtime code paths even though the skill bundle contains no code or install spec, which is an unexplained mismatch.

Instruction Scope

Runtime instructions are design and implementation guidance (file layout, API contracts, events). They do not instruct the agent to read unrelated system files, exfiltrate data, or call external endpoints. No broad or vague 'gather whatever context you need' statements are present.

Install Mechanism

No install spec and no code files are included — instruction-only, which is the lowest install risk. There are no downloads or archives referenced.

Credentials

The skill declares no required binaries or environment variables, but the SKILL.md references running 'npm test' and specific runtime JavaScript paths, implying Node/npm and a local package are expected. The absence of declared dependencies or required tooling is a mismatch and could mislead users about what is actually needed to use this guidance.

Persistence & Privilege

The skill does not request always:true, does not declare credentials, and is user-invocable only. There is no indication it would modify other skills or system-wide settings.

What to consider before installing

This skill is primarily design and implementation notes for stake-lock logic and appears coherent with its stated purpose, but it also claims an existing runtime implementation and mentions running 'npm test' while providing no code or install instructions. Before installing or using it: 1) treat it as documentation/guidance only (no runnable component is included); 2) confirm whether you need Node/npm and a separate runtime package mentioned in the SKILL.md; 3) ask the publisher for the referenced runtime code or a clear install path if you expect executable artifacts; and 4) avoid granting secrets or system-level access — none are required by the skill as provided, and any future version that requests credentials should be scrutinized for proportionality.

Build the rule engine shell for stake lock lifecycle in A2A transactions.

Current status: registration-first scaffold with explicit policy points.

Scope

• Lock stake when node accepts an intent or enters negotiation.
• Release or slash stake based on final outcome and policy.
• Keep stake decisions auditable for dispute resolution.

Suggested Project Layout

• app/domain/rules/stake_rules.py
• app/application/services/stake_service.py
• app/infrastructure/db/stake_repository.py
• app/infrastructure/tasks/stake_timeout_worker.py

Minimum Contracts (MVP P0)

1. freeze_stake(node_id, intent_id, amount) returns lock record.
2. release_stake(lock_id, reason) closes lock and restores available stake.
3. slash_stake(lock_id, reason, evidence) applies penalty and emits incident log.
4. evaluate_timeout_locks(now_ts) handles automatic release/slash decisions.

Policy Baseline

• Lock amount should be deterministic from intent risk tier.
• Slashing requires evidence payload and policy version.
• Timeout defaults to release unless explicit breach condition is met.

Events

• Emit NEGOTIATION_STARTED when stake lock is confirmed.
• Emit risk/stake incident events for policy engine and logging.

Implementation Backlog

• Add dynamic stake multipliers by market volatility.
• Add external arbitration hook for manual dispute outcomes.

Runtime Implementation

• Status: implemented in local runtime package.
• Primary code paths:
• runtime/src/domain/stake-policy.js
• Validation: covered by runtime/tests and npm test in runtime/.