Agent Wallet — open skill

Single skill file: skills/SKILL.md. Cursor loads it via .cursor/skills/open → skills/. ClawHub: clawhub publish skills.

OpenClaw / ClawHub: Source of truth for how agent_id and the TEE interact. Read before inventing “sequence mismatch” or dual-ID theories.

When to use

• POST /create-agent-wallet, POST /sign-transaction, GET /agent/:id, GET /user/:username.
• Production: wrong wallet, signing fails, /agent/2 vs /user/foo disagree on who owns an id.
• Deploy: GKE, DATABASE_URL, TEE_BASE_URL, INTERNAL_HMAC_SECRET.

WRONG hypotheses — do not use these

1. “The TEE allocates agent_id and can get out of sync with Postgres.”
   False. The API allocates agent_id (allocUsername). The TEE receives agent_id as a string and uses it only as AES-GCM AAD. No TEE wallet table or ID sequence. See api/src/teeClient.ts, tee-app/src/index.ts, tee-app/src/walletCore.ts.

2. “TEE in-memory reset breaks ID alignment.”
   Misleading. TEE is stateless for identities. Ciphertexts live in the API (Share B) and client (key_share).