factory run: liquidation-guard

[Ansh-699]

Factory run liquidation-guard: build ZeroClaw wasm plugin plugins/liquidation-guard/ (Kamino Lend health guard: tiered liquidation warnings, liquidation-price forecast, ranked remedies, unsigned repay tx) for PR to zeroclaw-labs/zeroclaw-plugins. Superteam Brasil bounty; PR target Aug 2, bounty deadline Aug 6 2026.

• Spec: docs/spec/liquidation-guard.md (factory branch factory/liquidation-guard, base upstream/main 23a5dcb)
• Manifest: docs/runs/liquidation-guard/manifest.md (local, gitignored)
• Build plan + research: /home/anshtyagi/Documents/liquidation-guard/

Assumptions

• Roles per ~/.architect/config: strategist = claude/best (Fable), builders = claude/tier-down (Sonnet high). codex CLI absent on this machine; config already routes builders to Claude — no substitution needed.
• Tracker = github on this fork (issues enabled for the run). Submission PR to upstream must contain ONLY plugins/liquidation-guard/**; ship step cuts a clean branch from upstream/main.
• Canary: SHELLS_OK. Host toolchain cargo 1.96.1 == CI pin; wasm32-wasip2 installed.
• Locked product decisions per PLAN.md §1 (single plugin dir, one tool w/ action enum, repay-only rescue, withdraw excluded, fail-closed config, Kamino /oracles/prices only).

[Ansh-699]

RULING: GROUND DRIFT (no freeze commit for docs/checks/liquidation-guard/) is expected pre-freeze state — run is in spec stage; proceed. Freeze happens after harden.

[Ansh-699]

RULING PENDING (auto-applies defaults after ~5m silence):

1. Runtime crypto deps for rescue PDA/ATA derivation — default: adopt feat(solana): payment suite, three unsigned-only tool plugins on a shared wasip2 core zeroclaw-labs/zeroclaw-plugins#30's field-proven set (bs58, sha2, curve25519-dalek no-rand) as runtime deps; keeps markets config open, wasip2-clean, getrandom-free.
2. Manifest author/publisher — default: Ansh-699.
3. License — default: MIT OR Apache-2.0 (matches reference plugin redact-text).
4. Rescue live evidence — default: manual RPC simulateTransaction sigVerify:false against the public demo wallet (plugin itself never simulates/broadcasts); funded-wallet demo optional polish.

[Ansh-699]

RULING (user present, no objection): all four defaults applied — (1) runtime deps bs58+sha2+curve25519-dalek (no rand) per zeroclaw-labs#30 precedent; (2) author Ansh-699; (3) MIT OR Apache-2.0; (4) rescue evidence = manual simulateTransaction sigVerify:false vs demo wallet.

[Ansh-699]

RULING 5 (applied at default): rescue extracts reserve-account pubkeys by fixed offset from base64 blobs, fail-closed validated (discriminator + length + lending_market match) and golden-cross-checked vs a captured mainnet tx. F16 verified offsets across all 58 reserves. Fallback if the golden test ever disagrees: monitor-only T0. HARDEN: DONE issues=8 checks=8 findings=20 (F18-F20 fixed pre-freeze).