feat(agent): OWS-secured x402 USDC deposit agent for Arbitrum One

[gianalarcon]

What

A standalone agent (usdc-deposit-agent/, outside the yarn workspace) that funds a PolyPay multisig with USDC on Arbitrum One via the gasless x402 deposit flow — with the signing key kept entirely out of the agent process.

Verified end-to-end with a live 1 USDC deposit: tx 0x488ac7…3f451.

How it works

agent process ──spawn──▶ OWS signer subprocess ──▶ OWS policy engine ──▶ vault key
(holds token)            (holds token)             (allow/deny)          (~/.ows, encrypted)

1. Discover — GET /api/x402/deposit/:multisig → 402 with payment requirements.
2. Sign — builds the EIP-3009 TransferWithAuthorization typed data and signs it inside an OWS policy-gated vault (Open Wallet Standard). The agent only ever holds a scoped ows_key_ token, never the private key.
3. Submit — base64 X-PAYMENT POST with network: "arbitrum"; PolyPay settles via the CDP facilitator (gasless).

Why this design

• Not Coinbase awal/agentic wallet — it supports Base/Polygon/Solana only, not Arbitrum.
• Not a raw PRIVATE_KEY in .env — that key would sit in the agent's heap, reachable by any tool it runs and one prompt-injection away from signing an attacker's transfer.
• OWS gives an encrypted vault + scoped token + a policy engine that decides what may be signed before the key is decrypted.

Security guarantee (enforced by policy/check-deposit.mjs)

Even if the agent is fully compromised, the scoped token can only produce an EIP-3009 USDC TransferWithAuthorization, on Arbitrum One, to one multisig, ≤ a configured cap, until it expires. It cannot drain the wallet or redirect funds. Proven by npm run test:policy (allows the correct deposit; denies wrong recipient / over-cap / wrong chain).

CI / deploy impact

None. The folder lives at repo root, outside packages/** (so no path-filtered workflow fires) and is not a yarn workspace member (workspaces: packages/*), so yarn install/build/format don't touch it. Purely additive tooling.

Not committed (gitignored, reconstructed via npm install + ./setup.sh)

.env (holds the live scoped token), node_modules/, and the rendered policy/*.policy.json (holds the multisig + cap).

Test plan

• npm run typecheck — passes.
• npm run test:policy — isolated temp vault; correct deposit signs, wrong recipient / over-cap / wrong-chain denied.
• Live 1 USDC deposit on Arbitrum One settled (tx above); balances confirmed on-chain.

🤖 Generated with Claude Code