Phase 6: complete Leash MCP proxy and signer boundary

[Blockchain-Oracle]

What changed

• builds the installable leash-mcp stdio proxy and standalone paid_fetch surface on the real MCP/x402 SDKs
• adds strict EIP-3009 parsing, Base/Arbitrum routing, remote-signer reporting, and bounded settlement retries
• adds the authenticated Leash connect/sign/result control plane with PostgreSQL cap, status, key, float, expiry, receipt, and migration invariants
• verifies settlement from server-fetched transaction, receipt, and USDC event evidence instead of trusting the client callback
• records the Phase 6 verification audit and explicit B-03/B-04/B-08/B-10 boundaries

Why

Phase 6 needs a runnable agent payment boundary now without pretending that the unresolved Magic TEE or funded mainnet path exists. The implementation is real through the remote-signer boundary and fails honestly with SIGNER_NOT_CONFIGURED until B-03 clears.

The hardening pass also closes concurrency, retry, URL-secret leakage, nonce canonicalization, SQL CHECK, and migration-upgrade gaps found by independent correctness/security review.

Impact

Free MCP and HTTP calls work through the packaged agent. x402 challenges reach the hosted policy boundary, where unsupported or unfunded/signing-blocked requests are persisted accurately. No fake signature, transaction hash, settlement, or payable target is introduced.

Validation

• pnpm install --frozen-lockfile --offline
• pnpm lint
• pnpm check:showcase
• pnpm typecheck
• pnpm test — agent 57 tests; web 477 tests
• pnpm build
• pnpm --filter @tab/web db:check
• built-bin stdio and Streamable HTTP MCP smoke tests
• real loopback HTTP, PostgreSQL, viem RPC, signature-recovery, and migration-upgrade integrations
• independent follow-up review: READY, no remaining blockers

[gitguardian]

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

---

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}