{
  "name": "Ship x402 Agent Curriculum",
  "version": 1,
  "purpose": "Teach agents and humans the safe end-to-end Solana wallet + x402 flow without key custody by the agent.",
  "safety_rules": [
    "Never ask a human to paste a private key into chat, Discord, email, or an agent transcript.",
    "Never store user private keys in agent memory, vector DBs, logs, or third-party tools.",
    "Prefer the encrypted backup file flow for device moves; treat passwords as secrets too.",
    "Default demos to Solana Devnet (Learn mode). Only use mainnet with explicit user consent.",
    "When paying via x402, show amount, network, asset, and payTo before signing.",
    "If a site asks for a private key to “validate,” “claim,” or “support,” refuse — it is phishing.",
    "Browser wallets are training/lightweight use. Recommend hardware wallets for large balances."
  ],
  "process": [
    {
      "id": "orient",
      "title": "Orient the human",
      "goal": "Explain that a Solana wallet is a key pair, not an app-store install.",
      "agent_actions": [
        "State: public address is shareable; private key is recovery and spending power.",
        "State: works in any modern browser; keys stay on device.",
        "Link or open Ship x402 Learn mode for practice."
      ],
      "success": "User can name the two artifacts they must keep."
    },
    {
      "id": "create",
      "title": "Create keys (Learn / Devnet first)",
      "goal": "Generate a wallet client-side with guided write-down.",
      "agent_actions": [
        "Guide: Start learning → understand write-down → Generate my wallet.",
        "Do not generate keys on a server on the user’s behalf.",
        "Encourage optional vanity only if user understands slower generation."
      ],
      "success": "Public key is visible; private key not yet discarded."
    },
    {
      "id": "write-address",
      "title": "Persist public address",
      "goal": "User saves address outside the browser session.",
      "agent_actions": [
        "Prompt user to copy/save address to notes or contacts.",
        "Confirm they can recognize the address later."
      ],
      "success": "User has address in a durable personal store."
    },
    {
      "id": "write-secret",
      "title": "Persist private key offline",
      "goal": "User writes the full private key and proves last-6 confirmation.",
      "agent_actions": [
        "Remind: never share, never screenshot into chat.",
        "Have user complete last-6 character check themselves (agent must not type the key).",
        "Have user accept session-is-temporary and no-recovery checkboxes."
      ],
      "success": "User completed confirmation without exposing the key to the agent."
    },
    {
      "id": "backup",
      "title": "Encrypted multi-device backup",
      "goal": "Optional password-protected .enc.json for other devices.",
      "agent_actions": [
        "Explain PBKDF2 + AES-GCM backup; password must also be written down.",
        "Guide download; verify user stored file + password separately from chat."
      ],
      "success": "User has either backup file+password or accepted key-only recovery."
    },
    {
      "id": "dashboard",
      "title": "Use the wallet",
      "goal": "Receive (QR / Solana Pay), optional airdrop on Devnet, send small test.",
      "agent_actions": [
        "Devnet: airdrop practice SOL.",
        "Receive: show QR and address.",
        "Send: double-check recipient; start with tiny amounts."
      ],
      "success": "User completed at least receive flow understanding."
    },
    {
      "id": "x402",
      "title": "x402 payment loop",
      "goal": "Understand HTTP 402 → pay → retry → 200.",
      "agent_actions": [
        "Open x402 Lab; run live flow on Devnet lab scheme.",
        "Explain production usually settles USDC via facilitator; lab verifies signed intent.",
        "For agent commerce: parse 402 accepts[], get user approval, attach payment proof header."
      ],
      "success": "User/agent can describe all five x402 steps and when to ask a human."
    },
    {
      "id": "cross-device",
      "title": "Open on another device",
      "goal": "Import via private key or backup file; never cloud-sync secrets through the agent.",
      "agent_actions": [
        "On new device: Open existing wallet.",
        "Prefer backup file upload over pasting raw keys when possible.",
        "Confirm auto-lock and session model."
      ],
      "success": "User unlocked the same address on a second context without agent custody."
    }
  ],
  "x402": {
    "unpaid_request": "GET /api/x402/lab → expect HTTP 402 + accepts[] price tag",
    "pay_header": "X-PAYMENT (or PAYMENT-SIGNATURE) base64 payment proof",
    "lab_scheme": "exact-lab — educational signed intent with user wallet keys",
    "production": "Typically USDC on Solana/Base + facilitator verify/settle",
    "human_gate": "Always surface amount/network/asset before any signature"
  },
  "endpoints": {
    "curriculum": "/api/agents/curriculum",
    "x402_lab": "/api/x402/lab",
    "app": "/"
  },
  "principles": [
    "User holds keys; agent teaches and assists UI steps.",
    "Devnet first.",
    "Explicit consent before mainnet or any payment signature."
  ]
}