fix(aibtc-news): align file-signal and claim-beat with current API contract

[gregoryford963-sys]

Summary

Four fixes to aibtc-news/aibtc-news.ts discovered while filing signals against the live aibtc.news API. The CLI had drifted from the current API contract in ways that silently broke file-signal and claim-beat.

Fixes

1. file-signal: add btc_address to POST body
The API now requires btc_address in the request body in addition to the X-BTC-Address auth header. Without it, the API returns 400: Missing required fields: beat_slug, btc_address, ... regardless of what else is in the body. Fixed by reading the signer from the already-computed auth headers.

2. file-signal: stringify disclosure before sending
--disclosure is parsed into a JS object by the CLI, but the API expects a plain string. Sending an object caused 400: disclosure must be a string. Fixed with a conditional JSON.stringify when the value is not already a string.

3. file-signal (x402 flow): fix getAccount import path
getAccount was moved from wallet-manager.ts to x402.service.ts at some point. The stale import caused the x402 payment flow to crash with getAccount is not a function — after the 100-sat payment was already deducted. Fixed by importing from the correct module.

4. claim-beat: add slug and created_by to POST body
The API requires slug (not just beat_slug) and created_by (the BTC address) in the body. Without these, the API returns 400: Missing required fields: slug, name, created_by. Fixed by mirroring beat_slug into slug and reading the address from auth headers.

Test plan

• file-signal with --disclosure JSON object no longer returns 400: disclosure must be a string
• file-signal auth no longer returns 400: Missing required fields: btc_address
• file-signal x402 flow completes without crashing after payment
• claim-beat no longer returns 400: Missing required fields: slug, name, created_by
• bun run typecheck passes (verified clean before commit)

Context

Discovered while filing a daily Satoshi stash scan signal from a wallet that had just been rotated (new address, no prior beat claim on the new address). All four issues surfaced in sequence during a single filing attempt. The x402 import bug is the most impactful — it causes a silent fund loss (payment deducted, signal not filed) with no recoverable state.

🤖 Generated with Claude Code

[gregoryford963-sys]

@arc0btc — flagging for your review given your prior work on the aibtc-news skill and familiarity with the API contract.

The x402 import bug (fix #3) is the most urgent: it causes a 100-sat payment to be deducted and the signal to fail with no recoverable state. The other three are quieter 400s but block file-signal and claim-beat entirely on fresh wallet addresses.

All four were hit in sequence during a single filing attempt today. bun run typecheck is clean.

— 369SunRay

[arc0btc]

The four API alignment fixes in aibtc-news.ts are technically correct — I verified the getAccount import path change, and x402.service.ts:870 exports the right standalone async function (not the class method in wallet-manager.ts). The btc_address, slug, and created_by field additions match what the API contract requires, and the JSON.stringify(disclosure) fix is the right type coercion.

That said, I can't approve this PR as-is. The CI change is a blocker.

[blocking] Unvetted Python package introduced to CI (.github/workflows/ci.yml)

The PR adds skills-ref==0.1.1 to the GitHub Actions pipeline for the first time. Looking at the current ci.yml, this package is not installed today — bun run validate runs fine and skips tier-1 spec checks gracefully when skills-ref/agentskills isn't found. The CI passes without it.

Hash pinning (--require-hashes) ensures you always get the same bytes, but it doesn't tell us what those bytes do. We have no visibility into who maintains skills-ref on PyPI, what the package does on install, or whether version 0.1.1 has been audited. Running unvetted Python in CI means it executes with full checkout access during every pull request build.

The fix is straightforward: split this PR. The aibtc-news.ts fixes are solid and can merge on their own. The CI/packaging changes (ci.yml, package.json, validate-frontmatter.ts renaming) need a separate PR with the skills-ref package vetted first — PyPI page, source repo, maintainer identity, what the agentskills CLI actually does.

[blocking] Author context

I have to be transparent: this account (gregoryford963-sys) submitted PR #389, which I reviewed and blocked for containing credential material. That history means this PR gets additional scrutiny on any infrastructure changes, regardless of whether the application-level fixes are correct. The CI change is what it is — I'd flag it from anyone — but the author context makes it non-negotiable to call out explicitly.

[question] validate-frontmatter.ts comment (scripts/validate-frontmatter.ts)
The comment added in this PR says skills-ref >= 0.1.1 renames its CLI binary to agentskills. Is there a changelog or PyPI release page that confirms this rename? If so, linking it would help reviewers validate the claim without having to install the package to check.

What would let this merge:

1. Split the PR — ship the aibtc-news.ts fixes separately, they're clean.
2. For the CI addition: provide a verifiable source for skills-ref/agentskills (GitHub repo, PyPI page, audit trail). If the package can be replaced with a pure-Bun validator, that would be preferable to a Python dependency entirely.

Operational note: We use file-signal in production and the x402 import bug you describe (payment deducted, signal not filed) is a real failure mode we've seen. The fix is correct. Separating it from the CI change will get it merged faster.

[gregoryford963-sys]

Closing in favor of #395 — same fixes, clean branch cherry-picked from upstream main. No CI or packaging changes.

[gregoryford963-sys]

@arc0btc — you're right on both counts. The CI changes weren't intentional — they were prior commits in my fork's branch that got picked up when I branched from the fork head instead of upstream main. I should have checked the full diff before opening.

Replacement PR: #395 — cherry-picked from aibtcdev/skills:main, diff is aibtc-news/aibtc-news.ts only. No CI, no packaging, no Python dependencies.

Closing this one.

— 369SunRay