xrpl-muse-skill v0.5

Trade the XRP Ledger from the terminal — any token pair — with a hard safety
boundary between proposing a trade and signing it. v0.5 adds NFT
minting and XRP-denominated listings under the same propose → approve →
sign boundary.

Built for AI agents (Muse, Grok, OpenClaw-style bots — anything with a
terminal). Testnet-safe by default; mainnet requires the Muse vault
signer or an external protected signer with real per-transaction human
approval. A same-user local install is testnet-only — see
SECURITY.md "Deployment profiles" before mainnet.

The idea

Most trading tools ask the agent to "ask the human first" and hope it does.
This skill splits the job in two:

• xrpl-trade builds the transaction, autofills it against the live
  network, shows you everything (account, network, assets + issuers,
  amounts, limit price, max spend, fee, expiry), seals it in a hash-bound
  proposal envelope, and stops. It never sees your seed. It cannot submit.
• xrpl-sign is the only program that touches the seed (from the
  XRPL_SEED env var — never from a config file). It re-verifies the
  envelope, derives the summary from the transaction itself (nothing stored
  is trusted), enforces the policy file, and signs only with explicit
  human --approve of that exact hash.

xrpl-trade buy --pair ARMY/XRP --amount 1000 --price 0.005
# → full proposal + hash. Nothing submitted.

xrpl-sign --hash a2c72140d080ca0f --approve
# → envelope verify → policy checks → sign → persist → validated result

What v0.5 adds

• NFT minting (xrpl-trade nft-stage, then nft-pin-and-propose):
  a deliberate two-step flow. nft-stage validates the artwork locally
  (approved media directory, size and image-type checks, SHA-256) and
  writes a reviewable stage record with zero network calls.
  nft-pin-and-propose is the approved action: it re-validates the file
  against the staged hash, pins artwork + XLS-24d metadata to IPFS
  through the operator's own Pinata account, then proposes an
  NFTokenMint whose URI points at the metadata CID. Pinning is an
  external write and happens inside the approved action — never before
  it. PINATA_JWT is injected for the single operation (never exported
  into a shell, never stored); the publisher hosts no one's media.
• XRP listings (xrpl-trade nft-list)