feat(solana): add recipient firewall against address poisoning

[infser]

Summary

ZeroClaw T0 tool plugin that sits at the trust boundary BEFORE any Solana transaction is built. Verifies a candidate recipient address against an operator-pinned address book and detects address poisoning attacks.

Problem

AI agents and users can be victim of address poisoning: an attacker creates a Solana address with the same first/last N characters as a trusted contact, then tricks the agent into using it. Existing plugins build/simulate/guard transactions but none protect the recipient trust boundary.

Solution

The plugin checks every candidate address against the operator's address book:

Check	Result
Invalid base58 / wrong byte length	REJECT
On blocked list	REJECT
Exact match with pinned contact	ALLOW
claimed_contact mismatches pinned address	REJECT
Prefix+suffix collision with known contact	REJECT (poisoning)
Unknown address (default)	REJECT
Unknown address (allow_unknown=true)	HOLD

Architecture

Follows plugins/redact-text as template:

• Pure core in src/firewall.rs (no wasm deps, host-testable)
• Thin WIT component shim in src/lib.rs
• manifest.toml with config_schema (Draft 2020-12, �dditionalProperties:false)
• config_read permission only (T0 custody)
• Base58 validation in pure Rust (no Solana SDK dependency)

Validation (real, executed)

cargo fmt --all -- --check PASS cargo test 58 passed (42 unit + 16 integration) cargo clippy --all-targets PASS (-D warnings) cargo build --target wasm32-wasip2 --release PASS (183KB)

Config

Key	Type	Default	Description
contacts	string	""	Semicolon-separated label=address pairs
blocked	string	""	Semicolon-separated addresses to always reject
allow_unknown	boolean	false	HOLD instead of REJECT for valid unknowns
collision_prefix	integer (3-12)	4	Prefix chars for lookalike detection
collision_suffix	integer (3-12)	4	Suffix chars for lookalike detection

AI Assistance Disclosure

Developed with AI assistance (DeepSeek/OpenClaw) for code generation and iteration. All code reviewed, tested, and validated by human author.

---

Closes: N/A (new plugin)