feat(security+ux): Pillar 2 owner-permission lockdown + Get Started rewrite + copy buttons

[paulgnz]

Bundles three operator-facing improvements driven by an audit swarm of the live xpragents.com surface (3 parallel agents, 70+ findings consolidated):

1. Pillar 2 security model — owner permission delegated to a human account
2. Get Started page rewrite — path-aware linear flow with explicit Standalone vs Harness picker
3. Copy buttons sitewide — every shell snippet on Get Started + Register

Plus consolidated audit-driven content fixes (operator-blocking copy in how-it-works, missing form validation on /register, missing OG metadata on sub-pages, etc.).

Pillar 2 — owner permission delegated to a human account

Until now, the post-charliebot security story stopped at "active key lives in the proton CLI keychain, never in the agent process" (Pillar 1). Necessary but not sufficient: if the active key ever leaks, the attacker can rotate the agent out of its own account because the same key controls owner by default.

This PR ships an interactive, idempotent, type-to-confirm setup script that delegates owner to the operator's separate human XPR account.

After setup:

owner:  <human-account>@active   (recovery + permission control)
active: PUB_K1_xxx               (proton CLI keychain, daily signing)

If active leaks, the human signs an updateauth from a different machine to rotate active. Agent identity / history / trust score all survive.

Reachable from both deployment paths:

• Standalone: ./setup-security.sh (ships in scaffold)
• Harness: npx @xpr-agents/openclaw xpr-agents-setup-security --account <name> (new bin entry in @xpr-agents/openclaw)

Safety design:

• TTY required (no automation, no piped stdin)
• Hard refuse if proton CLI absent, account lookup fails, or K1 we'd set on active isn't in keychain
• Type-to-confirm BOTH the agent and human account names
• Operator must visit explorer.xprnetwork.org and verify visually
• Atomic 2-action transaction; re-fetch + verify end-state after push
• Idempotent: detects already-secured accounts and exits cleanly

start.sh first-run check: detects raw keys on owner and prints a yellow [security] warning pointing at the script. Non-blocking.

Full rationale: new docs/SECURITY.md (227 lines, covers WebAuth and proton account:create starting states).

Get Started — path-aware linear flow

Restructured from a 5-step nested-branch layout to 5 linear steps with a Standalone vs Harness picker between Step 2 and Step 3:

1. Create an XPR Network account (WebAuth-first; CLI alternative)
2. Load private key into proton CLI keychain
3. [Path picker] Deploy — content swaps based on selection
4. Lock down owner permission (Pillar 2)
5. Register, claim for KYC, build trust

The post-charliebot security explainer is no longer buried in text-zinc-500 — it's now a prominent emerald callout above the steps.

New "Building skills?" developer-resources card links the xpr-network-dev-skill repo (previously invisible on the frontend).

Copy buttons sitewide

New components: CopyButton, CodeBlock. Applied to every multi-line shell snippet on Get Started + Register.

Audit-driven content fixes

• how-it-works hero: "Running on testnet today" → "Live on XPR Network mainnet, with testnet available for experiments." The old copy was actively misleading new visitors; mainnet has been live with 56 agents, 27 jobs, 4 arbitrators.
• ERC-8004 → EIP-8004 across user-facing pages.
• Home hero CTA: "How It Works" → "Get Started". The page that walks operators through what to do was reachable only from the header dropdown before.
• Test-count breakdown grid: dropped the "MCP Tools: 72" tile from a Total Tests category (category error caught by audit).
• New SiteHead component fixes og:image (was pointing at stale Vercel preview URL on every page) and adds og:url/og:title/og:description to get-started + how-it-works (only home had them).

Register page P0s

• Description client-side required to match contract (agentcore.contract.ts:476 enforces 1-256 chars; form was letting operators hit a confusing on-chain assertion failure).
• Protocol dropdown dropped websocket and mqtt — contract only accepts http://, https://, grpc://, wss://.
• Network badge in form next to "Registering as @account" — wrong-chain registration risk caught by audit.
• Trust score preview ("you'll start at 0/100, here's how it grows").
• Wallet-connect inline CTA when no session.
• start.sh flags table expanded from 2 to 6 rows (--network, --rpc, --model, --poll-interval added).

Versions

• @xpr-agents/openclaw → 0.4.3 (bin entry for xpr-agents-setup-security, SKILL.md Pillar 2 safety rule)
• create-xpr-agent → 0.6.0 (start.sh first-run security check, setup-security.sh ships in template)

Verification

• 80 openclaw tests pass
• Frontend builds clean (npm run build, all 13 routes prerendered)
• CI scaffold-sanity covers all three setup-security.sh copies + start.sh + .env.example
• Smoke-tested setup-security.sh on a TTY against an already-secured account → exits cleanly with idempotency check

Next

PR β (action-surface P0s — Hire CTA on /agent/[id], direct-hire option in Post Job modal, useChainStream perf, getLeaderboard N+1, testnet indexer fix, dashboard fixes) lands as a separate PR.