PRD-41: ElizaOS Plugin — Drop-in Threshold Signing for AI Agents

[PancheI]

ElizaOS plugin (@agentokratia/plugin-guardian) that replaces raw EVM_PRIVATE_KEY in .env with threshold signing credentials. Drop-in replacement — change 3 env vars and swap the plugin name in the character file.

Acceptance Criteria

• @agentokratia/plugin-guardian package builds and exports valid ElizaOS plugin
• 7 actions registered and functional: SEND_ETH, SEND_TOKEN, CALL_CONTRACT, SIGN_MESSAGE, SIGN_TYPED_DATA, CHECK_BALANCE, SWAP_TOKEN
• GuardianWalletService manages ThresholdSigner lifecycle, calls destroy() on agent shutdown
• guardianWalletProvider injects address + balance context into agent memory
• guardianTransactionProvider injects recent audit log context
• guardianPolicyEvaluator runs pre-flight policy simulation before signing
• Core invariant holds — full private key never exists
• Migration from plugin-evm requires only 3 env var changes + plugin swap
• Compatible alongside plugin-solana, plugin-tee, plugin-safe
• SEND_TOKEN auto-reads decimals + symbol on-chain
• SIGN_TYPED_DATA handles EIP-712 domains (x402, Permit2)
• Natural language triggers work (e.g. "send 0.1 ETH to 0x...")
• pnpm build succeeds across all packages

Tasks

• Scaffold packages/elizaos-plugin/ with package.json, peer dep on @elizaos/core ^1.0.0
• Implement GuardianWalletService — ThresholdSigner lifecycle + cleanup
• Implement guardianWalletProvider — address + balance context
• Implement guardianTransactionProvider — recent audit log context
• Implement guardianPolicyEvaluator — pre-flight policy simulation
• Implement SEND_ETH action
• Implement SEND_TOKEN action with auto decimal handling
• Implement CALL_CONTRACT action
• Implement SIGN_MESSAGE action (EIP-191)
• Implement SIGN_TYPED_DATA action (EIP-712)
• Implement CHECK_BALANCE action
• Implement SWAP_TOKEN action (approval + swap)
• Write unit tests for all actions
• Write integration tests with mock ElizaOS runtime
• Add migration guide in README
• Submit to ElizaOS plugin registry

I've been looking into this and I think I've found where the fix needs to go, but I wanted to check my understanding before opening a PR since this touches The fix involves implementing threshold signing for AI agents with a full private key never existing, which has financia.

What I think the fix is:
Implement the GuardianWalletService with ThresholdSigner lifecycle, create guardianWalletProvider and guardianTransactionProvider, implement guardianPolicyEvaluator, ensure all 7 actions are functional, and verify compatibility with other plugins.

Before I open a PR:

• Does this diagnosis look correct to you?
• Are there any edge cases or invariants I should know about?

Happy to open the PR straight away if this looks right — just let me know.