chore(release): prepare 0.1.2 for OpenClaw 2026.6.34

AGENTS.md

@@ -2,7 +2,7 @@
 
 - Follow the ordered slices in `docs/IMPLEMENTATION_PLAN.md` and implement only the active slice.
 - Use red-green-refactor: observe a focused test fail before implementing behavior, then run focused and full suites.
-- Keep TypeScript strict and use public exports from exactly `openclaw@2026.6.1`.
+- Keep TypeScript strict and use public exports from exactly `openclaw@2026.6.34`.
 - Do not read Nostr secret files in plugin code. OpenClaw resolves the configured file SecretRef.
 - Never log or expose private keys, resolved secret values, plaintext, ciphertext, AUTH challenges, or sender-recipient relationships.
 - Keep transport, cryptography, and OpenClaw adapter boundaries separate.

README.md

@@ -14,7 +14,7 @@ npm run package:validate
 ```
 
 The build checkout intentionally installs development dependencies, including the
-pinned OpenClaw `2026.6.1` SDK compatibility baseline. Deployments do not need
+pinned OpenClaw `2026.6.34` SDK compatibility baseline. Deployments do not need
 that development tree.
 
 From an npm-managed local OpenClaw `2026.7.2-beta.6` or newer checkout, install the built working directory:
@@ -35,9 +35,9 @@ For a standard OpenClaw installation, pack and install the managed artifact:
 
 ```bash
 npm pack
-sha256sum openclaw-armada-dm-0.1.1.tgz > openclaw-armada-dm-0.1.1.tgz.sha256
-sha256sum --check openclaw-armada-dm-0.1.1.tgz.sha256
-openclaw plugins install npm-pack:/absolute/path/openclaw-armada-dm-0.1.1.tgz
+sha256sum openclaw-armada-dm-0.1.2.tgz > openclaw-armada-dm-0.1.2.tgz.sha256
+sha256sum --check openclaw-armada-dm-0.1.2.tgz.sha256
+openclaw plugins install npm-pack:/absolute/path/openclaw-armada-dm-0.1.2.tgz
 openclaw plugins enable armada-dm
 openclaw gateway restart
 ```
@@ -53,16 +53,16 @@ Maintainers can publish the package and checksum in the repository's Releases
 section by pushing a version tag after its version bump reaches `main`:
 
 ```bash
-git tag -a v0.1.1 -m "v0.1.1"
-git push origin v0.1.1
+git tag -a v0.1.2 -m "v0.1.2"
+git push origin v0.1.2
 ```
 
 The tag must exactly match `v` followed by the version in `package.json`. The
 release workflow repeats the install, test, build, package-validation, pack, and
 checksum sequence before creating the GitHub release. It attaches
-`openclaw-armada-dm-0.1.1.tgz` and its `.sha256` checksum as release assets.
+`openclaw-armada-dm-0.1.2.tgz` and its `.sha256` checksum as release assets.
 
-The published `setup-entry.js` uses only the OpenClaw `2026.6.1` public SDK compatibility baseline, while deployment requires patched OpenClaw `2026.7.2-beta.6` or newer. It does not run a wizard, prompt for values, edit configuration, read the secret file, publish events, or start relay connections.
+The published `setup-entry.js` uses only the OpenClaw `2026.6.34` public SDK compatibility baseline, while deployment requires patched OpenClaw `2026.7.2-beta.6` or newer. It does not run a wizard, prompt for values, edit configuration, read the secret file, publish events, or start relay connections.
 
 ## Migrating another Nostr channel
 

SECURITY.md

@@ -4,9 +4,9 @@ Report suspected vulnerabilities privately to the repository maintainers. Do not
 
 Use a dedicated Nostr bot identity. Store its single `nsec` at `/path/to/.openclaw/secrets/nostr_nsec` in a mode-0700 directory and a mode-0600 file, configure OpenClaw's `nostr` single-value file provider, and reference it from `channels.nostr.privateKey`. The plugin never opens that file directly and must never expose the resolved key through configuration, logs, errors, or status.
 
-Deploy only on OpenClaw `2026.7.2-beta.6` or newer. The plugin deliberately typechecks against the narrower `2026.6.1` public SDK surface for compatibility, but that historical package is a development-only API baseline and is not an approved runtime host.
+Deploy only on OpenClaw `2026.7.2-beta.6` or newer. The plugin deliberately compiles and typechecks against the narrower `2026.6.34` public SDK surface for compatibility, but npm currently reports advisories in that exact development-only package tree, so it is not the approved smoke-test or runtime host.
 
-`npm run audit` checks the complete dependency tree as well as production dependencies. It fails for any advisory outside the nested, development-only `openclaw@2026.6.1` SDK baseline, and it independently verifies that the deployable host tree is the patched version above. Current advisories attached to the historical baseline are therefore reported explicitly, never shipped in the plugin package, and never accepted in a runtime host.
+`npm run audit` checks the complete dependency tree as well as production dependencies. It fails for any advisory outside the nested, development-only `openclaw@2026.6.34` SDK baseline, and it independently verifies that the deployable host tree is the patched version above. Findings attached to the exact SDK baseline are reported explicitly, never shipped in the plugin package, and never accepted in the runtime smoke host.
 
 NIP-17 is transport end-to-end encryption. Plaintext exists on the OpenClaw host and is provided to the operator's configured model provider. Use least-privilege tools and sandboxing for every agent reachable through this channel.