# BotAppStore.com — Specialized Agent Templates & Verified SKILL.md Packs for Grok Bot

> BotAppStore.com is the storefront and technical specification index for task-specialized Grok Bot agent templates and portable `SKILL.md` packs that execute inside your isolated `/workspace` Linux sandbox.

> **Dual Runtime in Every Product:** every license key unlocks both (1) a 1-Click Grok Bot skill bundle (`https://x.ai/bot/...`) and (2) a standalone, deterministic, zero-dependency Python 3.10+ single-file CLI (`/runtime/*.py`, standard library only, no `pip install`, `--json` / `--markdown` output) that runs locally in Cursor, Claude Code, Windsurf, CI/CD pipelines (e.g. GitHub Actions), and any macOS/Linux/Windows terminal.

- **Canonical Storefront:** https://botappstore.com/
- **Machine-Readable Catalog:** https://botappstore.com/llms.txt
- **Full Catalog + Verbatim Sample Reports:** https://botappstore.com/llms-full.txt
- **Structured Product Catalog (JSON):** https://botappstore.com/catalog.json — every live bot and bundle with SKU, USD price, payment methods, when-to-use and checkout endpoints.
- **About, Contact, Privacy & Refunds:** https://botappstore.com/about.html , https://botappstore.com/contact.html , https://botappstore.com/privacy.html (refunds within 15 days of purchase; the license is revoked on refund)
- **Sister Storefront:** https://coinloader.com/
- **Value Bundles (Multi-Bot Packs, one `wcl_...` key unlocks all included bots):** https://botappstore.com/#bundles — `devsecops-ai-security-pack` ($69 one-time · card / Apple Pay / Google Pay via Stripe); `physical-ai-manufacturing-pack` ($59 one-time · card / Apple Pay / Google Pay via Stripe); `founder-research-gtm-pack` ($59 one-time · card / Apple Pay / Google Pay via Stripe); `edgar-intelligence-pack` ($89 one-time · card / Apple Pay / Google Pay via Stripe)
- **Free Flagship Utility (1-Click Install):** https://botappstore.com/bots/web-text-extractor.html (Direct Grok Bot import: https://x.ai/bot/k1oyHmw4iS4VBW1U8_3Ol)
- **Paid Bot & Skill Security Auditor ($29 one-time · card / Apple Pay / Google Pay via Stripe, `sku: bot-skill-auditor`):** https://botappstore.com/bots/bot-skill-auditor.html (Checkout: https://botappstore.com/#card-bot-skill-auditor)
- **Paid Company & Competitor Deep-Dive Analyst ($19 one-time · card / Apple Pay / Google Pay via Stripe, `sku: company-deep-dive`, Registry Name: *Corporate & Competitor OSINT Deep-Dive*):** https://botappstore.com/bots/company-deep-dive.html (Checkout: https://botappstore.com/#card-company-deep-dive)
- **Paid SEC & Patent Watchdog Digest ($29 one-time · card / Apple Pay / Google Pay via Stripe, `sku: sec-patent-watchdog`, Registry Name: *SEC EDGAR & Patent Filing Watchdog*):** https://botappstore.com/bots/sec-patent-watchdog.html (Checkout: https://botappstore.com/#card-sec-patent-watchdog)
- **Dependency Vulnerability Triage ($29 one-time · card / Apple Pay / Google Pay via Stripe, `sku: dependency-vuln-triage`, LIVE NOW):** https://botappstore.com/bots/dependency-vuln-triage.html
- **Social Hub Publisher ($29 one-time · card / Apple Pay / Google Pay via Stripe, `sku: social-hub-publisher`, LIVE NOW):** https://botappstore.com/bots/social-hub-publisher.html
- **Domain, TLS & Email Auth Infrastructure Hygiene Auditor ($19 one-time · card / Apple Pay / Google Pay via Stripe, `sku: domain-infra-hygiene`, LIVE NOW):** https://botappstore.com/bots/domain-infra-hygiene.html (Checkout: https://botappstore.com/#card-domain-infra-hygiene)
- **Agent Council — Multi-Model Swarm Debate & Pair-Architect Collaborator ($39 one-time · card / Apple Pay / Google Pay via Stripe, `sku: agent-council`, LIVE NOW):** https://botappstore.com/bots/agent-council.html (Checkout: https://botappstore.com/#card-agent-council)
- **MCP Server & Tool-Permission Security Auditor ($19 one-time · card / Apple Pay / Google Pay via Stripe, `sku: mcp-config-auditor`, LIVE NOW):** https://botappstore.com/bots/mcp-config-auditor.html (Checkout: https://botappstore.com/#card-mcp-config-auditor)
- **3D Print Farm & Slicer Queue Ops ($29 one-time · card / Apple Pay / Google Pay via Stripe, `sku: print-farm-ops`, AVAILABLE NOW · PHASE 2 LIVE):** https://botappstore.com/bots/print-farm-ops.html (Checkout: https://botappstore.com/#card-print-farm-ops)
- **Humanoid & Fleet Telemetry Inspector ($49 one-time · card / Apple Pay / Google Pay via Stripe, `sku: robotics-telemetry-inspector`, AVAILABLE NOW · PHASE 1 RELEASE):** https://botappstore.com/bots/robotics-telemetry-inspector.html (Checkout: https://botappstore.com/#card-robotics-telemetry-inspector)
- **SEC EDGAR Supply Chain & Counterparty Mapper ($29 one-time · card / Apple Pay / Google Pay via Stripe, `sku: sec-supply-chain-mapper`, v1.1, LIVE NOW):** https://botappstore.com/bots/sec-supply-chain-mapper.html (Checkout: https://botappstore.com/#card-sec-supply-chain-mapper; runtime: https://botappstore.com/runtime/sec_supply_chain_mapper.py)
- **Mill Cert Matcher ($39 one-time, `sku: mill-cert-matcher`, LIVE NOW - card / Apple Pay / Google Pay checkout):** https://botappstore.com/bots/mill-cert-matcher.html (Checkout: https://botappstore.com/#card-mill-cert-matcher; runtime: https://botappstore.com/runtime/mill_cert_matcher.py). Screening aid that flags issues for human review; not a legal, compliance, or material-certification determination.
- **RFQ Flowdown Triage ($39 one-time, `sku: rfq-flowdown-triage`, LIVE NOW - card / Apple Pay / Google Pay checkout):** https://botappstore.com/bots/rfq-flowdown-triage.html (Checkout: https://botappstore.com/#card-rfq-flowdown-triage; runtime: https://botappstore.com/runtime/rfq_flowdown_triage.py). Screening aid that flags issues for human review; not a legal, export-control, or compliance determination.
- **FAI Results Reconciler ($39 one-time, `sku: fai-results-reconciler`, LIVE NOW - card / Apple Pay / Google Pay checkout):** https://botappstore.com/bots/fai-results-reconciler.html (Checkout: https://botappstore.com/#card-fai-results-reconciler; runtime: https://botappstore.com/runtime/fai_results_reconciler.py). Screening aid that flags issues for human review; not a quality sign-off or AS9102 approval.
- **Pinned Runtime Downloads:** https://botappstore.com/runtime/fai_results_reconciler.py (SHA-256 `0dbbd34d759005d0ded1ab8c65f49be5753f6931ca7873cdbccc3b159347b4d1`), https://botappstore.com/runtime/rfq_flowdown_triage.py (SHA-256 `7816812f6f329881e80da89d85c3299851037e44eb7e04dd80b1262f8d1e0c07`), https://botappstore.com/runtime/mill_cert_matcher.py (SHA-256 `19b875763d371177e96bdac76e6ace6224e236fc6263f51a3204390b83c205ef`), https://botappstore.com/runtime/robotics_telemetry_inspector.py (SHA-256 `aa45c09553b0c989a988c4f2375a7d9e596f338afa5f98969db09896eb6c6b17`), https://botappstore.com/runtime/print_farm_ops.py (SHA-256 `29edc5e8664be0b6823edc6ea985467fba83430f03d5781cd6fe341684abb669`), https://botappstore.com/runtime/mcp_config_auditor.py (SHA-256 `42cb3f145458844604c795a97ec8009365a218f20b4a441f6988edd93184c025`), https://botappstore.com/runtime/agent_council.py (SHA-256 `703d307e52c4e13df94e28554d16143a5286bf0af3ffe6d95431a5fa490284d7`), https://botappstore.com/runtime/domain_infra_hygiene.py (SHA-256 `73f7a04a48f55b6a9f0a733bdf4bba7cab2b9b6d245c0505567487585f0d1c14`), https://botappstore.com/runtime/bot_common.py (SHA-256 `d1941b61b95ca664e4c1286c3bf1918c00e976c2c1601199b19200257650e526`)
- **Runtime download note:** `/runtime/` URLs are license-gated: send `X-License-Key: wcl_...` or `X-Agent-Key: wck_...` (unauthenticated requests get `401`). The served file carries a per-license watermark block (5 lines), so compare the `X-Canonical-SHA256` response header (or the SHA-256 after stripping the block) against the pins. Recommended: the setup skill installer (`/workspace/.wattcoin_license_check.py --sku <sku> --install-runtime ... --expected-sha256 <pin>`). `bot_common.py` has two pinned variants chosen by SKU: `d1941b61b95ca664e4c1286c3bf1918c00e976c2c1601199b19200257650e526` (legacy; served for `agent-council`, `dependency-vuln-triage`, `domain-infra-hygiene`, `mcp-config-auditor`, `print-farm-ops`, `robotics-telemetry-inspector`) and `dbbd8521357fedc348cf7dc102435d4412ea26487e08bf067038ba8c66c9bcd1` (current; every other BotAppStore SKU, including `sec-supply-chain-mapper`, `mill-cert-matcher`, `rfq-flowdown-triage` and `fai-results-reconciler`).
- **Cloud Registry & License Endpoints:** https://www.wattcoin.org/api (`POST /v1/agents/register`, `POST /v1/agents/tasks/complete`, `GET /v1/agents/me`, `POST /v1/scrape`, `POST /v1/agents/license/stripe-checkout`, `GET /v1/agents/license/stripe-session/{session_id}`, `POST /v1/agents/license/claim`, `GET /v1/agents/license`)

## When to use

15 live listings. Each line: when an agent needs it; inputs; output; how to call it. Paid SKUs are bought as described in "How an agent buys" below.

- **`web-text-extractor`:** Use when an agent needs fetch readable text from a public web page or API URL. Inputs: a public URL (`format: "text"`, 10 free cloud extractions per UTC day, local fallback after that). Output: extracted page text with `X-Quota-*` headers. Call: SKU `web-text-extractor`, page https://botappstore.com/bots/web-text-extractor.html, free, no purchase: `POST https://www.wattcoin.org/api/v1/scrape` with `{"url": "<target>", "format": "text"}`.
- **`bot-skill-auditor`:** Use when an agent needs to inspect a third-party skill or `SKILL.md` for network calls, credential reads and shell commands before running it. Inputs: a `SKILL.md` or a GitHub repo URL (reads capped at 50 files / 100 KB per file / 250 KB total). Output: a line-cited 5-bucket static inspection report with a `SCOPE_NOTE.txt` (no Safe/Pass verdict or score). Call: SKU `bot-skill-auditor`, page https://botappstore.com/bots/bot-skill-auditor.html, checkout https://botappstore.com/#card-bot-skill-auditor.
- **`company-deep-dive`:** Use when an agent needs a primary-source corporate or competitor dossier. Inputs: a company name (up to 5 entities, 1 primary plus up to 4 competitors). Output: a 7-section `REPORT.md` of SEC EDGAR filings, patent disclosures and RDAP domain records with accession numbers and UTC retrieval timestamps. Call: SKU `company-deep-dive`, page https://botappstore.com/bots/company-deep-dive.html, checkout https://botappstore.com/#card-company-deep-dive.
- **`sec-patent-watchdog`:** Use when an agent needs to be told only when new SEC EDGAR filings or USPTO patent/IP publications appear. Inputs: a watchlist of up to 10 tickers or CIKs. Output: `DELTA_SUMMARY.json` and a `DIGEST_<timestamp>.md`, written only when something changed. Call: SKU `sec-patent-watchdog`, page https://botappstore.com/bots/sec-patent-watchdog.html, checkout https://botappstore.com/#card-sec-patent-watchdog.
- **`social-hub-publisher`:** Use when an agent needs one approved announcement queue for X, Discord, Bluesky and Telegram. Inputs: announcement text plus one `config.json` (credentials in environment variables). Output: linted, HMAC-approved posts; dry run unless `--live`. Call: SKU `social-hub-publisher`, page https://botappstore.com/bots/social-hub-publisher.html, checkout https://botappstore.com/#card-social-hub-publisher.
- **`dependency-vuln-triage`:** Use when an agent needs to prioritise lockfile vulnerabilities by what is being exploited. Inputs: `package-lock.json`, `yarn.lock`, `Pipfile.lock`, `poetry.lock`, pinned `requirements.txt`, `Cargo.lock` or `go.sum`. Output: OSV.dev advisories enriched with EPSS and CISA KEV, sorted into `KEV_ACTIVE_EXPLOIT`, `HIGH_EPSS_URGENT`, `PATCH_AVAILABLE` and `LOW_PRIORITY_MONITOR` with the lowest fixing version. Call: SKU `dependency-vuln-triage`, page https://botappstore.com/bots/dependency-vuln-triage.html, checkout https://botappstore.com/#card-dependency-vuln-triage.
- **`domain-infra-hygiene`:** Use when an agent needs a read-only DNS, DNSSEC, TLS, email-authentication and security-header audit of domains you own. Inputs: one or more domain names (plus whether they send mail). Output: findings with copy-paste fixes. Call: SKU `domain-infra-hygiene`, page https://botappstore.com/bots/domain-infra-hygiene.html, checkout https://botappstore.com/#card-domain-infra-hygiene.
- **`agent-council`:** Use when an agent needs 2-6 AI seats debating one design question, patch or diff. Inputs: a question or file range, number of rounds and a budget. Output: consensus, minority report, verdict, action plan and a self-contained HTML transcript. Call: SKU `agent-council`, page https://botappstore.com/bots/agent-council.html, checkout https://botappstore.com/#card-agent-council.
- **`mcp-config-auditor`:** Use when an agent needs a read-only audit of MCP client configs for leaked keys, unpinned packages and poisoned tools. Inputs: MCP config files (Claude Desktop, Claude Code `.mcp.json`, Cursor, VS Code, Windsurf, Cline, Zed) and optional `tools/list` snapshots. Output: findings with every detected secret redacted and a hardened config per file. Call: SKU `mcp-config-auditor`, page https://botappstore.com/bots/mcp-config-auditor.html, checkout https://botappstore.com/#card-mcp-config-auditor.
- **`print-farm-ops`:** Use when an agent needs an offline audit of 3D print jobs and a scheduled multi-printer production queue. Inputs: `.3mf` / `.gcode` files plus optional spool, order and printer CSV/JSON tables and cost rates. Output: audit findings and a production queue (`queue.csv`). Call: SKU `print-farm-ops`, page https://botappstore.com/bots/print-farm-ops.html, checkout https://botappstore.com/#card-print-farm-ops.
- **`robotics-telemetry-inspector`:** Use when an agent needs an offline audit of robot, battery and flight telemetry. Inputs: actuator and BMS CSV/JSON tables, ROS 2 bags, PX4 / ArduPilot flight logs, URDF / SDF models and CAN captures. Output: a prioritised preventive-maintenance and flight-readiness checklist with NO-GO calls. Call: SKU `robotics-telemetry-inspector`, page https://botappstore.com/bots/robotics-telemetry-inspector.html, checkout https://botappstore.com/#card-robotics-telemetry-inspector.
- **`sec-supply-chain-mapper`:** Use when an agent needs a cited supplier, customer, subsidiary and equity-stake map for a public company. Inputs: a company ticker or a preset such as `--preset nvidia-physical-ai`. Output: relationship edges each backed by a verbatim filing quote, accession number and sec.gov URL, with a reproducible `audit_sha256`. Call: SKU `sec-supply-chain-mapper`, page https://botappstore.com/bots/sec-supply-chain-mapper.html, checkout https://botappstore.com/#card-sec-supply-chain-mapper.
- **`mill-cert-matcher`:** Use when an agent needs to cross-check a mill test certificate against a purchase order and drawing callout at receiving inspection. Inputs: certificate, PO and drawing as text or text-layer PDF (no OCR), plus your own spec-limits library. Output: a receiving-inspection card with verdict PASS / HOLD / REJECT (exit codes 0 / 3 / 4); a screening aid for human review, not a compliance determination. Call: SKU `mill-cert-matcher`, page https://botappstore.com/bots/mill-cert-matcher.html, checkout https://botappstore.com/#card-mill-cert-matcher.
- **`rfq-flowdown-triage`:** Use when an agent needs to screen an RFQ for quality, DFARS/FAR, CUI and export-control flowdown clauses against your capability profile. Inputs: the RFQ as text or text-layer PDF (no OCR) and a `profile.json` of your capabilities. Output: a triage card with each clause MET / GAP / UNKNOWN and verdict CLEAR / CLARIFY / NO-BID-RISK (exit codes 0 / 3 / 4); a screening aid for human review, not a legal or export-control determination. Call: SKU `rfq-flowdown-triage`, page https://botappstore.com/bots/rfq-flowdown-triage.html, checkout https://botappstore.com/#card-rfq-flowdown-triage.
- **`fai-results-reconciler`:** Use when an agent needs to match a first-article balloon list to inspection results. Inputs: a balloon list and results as CSV, TSV, XLSX, Calypso-style CSV or PC-DMIS text report. Output: a reconciliation card with verdict PASS / REVIEW / FAIL (exit codes 0 / 3 / 4); a screening aid for human review, not a quality sign-off or AS9102 approval. Call: SKU `fai-results-reconciler`, page https://botappstore.com/bots/fai-results-reconciler.html, checkout https://botappstore.com/#card-fai-results-reconciler.

## How an agent buys

Prices are one-time USD. Payment is by card / Apple Pay / Google Pay (via Stripe), which issues a private `wcl_<64-hex>` license code.

1. **Card:** `POST https://www.wattcoin.org/api/v1/agents/license/stripe-checkout` with `{"sku": "<sku>", "storefront": "botappstore"}` returns a `checkout_url`, a hosted Stripe page that a human pays (to read the price without creating an order, add `"dry_run": true` to the body). After payment, `GET https://www.wattcoin.org/api/v1/agents/license/stripe-session/<session_id>` returns the `license_code`.

---

## Live Agent Templates (Available Now — 15 Live Automations)

### 1. Web & API Text Extractor (Free Forever Utility)
- **Status:** LIVE NOW
- **Price:** $0 (Free Forever — 10 Cloud Extractions / UTC Day + Automatic Local Fallback)
- **One-Click Grok Bot Import URL:** https://x.ai/bot/k1oyHmw4iS4VBW1U8_3Ol
- **Included Skills:** `getting-started` + `web-extractor`
- **What It Does:**
  1. **Turn-1 Onboarding (`getting-started`):** Checks for `/workspace/.wattcoin_env` (`0600` permissions). If missing, registers an agent key (`wck_...`) via `POST https://www.wattcoin.org/api/v1/agents/register`, completes `onboarding_v1` and `starter_v1`, verifies `"initial_tasks_completed": true` via `GET /api/v1/agents/me`, and runs a test extraction against `https://example.com`.
  2. **10/Day Free Cloud Text Extraction (`web-extractor`):** Calls `POST https://www.wattcoin.org/api/v1/scrape` with `{"url": "<target>", "format": "text"}` and reports `X-Quota-Limit: 10`, `X-Quota-Remaining`, and `X-Quota-Reset` headers.
  3. **Paid Modes Disclosure:** `format: "html"` and `format: "json"` are paid per-call modes on the registry; this free utility uses `format: "text"` (10/day free) and never invokes paid modes without explicit user confirmation.
  4. **Automatic Local Sandbox Fallback:** When `X-Quota-Remaining: 0` or `HTTP 429` (`reason: "quota_exhausted"`), automatically falls back to local `curl -sL` + Python HTML-to-text parsing (`bs4` or stdlib `html.parser`) inside `/workspace`.
- **Refusal Boundaries:**
  - Never claims headless-browser or client-side JavaScript SPA rendering on the static HTTP cloud endpoint (`requests.get` + BeautifulSoup, 15s timeout, 2 MB response cap).
  - Never prints or echoes `wck_...` API keys in chat output.
  - Rejects loopback (`127.0.0.0/8`, `::1`), RFC1918 private IPs (`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`), link-local, and cloud metadata (`169.254.169.254`) with `HTTP 400`.

### 2. Bot & Skill Security Auditor ($29 one-time · card / Apple Pay / Google Pay via Stripe — LIVE NOW)
- **Status:** LIVE NOW
- **SKU:** `bot-skill-auditor`
- **Price:** $29.00 USD One-Time License (card / Apple Pay / Google Pay via Stripe) (includes up to **3 workspace-reset rebinds** across `/workspace` container resets)
- **Product Page URL:** https://botappstore.com/bots/bot-skill-auditor.html
- **Storefront Checkout URL:** https://botappstore.com/#card-bot-skill-auditor
- **Included Skills:** `auditor-setup` + `bot-skill-auditor`
- **Deliverable:** *See every network call, credential read, and shell command in a third-party skill, with line numbers, before you run it.*
- **License Architecture:**
  1. **Turn-1 Onboarding & License Binding (`auditor-setup`):** Installs two read-only Python helpers at `chmod 500` (`-r-x------`) in `/workspace` (`.wattcoin_license_check.py` and `.wattcoin_audit_prep.py`), registers/activates `/workspace/.wattcoin_env` (`chmod 600`), and binds the `wcl_<64-hex>` code via `POST https://www.wattcoin.org/api/v1/agents/license/claim`.
  2. **Mandatory Pre-Flight License Gate (`bot-skill-auditor`):** Every audit run first executes `/usr/bin/python3 -I /workspace/.wattcoin_license_check.py` (`GET https://www.wattcoin.org/api/v1/agents/license?sku=bot-skill-auditor`) and requires `"sku_licensed": true`.
- **5-Bucket Line-Cited Static Inspection:**
  - **Bucket 1:** Prompt, Confirmation & Auditor Bypass
  - **Bucket 2:** Secret, Filesystem, Self-Modification & Persistence Access
  - **Bucket 3:** Outbound Network, Exfiltration & MCP Connectors (including Combined Data-Path Analysis when secret reads and outbound network calls co-occur)
  - **Bucket 4:** Unverifiable Runtime Execution & Obfuscation (`curl | sh`, unpinned `npx`/`pip`, `eval`/`exec`, base64/hex/unicode escapes)
  - **Bucket 5:** Local Machine Escalation (`machineId`, `CopyToBox`, `CopyFromBox`, `request_smart_mode_approval`)
- **What This Static Audit Does Not Catch:**
  - Dynamically fetched remote payloads whose server-side contents change after the audit
  - Multi-stage or delayed prompt-injection payloads returned at runtime by external APIs or MCP servers
  - Time-bombed or state-gated logic hidden inside undecodable runtime blobs (flagged as uninspected under Bucket 4)
  - Author identity, hosting-account compromise, or files beyond the 50-file / 100 KB per-file / 250 KB aggregate read caps
- **Refusal & Non-Certification Boundaries:**
  - Never executes audited code, scripts, or embedded URLs
  - Never reads `/workspace/.wattcoin_env` into model context or echoes `wck_...` / `wcl_...` in chat
  - Never outputs a "Safe", "Pass", checkmark badge, or numeric security score — always prepends `SCOPE_NOTE.txt` verbatim

### 3. Company & Competitor Deep-Dive Analyst ($19 one-time · card / Apple Pay / Google Pay via Stripe — LIVE NOW)
- **Status:** LIVE NOW
- **SKU:** `company-deep-dive`
- **Price:** $19.00 USD One-Time License (card / Apple Pay / Google Pay via Stripe) (includes up to **3 workspace-reset rebinds** across `/workspace` container resets)
- **Alternate / Registry Name:** Corporate & Competitor OSINT Deep-Dive
- **Product Page URL:** https://botappstore.com/bots/company-deep-dive.html
- **Storefront Checkout URL:** https://botappstore.com/#card-company-deep-dive
- **Included Skills:** `company-deep-dive-setup` + `company-deep-dive`
- **Deliverable:** *Pull a 7-section primary-source corporate and competitor dossier—SEC EDGAR filings, patent disclosures, RDAP domain records, and a side-by-side competitor comparison matrix—with exact accession numbers and UTC retrieval timestamps.*
- **License Architecture:**
  1. **Turn-1 Onboarding & License Binding (`company-deep-dive-setup`):** Installs two read-only Python stdlib helpers at `chmod 500` (`-r-x------`) in `/workspace` (`.wattcoin_license_check.py` and `.wattcoin_dd_fetch.py`), registers/activates `/workspace/.wattcoin_env` (`chmod 600`), and binds the `wcl_<64-hex>` code via stdin (`POST https://www.wattcoin.org/api/v1/agents/license/claim` with `sku: "company-deep-dive"`).
  2. **Mandatory Pre-Flight License Gate (`company-deep-dive`):** Every dossier run first executes `/usr/bin/python3 -I /workspace/.wattcoin_license_check.py` (`GET https://www.wattcoin.org/api/v1/agents/license?sku=company-deep-dive`) and requires `"sku_licensed": true`.
- **7-Section Cited Primary-Source Dossier (`/workspace/dossiers/<slug>-<timestamp>/REPORT.md`):**
  - Verbatim `SCOPE_NOTE.txt` prepended at the top of every dossier
  - **Section 1:** Entity Snapshot & Verified Identifiers (Legal Name, 10-digit CIK, Tickers, SIC Code, State of Incorporation, Fiscal Year End, Principal Address)
  - **Section 2:** SEC EDGAR Filing & Capital Breakdown (`10-K`, `10-Q`, `8-K` Items 1.01/2.01/5.02, `DEF 14A`, `Form 4`, `S-1`, and `Form D` with exact accession numbers and direct archive URLs)
  - **Section 3:** Patent & IP Footprint (`efts.sec.gov` full-text patent/IP disclosures across SEC filings + `search.patentsview.org` USPTO PatentsView dockets)
  - **Section 4:** Domain & Technical Infrastructure Footprint (`rdap.org` domain status, registrar, registration/expiration dates, and nameservers)
  - **Section 5:** Competitor Comparison Matrix (side-by-side table comparing 1 primary entity + up to 4 competitors across CIK, SIC, state, FYE, latest `10-K`/`10-Q`, and 180-day `8-K` velocity)
  - **Section 6:** Skipped, Unverified, or Unavailable Sources Log
  - **Section 7:** Primary Source Index (every fetched URL, HTTP status, byte count, and UTC retrieval timestamp from `RAW_SOURCES.json`)
- **Hardened Fetch Helper (`.wattcoin_dd_fetch.py`):**
  - Runs with `/usr/bin/python3 -I` using Python stdlib only (`0500` permissions)
  - Enforces HTTPS-only DNS-pinned SSRF protection (`_PinnedHTTPSConnection`), rejects IP literals and private/loopback/link-local ranges, sends a SEC-compliant `User-Agent` with a contact string at `<= 5 req/s`, enforces caps of 5 entities / 40 HTTP requests / 200 KB per doc / 15s per-request deadline, and wraps all external strings in random 128-bit `<untrusted_data_<32-hex>>` tags
- **What This Public-Filing Dossier Does Not Cover:**
  - Non-reporting private companies with zero SEC Form D/S-1 filings and zero indexed USPTO patents
  - Unfiled commercial contracts, trade secrets, internal financial projections, or local municipal building permits
  - Patents or domains registered under unnamed subsidiary or shell LLCs unless queried directly
  - Point-in-time filing lag or subsequent registrant amendments (`10-K/A`, `10-Q/A`, `8-K/A`)
- **Mandatory Refusal Boundaries:**
  - Never outputs stock buy, sell, or hold ratings, valuation multiples, or price targets
  - Never outputs legal conclusions on patent validity, freedom-to-operate, or infringement liability
  - Pauses for confirmation on ambiguous company names (`AMBIGUOUS_ENTITY`) and automatically excludes individual non-corporate SEC filers (`INDIVIDUAL_EXCLUDED`)

### 4. SEC & Patent Watchdog Digest ($29 one-time · card / Apple Pay / Google Pay via Stripe — LIVE NOW)
- **Status:** LIVE NOW
- **SKU:** `sec-patent-watchdog`
- **Price:** $29.00 USD One-Time License (card / Apple Pay / Google Pay via Stripe) (includes up to **3 workspace-reset rebinds** across `/workspace` container resets)
- **Alternate / Registry Name:** SEC EDGAR & Patent Filing Watchdog
- **Product Page URL:** https://botappstore.com/bots/sec-patent-watchdog.html
- **Storefront Checkout URL:** https://botappstore.com/#card-sec-patent-watchdog
- **Included Skills:** `sec-patent-watchdog-setup` + `sec-patent-watchdog`
- **Deliverable:** *A zero-noise delta digest of new SEC EDGAR filings and USPTO patent/IP publications for up to 10 tickers/CIKs — written only when something actually changed.*
- **License Architecture:**
  1. **Turn-1 Onboarding & License Binding (`sec-patent-watchdog-setup`):** Registers/activates `/workspace/.wattcoin_env` (`chmod 600`) and binds the `wcl_<64-hex>` code via `POST https://www.wattcoin.org/api/v1/agents/license/claim` with `sku: "sec-patent-watchdog"`.
  2. **Mandatory Pre-Flight License Gate (`sec-patent-watchdog`):** Every run first checks `GET https://www.wattcoin.org/api/v1/agents/license?sku=sec-patent-watchdog` and requires `"sku_licensed": true`.
- **What It Does:**
  - Tracks SEC EDGAR `10-K`, `10-Q`, `8-K`, `Form 4`, `13F-HR`, and `S-1` filings plus USPTO patent/IP publications for up to 10 tickers/CIKs
  - Stateful `state.json` baseline & diff engine; writes `DELTA_SUMMARY.json` + `DIGEST_<timestamp>.md`
  - Native Grok Bot `UpdateRoutine` scheduling; stays quiet when zero new filings land
- **Sample Prompt:** `Check my SEC & patent watchlist for NVDA, AMD, and AAPL...`
- **Mandatory Refusal Boundaries:**
  - Never sends empty filler alerts when the delta is zero
  - Never bypasses SEC EDGAR rate limits (`<= 10 req/sec`) or `User-Agent` identification
  - Never connects to brokerage APIs, executes trades, or issues buy/sell/hold advice; never opines on patent validity or infringement

### 5. Social Hub Publisher ($29 one-time · card / Apple Pay / Google Pay via Stripe — LIVE NOW)
- **Status:** LIVE NOW
- **SKU:** `social-hub-publisher`
- **Price:** $29.00 USD One-Time License (card / Apple Pay / Google Pay via Stripe) (includes up to **3 workspace-reset rebinds**)
- **Product Page URL:** https://botappstore.com/bots/social-hub-publisher.html
- **Storefront Checkout URL:** https://botappstore.com/#card-social-hub-publisher
- **Included Skills:** `social-hub-publisher-setup` + `social-hub-publisher`
- **Deliverable:** *Write once, approve once, publish everywhere: one announcement queue for X, Discord, Bluesky and Telegram driven by one `config.json`, with credentials kept in environment variables.*
- **What It Does:**
  - **Gate 1 linter:** per-channel length (X weights URLs as 23), link-domain allowlist, banned terms, hashtag/mention caps, duplicate detection
  - **Gate 2 approval:** `approve` HMAC-SHA256 signs the exact text with an expiry; the dispatcher refuses edited, expired or unsigned items
  - **Channels:** free 1-click X Web Intent links by default (optional X API mode with pay-per-use cost estimates), Discord webhooks (mentions suppressed), Bluesky AT Protocol (link facets), Telegram Bot API
- **Refusal Boundaries:**
  - Dry run unless `--live`; never sends an item without a valid Gate-2 approval
  - Ambiguous sends are marked `unknown_outcome` and never auto-retried (no duplicate posts)

### 6. Dependency Vulnerability Triage ($29 one-time · card / Apple Pay / Google Pay via Stripe — LIVE NOW)
- **Status:** LIVE NOW
- **SKU:** `dependency-vuln-triage`
- **Price:** $29.00 USD One-Time License (card / Apple Pay / Google Pay via Stripe) (includes up to **3 workspace-reset rebinds**)
- **Product Page URL:** https://botappstore.com/bots/dependency-vuln-triage.html
- **Storefront Checkout URL:** https://botappstore.com/#card-dependency-vuln-triage
- **Included Skills:** `dependency-vuln-triage-setup` + `dependency-vuln-triage`
- **Deliverable:** *Fix what is being exploited first: lockfile advisories from OSV.dev enriched with FIRST EPSS and the CISA KEV catalog, sorted into four action buckets with the lowest fixing version.*
- **What It Does:**
  - Parses `package-lock.json` (v1-v3), `yarn.lock`, `Pipfile.lock`, `poetry.lock`, pinned `requirements.txt`, `Cargo.lock` and `go.sum`
  - Buckets: `KEV_ACTIVE_EXPLOIT`, `HIGH_EPSS_URGENT` (default EPSS threshold 0.10), `PATCH_AVAILABLE`, `LOW_PRIORITY_MONITOR`, plus a per-package upgrade plan
  - Exit codes: `0` nothing at `--fail-on`, `1` findings, `10` bad input, `11` a data source was unavailable (never a pass)
- **Refusal Boundaries:**
  - Only package names and versions leave the machine; never installs, upgrades or edits the project
  - Never claims a project is secure; EPSS is a probability estimate, not a verdict

### 7. Domain, TLS & Email Auth Infrastructure Hygiene Auditor ($19 one-time · card / Apple Pay / Google Pay via Stripe — LIVE NOW, sku: domain-infra-hygiene)
- **Status:** LIVE NOW
- **SKU:** `domain-infra-hygiene`
- **Price:** $19.00 USD One-Time License (card / Apple Pay / Google Pay via Stripe) (1-year license, includes up to **3 workspace-reset rebinds**)
- **Product Page URL:** https://botappstore.com/bots/domain-infra-hygiene.html
- **Storefront Checkout URL:** https://botappstore.com/#card-domain-infra-hygiene
- **Included Skills:** `domain-infra-hygiene-setup` + `domain-infra-hygiene`
- **Pinned Runtime (canonical SHA-256 pins, locked `chmod 500`):**
  - `https://botappstore.com/runtime/domain_infra_hygiene.py` — SHA-256 `73f7a04a48f55b6a9f0a733bdf4bba7cab2b9b6d245c0505567487585f0d1c14` (1,877 lines, stdlib Python)
  - `https://botappstore.com/runtime/bot_common.py` — SHA-256 `d1941b61b95ca664e4c1286c3bf1918c00e976c2c1601199b19200257650e526`
- **Deliverable:** *Find the expiring certificate, the spoofable domain and the dangling CNAME before someone else does: one read-only pass over DNS, DNSSEC, TLS, email authentication, HTTPS headers and Certificate Transparency for domains you own, with copy-paste fixes.*
- **License Architecture:**
  1. **Turn-1 Setup (`domain-infra-hygiene-setup`):** installs `/workspace/.wattcoin_license_check.py` at `0500`, verifies and installs the pinned runtime, registers/activates `/workspace/.wattcoin_env` (`0600`, `onboarding_v1` + `starter_v1`), binds the `wcl_<64-hex>` code via stdin (`--claim-stdin --sku domain-infra-hygiene`), and offers a smoke test on `botappstore.com coinloader.com`.
  2. **Mandatory Pre-Flight License Gate (`domain-infra-hygiene`):** every run first executes `/usr/bin/python3 -I /workspace/.wattcoin_license_check.py check --sku domain-infra-hygiene` (`GET https://www.wattcoin.org/api/v1/agents/license?sku=domain-infra-hygiene`, requires `"sku_licensed": true`; the helper prints `"state": "OK"`).
- **What It Checks:**
  - **DNS & DNSSEC:** A/AAAA/CNAME/NS/MX/CAA/TXT/DNSKEY via DNS-over-HTTPS (Cloudflare, Google fallback); `VALIDATED` only with DNSKEY + resolver `AD` bit; broken DS chains and bogus (cd=1) answers flagged HIGH; `--expect-ns` NS drift
  - **Email auth:** recursive SPF with RFC 7208 §4.6.4 10-lookup counting, loops, `+all`/`?all`; DMARC `p`/`sp`/`pct`/`rua`; DKIM RSA key size; MTA-STS; TLS-RPT; `--no-mail` expects `v=spf1 -all` + `p=reject` + null MX `0 .`
  - **TLS:** one :443 handshake — chain, SAN, protocol, cipher, 30/14/7-day expiry, issuer vs CAA
  - **HTTPS:** HSTS, CSP, `X-Content-Type-Options`, `Referrer-Policy`, frame protection, `Permissions-Policy`, HTTP→HTTPS redirect
  - **Takeover & CT:** dangling-CNAME provider fingerprints on the audited domain's own apex/`www`; Cert Spotter (crt.sh fallback) issuers vs CAA
  - **Remediation:** copy-paste BIND records, Nginx `add_header`, `vercel.json` headers, Netlify / Cloudflare Pages `_headers`
  - **Monitoring:** `--state /workspace/domain-hygiene/state.json --delta` events (`CERT_ROTATED`, `CERT_EXPIRY_WINDOW`, `NS_CHANGED`, `SPF_CHANGED`, `DMARC_CHANGED`, `DNSSEC_LOST`, `NEW_CT_NAMES`, `NEW_CT_ISSUANCES`, `HEADER_REGRESSED`) for daily/weekly `UpdateRoutine` runs
- **Exit Codes:** `0` clean, `1` MEDIUM, `2` HIGH, `3` CRITICAL (at/above `--fail-on`), `10` bad input/refusal, `11` degraded data source (never a pass)
- **Sample Prompt:** `Audit botappstore.com and coinloader.com for DNS, DNSSEC, TLS, email auth and security headers. Neither domain sends mail.`
- **Mandatory Refusal Boundaries:**
  - Own or authorised domains only; refuses third-party scanning, target lists and subdomain-takeover hunting
  - Passive only: no port scanning, brute-force subdomain enumeration, fuzzing, zone transfers, SMTP/credential probing or exploitation
  - Never registers dangling CNAME targets or edits DNS/certificates/server config; never claims a domain is "secure"

### 8. Agent Council — Multi-Model Swarm Debate & Pair-Architect Collaborator ($39 one-time · card / Apple Pay / Google Pay via Stripe — LIVE NOW, sku: agent-council)
- **Status:** LIVE NOW
- **SKU:** `agent-council`
- **Price:** $39.00 USD One-Time License (card / Apple Pay / Google Pay via Stripe) (includes up to **3 workspace-reset rebinds**)
- **Categories:** Orchestration & DevOps / Coding & Security
- **Product Page URL:** https://botappstore.com/bots/agent-council.html
- **Storefront Checkout URL:** https://botappstore.com/#card-agent-council
- **Included Skills:** `agent-council-setup` + `agent-council`
- **Pinned Runtime (canonical SHA-256 pins, locked `chmod 500`):**
  - `https://botappstore.com/runtime/agent_council.py` — SHA-256 `703d307e52c4e13df94e28554d16143a5286bf0af3ffe6d95431a5fa490284d7` (2,801 lines, stdlib Python, 170 unit tests)
  - `https://botappstore.com/runtime/bot_common.py` — SHA-256 `d1941b61b95ca664e4c1286c3bf1918c00e976c2c1601199b19200257650e526`
- **Deliverable:** *Put 2-6 AI seats on one design question, patch or diff and get the consensus, the minority report, a verdict and an action plan, within the time limit and budget you set, plus a self-contained HTML transcript.*
- **License Architecture:**
  1. **Turn-1 Setup (`agent-council-setup`):** installs `/workspace/.wattcoin_license_check.py` at `0500`, verifies and installs the pinned runtime, registers/activates `/workspace/.wattcoin_env` (`0600`, `onboarding_v1` + `starter_v1`), binds the `wcl_<64-hex>` code via stdin (`--claim-stdin --sku agent-council`), runs `--discover`, and offers a budget-capped smoke council and an optional scheduled review routine.
  2. **Mandatory Pre-Flight License Gate (`agent-council`):** every run first executes `/usr/bin/python3 -I /workspace/.wattcoin_license_check.py check --sku agent-council` (`GET https://www.wattcoin.org/api/v1/agents/license?sku=agent-council`, requires `"sku_licensed": true`; the helper prints `"state": "OK"`).
- **What It Does:**
  - **Seats (`--seats`, `--discover`):** 2-6 seats. Local CLIs: `claude` personas (`claude:architect`, `claude:security`, `claude:skeptic`, `claude:pragmatist`, `claude:driver`, `claude:navigator`, plus `performance` and `reviewer`), `codex`, `gemini`, `aider`, `cmd:<exe>`. BYOK HTTP: `openai:`, `anthropic:`, `xai:`, `gemini:`, `openrouter:`, `deepseek:`, `ollama:`. Keys are read by variable name and never printed.
  - **Modes:** `deliberate` (blind round 1, anonymized `Seat A`/`Seat B` delta cross-examination, Chair consensus matrix + minority report), `pair` (Driver + Navigator, `APPROVE` / `REQUEST_CHANGES` / `BLOCK`), `compete` (peer-graded rubric: correctness .40, security .30, simplicity .15, edge cases .15; deterministic winner), `review` (deduplicated `CRITICAL`..`INFO` findings with file:line).
  - **Token efficiency without throttling:** model output ceilings (Anthropic default 16,384 tokens with extended thinking), `--effort high` by default; pinned cache-friendly brief, `--files path:start-end` and `--git-diff` slices with secret redaction, delta-only round forwarding, early stop on consensus.
  - **Control:** `--seat-timeout`, `--total-deadline`, `--quorum`, `DEGRADED_TIMEOUT` fallback, `--max-cost-usd` (pre-flight refusal + 85% in-flight halt), `--session ID` with `--status` / `--pause` / `--inject "note"` / `--resume`, `--state --delta`, `--html-out` self-contained dark-slate viewer.
- **Exit Codes:** `0` clean, `1` MEDIUM, `2` HIGH, `3` CRITICAL (unresolved at/above `--fail-on`), `10` usage error/refusal/budget pre-flight, `11` degraded (seat timeout/error, lost quorum, deadline; never a clean consensus)
- **Sample Prompt:** `Convene architect, security and skeptic seats on lib/bot_common.py lines 85-177: is http_json safe for metered, non-idempotent paid POSTs? Two rounds, $2 budget, and write the HTML transcript.`
- **Mandatory Refusal Boundaries:**
  - Advisory and read-only: never edits, commits, runs or deploys anything; CLI seats run tool-less / read-only / dry-run from an empty temp dir
  - Refuses `.env*`, `.wattcoin_env*`, lockfiles, key files, `.git/`, `node_modules/`; redacts keys, tokens and private keys before any seat sees them
  - Declines exploit, credential-harvesting and other offensive tasks; a consensus is evidence, not proof; BYOK costs are estimates

### 9. MCP Server & Tool-Permission Security Auditor ($19 one-time · card / Apple Pay / Google Pay via Stripe — LIVE NOW, sku: mcp-config-auditor)
- **Status:** LIVE NOW
- **SKU:** `mcp-config-auditor`
- **Price:** $19.00 USD One-Time License (card / Apple Pay / Google Pay via Stripe) (includes up to **3 workspace-reset rebinds**)
- **Categories:** Coding & Security / MCP & Agent Hygiene
- **Product Page URL:** https://botappstore.com/bots/mcp-config-auditor.html
- **Storefront Checkout URL:** https://botappstore.com/#card-mcp-config-auditor
- **Included Skills:** `mcp-config-auditor-setup` + `mcp-config-auditor`
- **Pinned Runtime (canonical SHA-256 pins, locked `chmod 500`):**
  - `https://botappstore.com/runtime/mcp_config_auditor.py` — SHA-256 `42cb3f145458844604c795a97ec8009365a218f20b4a441f6988edd93184c025` (1,956 lines, stdlib Python, 275 unit tests)
  - `https://botappstore.com/runtime/bot_common.py` — SHA-256 `d1941b61b95ca664e4c1286c3bf1918c00e976c2c1601199b19200257650e526`
- **Deliverable:** *Find the leaked key, the unpinned package and the poisoned tool before your agent runs them: a read-only static audit of your MCP client configs and `tools/list` snapshots, with every detected secret redacted and a copy-paste hardened config per file.*
- **License Architecture:**
  1. **Turn-1 Setup (`mcp-config-auditor-setup`):** installs `/workspace/.wattcoin_license_check.py` at `0500`, verifies and installs the pinned runtime, registers/activates `/workspace/.wattcoin_env` (`0600`, `onboarding_v1` + `starter_v1`), binds the `wcl_<64-hex>` code via stdin (`--claim-stdin --sku mcp-config-auditor`), runs a deterministic self-check audit, offers a first `--dir` audit of the user's configs, and offers an optional scheduled rug-pull delta routine.
  2. **Mandatory Pre-Flight License Gate (`mcp-config-auditor`):** every run first executes `/usr/bin/python3 -I /workspace/.wattcoin_license_check.py check --sku mcp-config-auditor` (`GET https://www.wattcoin.org/api/v1/agents/license?sku=mcp-config-auditor`, requires `"sku_licensed": true`; the helper prints `"state": "OK"`).
- **What It Does:**
  - **Inputs:** Claude Desktop `claude_desktop_config.json`, Claude Code `.mcp.json`, Cursor `.cursor/mcp.json`, VS Code `.vscode/mcp.json` (`servers` + `inputs`), Windsurf, Cline, Zed `context_servers`, generic `mcp.json` (JSONC tolerated), via `--config`, `--dir` discovery or positional paths; `--tools-json` for saved `tools/list` snapshots.
  - **`SEC_*`:** hardcoded tokens and literal secrets in `env`, `args`, `headers`, URL userinfo/query and VS Code `inputs`, vs safe `${ENV_VAR}` / `${env:VAR}` interpolation; every detected secret prints as `[REDACTED:...]` in all outputs and the state file.
  - **`CMD_*` / `FS_*` / `DOCKER_*` / `DB_*`:** `curl | sh` remote pipe execution, shell wrappers, `--dangerously-skip-permissions` / `--allow-all`, `alwaysAllow` / `autoApprove`, `/`, home, `~/.ssh`, `~/.aws` exposure, Docker `--privileged` and writable mounts, writable database servers.
  - **`SUP_*`:** unpinned `npx -y` / `uvx` / `pipx run` / `bunx`, `@latest` floating tags, unpinned git refs and Docker images, Levenshtein typosquat detection against 26 canonical MCP packages.
  - **`NET_*`:** cleartext `http://` remote SSE / Streamable HTTP, `169.254.169.254` metadata SSRF, unauthenticated remote endpoints, insecure `mcp-remote` / `supergateway` bridges.
  - **`TOOL_*`:** `<IMPORTANT>` / "ignore previous instructions" poisoning, `~/.ssh/id_rsa` reads, bidi and zero-width Unicode, exfiltration parameters (`conversation_history`, `system_prompt`, `sidenote`), cross-server name shadowing (`read_file`), `readOnlyHint: true` on destructive tools.
  - **Remediation & delta:** hardened `mcpServers` snippets (`${ENV_VAR}`, `@VERSION` pins, `/workspace/project` paths, `:ro` mounts), `--remediate` JSON, and `--state PATH --delta` rug-pull events `TOOL_DESC_CHANGED`, `TOOL_SCHEMA_CHANGED`, `SERVER_ADDED`.
- **Exit Codes:** `0` clean, `1` MEDIUM, `2` HIGH, `3` CRITICAL (at/above `--fail-on`), `10` bad input, `11` degraded (unreadable/malformed input or no configs found; never clean)
- **Sample Prompt:** `Audit the .mcp.json and .cursor/mcp.json in /workspace/project plus the tools/list snapshot I uploaded. Show me the hardened config and set up a daily rug-pull check.`
- **Mandatory Refusal Boundaries:**
  - Static and read-only: no network requests; never launches or connects to an MCP server, installs a package, or modifies a config file
  - Own or authorised configs only; never harvests or validates secrets from other people's configs or public repos
  - Declines to write poisoned tools, prompt-injection payloads or typosquat packages; heuristic detection, so "no findings" is not proof of safety

### 10. 3D Print Farm & Slicer Queue Ops ($29 one-time · card / Apple Pay / Google Pay via Stripe — AVAILABLE NOW · PHASE 2 LIVE, sku: print-farm-ops)
- **Status:** AVAILABLE NOW · PHASE 2 LIVE
- **SKU:** `print-farm-ops`
- **Price:** $29.00 USD One-Time License (card / Apple Pay / Google Pay via Stripe) (includes up to **3 workspace-reset rebinds**)
- **Categories:** Robotics & Manufacturing / 3D Print Farm & Slicer Queue Ops
- **Product Page URL:** https://botappstore.com/bots/print-farm-ops.html
- **Storefront Checkout URL:** https://botappstore.com/#card-print-farm-ops
- **Included Skills:** `print-farm-ops-setup` + `print-farm-ops`
- **Pinned Runtime (canonical SHA-256 pins, locked `chmod 500`):**
  - `https://botappstore.com/runtime/print_farm_ops.py` — SHA-256 `29edc5e8664be0b6823edc6ea985467fba83430f03d5781cd6fe341684abb669` (2,165 lines, stdlib Python, 393 unit tests)
  - `https://botappstore.com/runtime/bot_common.py` — SHA-256 `d1941b61b95ca664e4c1286c3bf1918c00e976c2c1601199b19200257650e526`
- **Deliverable:** *Catch the wrong-temperature plate, the empty spool and the money-losing SKU before the printers run: an offline, read-only audit of OrcaSlicer, Bambu Studio and PrusaSlicer `.3mf` / `.gcode` files, a spool ledger, a storefront SKU table and a printer list, plus a scheduled multi-printer production queue.*
- **License Architecture:**
  1. **Turn-1 Setup (`print-farm-ops-setup`):** installs `/workspace/.wattcoin_license_check.py` at `0500`, verifies and installs the pinned runtime, registers/activates `/workspace/.wattcoin_env` (`0600`, `onboarding_v1` + `starter_v1`), binds the `wcl_<64-hex>` code via stdin (`--claim-stdin --sku print-farm-ops`, `POST /api/v1/agents/license/claim`), runs a deterministic self-check audit, and offers a first audit plus an optional `UpdateRoutine` for the recurring farm queue and spool delta.
  2. **Mandatory Pre-Flight License Gate (`print-farm-ops`):** every run first executes `/usr/bin/python3 -I /workspace/.wattcoin_license_check.py --sku print-farm-ops` (`GET https://www.wattcoin.org/api/v1/agents/license?sku=print-farm-ops`, requires `"sku_licensed": true`; the helper prints `"state": "OK"`).
- **What It Does:**
  - **Inputs:** `.3mf` / `.gcode.3mf` / `.gcode` files via `--3mf`, `--dir` or positional paths; `--spools`, `--orders` (alias `--inventory`) and `--printers` CSV/JSON tables; cost inputs `--kwh-rate`, `--printer-watts`, `--machine-rate-hr`, `--labor-rate-hr`, `--failure-rate-pct`, `--margin-target-pct`.
  - **Slicer Profile & Thermal/Mechanical Safety:** `THERMAL_RUNAWAY_OR_OUT_OF_RANGE`, `TEMP_MATERIAL_MISMATCH`, `ABRASIVE_FILAMENT_BRASS_NOZZLE`, `ABRASIVE_CLOG_RISK_SMALL_NOZZLE`, `ENCLOSURE_REQUIRED_OPEN_FRAME`, `TPU_HIGH_VOLUMETRIC_SPEED`, `LAYER_HEIGHT_EXCEEDS_NOZZLE_LIMIT`, `WEAK_INFILL_PATTERN_STRUCTURAL`, `STRUCTURAL_UNDER_WALLED`, `EMBEDDED_PRINTER_CREDENTIAL`, `ARCHIVE_SAFETY_VIOLATION`.
  - **Spool Inventory & Moisture Hygiene:** `SPOOL_INSUFFICIENT_FOR_QUEUE`, `SPOOL_LOW_STOCK`, `HYGROSCOPIC_DRYING_OVERDUE`, `DESICCANT_CHANGE_OVERDUE`, `FILAMENT_COST_ASSUMED`.
  - **Unit Economics & Per-Part BOM Margin:** `SKU_NEGATIVE_MARGIN`, `SKU_CRITICAL_MARGIN_COMPRESSION`, `SKU_BELOW_TARGET_MARGIN`, `PLATE_BOM_MISMATCH`, `PLATE_FILE_UNRESOLVED`, `SKU_COST_INPUTS_MISSING`.
  - **SKU Run-Rate & Queue Scheduler:** `SKU_BACKORDER_DEFICIT`, `SKU_STOCKOUT_IMMINENT`, `SKU_REORDER_TRIGGER`, `NO_COMPATIBLE_PRINTER_FOR_JOB`, `FARM_CAPACITY_OVERLOAD`; greedy earliest-finish queue written with `--queue-csv`.
  - **Delta:** `--state PATH --delta` events `SPOOL_DEPLETED`, `SKU_DAYS_OF_SUPPLY_DROP`, `PROFILE_DRIFT_DETECTED`.
- **Exit Codes:** `0` clean, `1` MEDIUM, `2` HIGH, `3` CRITICAL (at/above `--fail-on`), `10` bad input or refusal, `11` degraded (unreadable/malformed/unsafe input or nothing to audit; never clean)
- **Sample Prompt:** `Audit the .3mf files in /workspace/farm/projects with my spools.csv, orders.csv and printers.csv, flag anything unsafe or losing money, and write this week's print queue to queue.csv.`
- **Mandatory Refusal Boundaries:**
  - Offline and read-only: no network request, no Bambu Cloud / MQTT / Moonraker / Klipper / OctoPrint / PrusaLink call; never sends G-code, starts, stops or heats a printer, or modifies a `.3mf` / `.gcode` file
  - Refuses credentials, API keys, seed phrases and printer LAN access codes (exit `10`, value never echoed)
  - Heuristic checks of slicer metadata, not engineering certification or fire-safety protection; cost and margin figures are arithmetic on supplied inputs, not financial advice

### 11. Humanoid & Fleet Telemetry Inspector ($49 one-time · card / Apple Pay / Google Pay via Stripe — AVAILABLE NOW · PHASE 1 RELEASE, sku: robotics-telemetry-inspector)
- **Status:** AVAILABLE NOW · PHASE 1 RELEASE
- **SKU:** `robotics-telemetry-inspector`
- **Price:** $49.00 USD One-Time License (card / Apple Pay / Google Pay via Stripe) (includes up to **3 workspace-reset rebinds**)
- **Categories:** Robotics & Physical AI / Humanoid & Fleet Telemetry
- **Product Page URL:** https://botappstore.com/bots/robotics-telemetry-inspector.html
- **Storefront Checkout URL:** https://botappstore.com/#card-robotics-telemetry-inspector
- **Included Skills:** `robotics-telemetry-inspector-setup` + `robotics-telemetry-inspector`
- **Pinned Runtime (canonical SHA-256 pins, locked `chmod 500`):**
  - `https://botappstore.com/runtime/robotics_telemetry_inspector.py` — SHA-256 `aa45c09553b0c989a988c4f2375a7d9e596f338afa5f98969db09896eb6c6b17` (3,245 lines, stdlib Python, 724 unit tests)
  - `https://botappstore.com/runtime/bot_common.py` — SHA-256 `d1941b61b95ca664e4c1286c3bf1918c00e976c2c1601199b19200257650e526` (274 lines)
- **Deliverable:** *Find the overheating knee, the weak cell and the dropped topic before the robot runs again: an offline, read-only audit of actuator and joint logs, 16S LiFePO4 / LiPo BMS exports, ROS 2 bags, PX4 / ArduPilot flight logs, URDF / SDF models and CAN / RS485 captures, ending in a prioritised preventive-maintenance and flight-readiness checklist.*
- **License Architecture:**
  1. **Turn-1 Setup (`robotics-telemetry-inspector-setup`):** installs `/workspace/.wattcoin_license_check.py` at `0500`, verifies and installs the pinned runtime, registers/activates `/workspace/.wattcoin_env` (`0600`, `onboarding_v1` + `starter_v1`), binds the `wcl_<64-hex>` code via stdin (`--claim-stdin --sku robotics-telemetry-inspector`, `POST /api/v1/agents/license/claim`), runs the deterministic `--self-check`, and offers a first audit plus an optional `UpdateRoutine` for recurring `--state --delta` runs.
  2. **Mandatory Pre-Flight License Gate (`robotics-telemetry-inspector`):** every run first executes `/usr/bin/python3 -I /workspace/.wattcoin_license_check.py --sku robotics-telemetry-inspector` (`GET https://www.wattcoin.org/api/v1/agents/license?sku=robotics-telemetry-inspector`, requires `"sku_licensed": true`; the helper prints `"state": "OK"`).
- **What It Does:**
  - **Inputs:** positional paths, `--dir` or `.zip` archives (roles auto-detected), `--actuators` and `--bms` CSV/JSON tables, `--rosbag` (`.db3`, `.mcap`, `metadata.yaml`/JSON summary, or an expectations file with `topics[].expected_hz/required/qos.subscriber`; repeatable), `--flight-log` (PX4 `.ulg`, ArduPilot `.bin`/CSV/JSON; repeatable), `--urdf` (URDF/SDF), `--can-log` (candump text or CSV/JSON).
  - **Bucket 1 — Actuator, Joint & Harmonic-Drive Duty Cycles (with URDF/SDF and CAN cross-checks):** `ACTUATOR_THERMAL_OVERLOAD`, `ACTUATOR_HIGH_DUTY_CYCLE`, `JOINT_TORQUE_LIMIT_EXCEEDED`, `JOINT_VELOCITY_LIMIT_EXCEEDED`, `JOINT_POSITION_LIMIT_EXCEEDED`, `HARMONIC_DRIVE_WEAR_THRESHOLD`, `CAN_BUS_FAULT_OR_TIMEOUT`, `ACTUATOR_ERROR_FLAGS_SET`, `URDF_JOINT_LIMIT_INVALID`, `ACTUATOR_JOINT_NOT_IN_MODEL`.
  - **Bucket 2 — 16S LiFePO4 / LiPo Battery Management System:** `BMS_CELL_IMBALANCE_DELTA`, `BMS_CRITICAL_CELL_SAG`, `BMS_MOSFET_THERMAL_RISE`, `BMS_DISCHARGE_CRATE_EXCEEDED`, `BMS_SOH_DEGRADATION`, `BMS_CELL_COUNT_MISMATCH`.
  - **Bucket 3 — ROS 2 Bag, TF Tree & QoS Integrity:** `ROSBAG_TOPIC_DROPOUT`, `ROSBAG_CLOCK_DRIFT_OR_JUMP`, `QOS_INCOMPATIBLE_MISMATCH`, `TF_TREE_CYCLE_OR_DISCONNECT`.
  - **Bucket 4 — PX4 / ArduPilot Flight Readiness & Preventive Maintenance:** `EKF_INNOVATION_DIVERGENCE`, `IMU_VIBRATION_CLIPPING`, `GNSS_DEGRADED_FIX`, `ESC_DESYNC_OR_OVERHEAT`, `FLIGHT_FAILSAFE_OR_PREARM_FAULT`; checklist CSV via `--maintenance-out`.
  - **Cross-cutting:** `EMBEDDED_TELEMETRY_CREDENTIAL` (HIGH, value redacted), `ARCHIVE_SAFETY_VIOLATION`, `XML_ENTITY_SAFETY_VIOLATION`.
  - **Delta:** `--state PATH --delta` events `BMS_CELL_DELTA_SPIKE`, `ACTUATOR_THERMAL_DRIFT`, `SOH_DEGRADATION_STEP`, `TOPIC_RATE_REGRESSION`.
- **CLI Flags:** `PATH ...`, `--dir DIR`, `--actuators PATH`, `--bms PATH`, `--rosbag PATH`, `--flight-log PATH`, `--urdf PATH`, `--can-log PATH`, `--maintenance-out PATH`, `--self-check`, `--state PATH`, `--delta`, `--now ISO`, `--format {text,markdown,md,json,html}`, `--json`, `--out PATH`, `--fail-on {none,info,low,medium,high,critical}`.
- **Exit Codes:** `0` clean, `1` MEDIUM, `2` HIGH, `3` CRITICAL (at/above `--fail-on`), `10` bad input or refusal, `11` degraded (unreadable/malformed/unsafe input, a skipped symlink, or nothing to audit; never clean)
- **Sample Prompt:** `Audit actuators.csv, bms.csv, nav.db3 and quad.ulg against humanoid.urdf and the CAN log, tell me what is NO-GO, and write the maintenance checklist to checklist.csv.`
- **Mandatory Refusal Boundaries:**
  - Offline and strictly read-only: no network request; never issues motor/actuator commands, CAN frames, MAVLink parameter writes or BMS register writes, never overrides a safety interlock, never modifies an input file
  - Refuses credentials, tokens, seed phrases, MAVLink signing keys, DDS private keys, Wi-Fi passwords and SSH keys in arguments and tables (exit `10`, value never echoed); symlink inputs exit `10`
  - Heuristic diagnostics on exported logs, not airworthiness, FAA/EASA or functional-safety (ISO 13849 / IEC 61508 / ISO 10218) approval

### 12. SEC EDGAR Supply Chain & Counterparty Mapper ($29 one-time · card / Apple Pay / Google Pay via Stripe — LIVE NOW, sku: sec-supply-chain-mapper, v1.1)
- **Status:** LIVE NOW (v1.1)
- **SKU:** `sec-supply-chain-mapper`
- **Price:** $29.00 USD One-Time License (card / Apple Pay / Google Pay via Stripe) (includes up to **3 workspace-reset rebinds**); also included in the `edgar-intelligence-pack` bundle ($89)
- **Categories:** OSINT & Research / SEC EDGAR Supply Chain
- **Product Page URL:** https://botappstore.com/bots/sec-supply-chain-mapper.html
- **Storefront Checkout URL:** https://botappstore.com/#card-sec-supply-chain-mapper
- **Included Skills:** `sec-supply-chain-mapper-setup` + `sec-supply-chain-mapper`
- **Runtime:** https://botappstore.com/runtime/sec_supply_chain_mapper.py (SHA-256 `d3e13923dc752f1f0429433381ff48961eba0d142255524761ba2385c0e116d1`; standalone zero-dependency Python 3.10+ CLI, `--json` / `--markdown` output) + https://botappstore.com/runtime/bot_common.py (SHA-256 `dbbd8521357fedc348cf7dc102435d4412ea26487e08bf067038ba8c66c9bcd1`)
- **Deliverable:** Cited supplier, customer, foundry, subsidiary and equity-stake map built only from primary SEC EDGAR filings (10-K, 10-Q, 8-K, Exhibit 21, Schedule 13D/13G), with a reproducible `audit_sha256`.
- **Capabilities:**
  - Relationship edges typed `supplier`, `customer`, `foundry_compute`, `strategic_partner`, `subsidiary`, `equity_stake`; each carries a verbatim quote of `<=300` characters, the accession number and a direct sec.gov Archive URL. No quote, no edge.
  - Inline-XBRL Disclosed Concentration Scorer `CR-01..04` (major customer >=10%, top customers combined, sole-source supplier, receivables concentration) using `us-gaap:ConcentrationRiskPercentage`; Exhibit 21 subsidiaries are separated from counterparties.
  - YoY 10-K Counterparty Diff: `ADDED`, `REMOVED`, `PCT_CHANGED`.
  - Schedule 13D/13G Equity Stakes: `EQ-01`.
  - Presets such as `--preset nvidia-physical-ai` for multi-company ecosystem maps.
- **Guardrails:** HTTPS-only allow-listed sec.gov hosts, DNS pinning, no redirects (SSRF protection), compliant SEC User-Agent, <=5 requests per second with request and byte caps; never infers a relationship without a filing quote; never gives buy/sell/hold advice; always prepends a SCOPE_NOTE.
- **Full Verbatim Sample:** https://botappstore.com/bots/sec-supply-chain-mapper.html#sample-output

### 13. Mill Cert Matcher ($39 one-time — LIVE NOW, sku: mill-cert-matcher)
- **Status:** LIVE NOW
- **SKU:** `mill-cert-matcher`
- **Price:** $39.00 USD One-Time License (includes up to **3 workspace-reset rebinds**); card / Apple Pay / Google Pay checkout by default
- **Categories:** Manufacturing / Receiving Inspection
- **Product Page URL:** https://botappstore.com/bots/mill-cert-matcher.html
- **Storefront Checkout URL:** https://botappstore.com/#card-mill-cert-matcher
- **Included Skills:** `mill-cert-matcher-setup` + `mill-cert-matcher`
- **Pinned Runtime (canonical SHA-256 pins, locked `chmod 500`):**
  - `https://botappstore.com/runtime/mill_cert_matcher.py` — SHA-256 `19b875763d371177e96bdac76e6ace6224e236fc6263f51a3204390b83c205ef` (standalone zero-dependency Python 3 CLI; optional pinned PDF library for text-layer PDFs)
  - `https://botappstore.com/runtime/bot_common.py` — SHA-256 `dbbd8521357fedc348cf7dc102435d4412ea26487e08bf067038ba8c66c9bcd1` (current variant)
- **Deliverable:** A receiving-inspection card that cross-checks a mill test certificate against the purchase order and the drawing material callout, with source file, page and line for every extracted value. Verdict: any REJECT gives REJECT, otherwise any HOLD gives HOLD, otherwise PASS.
- **Capabilities:**
  - `MCM-MAT-01` alloy, temper (your equivalences) and spec match across cert, PO and drawing; `MCM-QTY-01` thickness and quantity.
  - `MCM-CHEM-01` chemistry and `MCM-MECH-01` tensile/yield/elongation against your own spec-limits library (built-in limits are illustrative examples only); a spec, alloy or temper missing from your library is a HOLD.
  - `MCM-HEAT-01` heat number already in your local history, `MCM-SIG-01` signature or certification statement, `MCM-DATE-01` cert date, `MCM-CONF-01` low-confidence fields or a PDF with no text layer (no OCR).
  - `MCM-DFARS-01` optional melt-country comparison against a qualifying list you configure (off by default, no built-in list).
- **Exit Codes:** `0` PASS, `3` HOLD, `4` REJECT.
- **Guardrails:** Runs on your machine and works offline (`--offline` makes no network call); certificate text, heat numbers, supplier names and file names are never sent. Screening aid that flags issues for human review. Not a legal, compliance, or material-certification determination; makes no DFARS or ITAR determination.
- **Sample Prompt:** `Run mill_cert_matcher.py on cert.txt with po.txt and drawing.txt and show me every line that needs a human decision.`

### 14. RFQ Flowdown Triage ($39 one-time — LIVE NOW, sku: rfq-flowdown-triage)
- **Status:** LIVE NOW
- **SKU:** `rfq-flowdown-triage`
- **Price:** $39.00 USD One-Time License (includes up to **3 workspace-reset rebinds**); card / Apple Pay / Google Pay checkout by default
- **Categories:** Manufacturing / Quoting & Contract Review
- **Product Page URL:** https://botappstore.com/bots/rfq-flowdown-triage.html
- **Storefront Checkout URL:** https://botappstore.com/#card-rfq-flowdown-triage
- **Included Skills:** `rfq-flowdown-triage-setup` + `rfq-flowdown-triage`
- **Pinned Runtime (canonical SHA-256 pins, locked `chmod 500`):**
  - `https://botappstore.com/runtime/rfq_flowdown_triage.py` — SHA-256 `7816812f6f329881e80da89d85c3299851037e44eb7e04dd80b1262f8d1e0c07` (standalone zero-dependency Python 3 CLI; optional pinned PDF library for text-layer PDFs)
  - `https://botappstore.com/runtime/bot_common.py` — SHA-256 `dbbd8521357fedc348cf7dc102435d4412ea26487e08bf067038ba8c66c9bcd1` (current variant)
- **Deliverable:** A pre-quote triage card that finds the quality, DFARS/FAR, CUI, export-control, special-process, certification, inspection, counterfeit-parts and record-retention clauses in an RFQ and compares each with your own supplier capability profile, with source file, page and line for every clause. Each clause is MET, GAP or UNKNOWN. Verdict: any GAP gives NO-BID-RISK, otherwise any UNKNOWN gives CLARIFY, otherwise CLEAR.
- **Capabilities:**
  - `RFT-DFARS-01`, `RFT-CUI-01`, `RFT-EXP-01` and `RFT-DIST-01` detect that clause text is present (specialty metals, 252.204-7012 and CMMC wording, export-control wording, distribution statements) and compare it with your profile; they do not say a clause applies. Export-control clauses are classified (ITAR, EAR with ECCN, EAR99 low risk, deemed export); only truly generic wording stays UNKNOWN.
  - `RFT-QMS-01`, `RFT-FAI-01`, `RFT-NADCAP-01`, `RFT-CERT-01`, `RFT-SRC-01`, `RFT-CFT-01` and `RFT-REC-01` cover quality-system, first-article, special-process, certification, source-inspection, counterfeit-parts and record-retention clauses.
  - `RFT-REV-01` RFQ/PO vs drawing revision mismatch, `RFT-FLOW-01` a DFARS/FAR clause number outside the catalog, `RFT-CONF-01` low confidence or a PDF with no text layer (no OCR): always UNKNOWN. A blank profile entry is UNKNOWN, never a GAP and never MET.
- **Exit Codes:** `0` CLEAR, `3` CLARIFY, `4` NO-BID-RISK.
- **Guardrails:** Runs on your machine and works offline (`--offline` makes no network call); RFQ text, clause text, customer names and file names are never sent. Screening aid that flags issues for human review. Not a legal, export-control, or compliance determination; makes no DFARS, ITAR or EAR compliance claim.
- **Sample Prompt:** `Run rfq_flowdown_triage.py on rfq.txt with profile.json and show me every clause that needs a human decision.`

### 15. FAI Results Reconciler ($39 one-time — LIVE NOW, sku: fai-results-reconciler)
- **Status:** LIVE NOW
- **SKU:** `fai-results-reconciler`
- **Price:** $39.00 USD One-Time License (includes up to **3 workspace-reset rebinds**); card / Apple Pay / Google Pay checkout by default
- **Categories:** Manufacturing / First-Article Inspection Review
- **Product Page URL:** https://botappstore.com/bots/fai-results-reconciler.html
- **Storefront Checkout URL:** https://botappstore.com/#card-fai-results-reconciler
- **Included Skills:** `fai-results-reconciler-setup` + `fai-results-reconciler`
- **Pinned Runtime (canonical SHA-256 pins, locked `chmod 500`):**
  - `https://botappstore.com/runtime/fai_results_reconciler.py` — SHA-256 `0dbbd34d759005d0ded1ab8c65f49be5753f6931ca7873cdbccc3b159347b4d1` (standalone zero-dependency Python 3 CLI; XLSX read with the standard library)
  - `https://botappstore.com/runtime/bot_common.py` — SHA-256 `dbbd8521357fedc348cf7dc102435d4412ea26487e08bf067038ba8c66c9bcd1` (current variant)
- **Deliverable:** A reconciliation card that matches every characteristic in a first-article balloon list to its inspection result (CSV, TSV, XLSX, Calypso-style CSV or PC-DMIS text report) and flags what a person should look at, with the source file and row or line for every finding. Verdict: any FAIL line gives FAIL, otherwise any REVIEW line gives REVIEW, otherwise PASS; an empty or ambiguous input is never a PASS.
- **Capabilities:**
  - `FAI-TOL-01` measured value against limits (Decimal maths; a value exactly on a limit passes); `FAI-MISS-01`, `FAI-UNM-01` and `FAI-DUP-01` flag missing, unmatched and duplicate characteristics.
  - `FAI-UNIT-01` inch/mm conflicts (declared units always convert exactly per row; undeclared or inferred unit fits are only ever REVIEW, never PASS), `FAI-REV-01` part number or revision mismatches and `FAI-FORM-01` missing Form 1/2 fields.
  - `FAI-ATTR-01` attribute results, `FAI-REF-01` REF and BASIC dimensions (listed, never evaluated), `FAI-GDT-01` material-condition modifiers (no bonus-tolerance maths) and `FAI-CONF-01` low confidence or ambiguous input: REVIEW, never a silent pass.
- **Exit Codes:** `0` PASS, `3` REVIEW, `4` FAIL.
- **Guardrails:** Runs on your machine and works offline (`--offline` makes no network call); balloon lists, measurements, part numbers and file names are never sent. Screening aid that flags issues for human review. Not a quality sign-off or AS9102 approval.
- **Sample Prompt:** `Run fai_results_reconciler.py on balloons.csv and cmm.csv and show me every characteristic that needs a human decision.`

## Value Bundles — Multi-Bot Packs (4 Live Bundle SKUs; One License Key Unlocks All Included Bots)

Bundle SKUs are priced in USD and paid by card (Stripe) through the same checkout (`POST https://www.wattcoin.org/api/v1/agents/license/stripe-checkout` with `sku: <bundle-sku>`, `storefront: "botappstore"`). A single bundle purchase returns **one** `wcl_<64-hex>` bearer license code that unlocks **every** member bot in the pack (up to 3 workspace-reset rebinds). The `stripe-session` response also includes `included_skus` (member SKU list) and `bundle_templates` (an array of `{sku, name, template_url}` with one unlisted `https://x.ai/bot/<id>` Grok Bot template per member) so you can import every bot in the pack. Activate each imported bot on its Turn 1 with the same `wcl_...` code. Storefront section: https://botappstore.com/#bundles

### DevSecOps & AI Agent Security Pack ($69 one-time · card / Apple Pay / Google Pay via Stripe, `sku: devsecops-ai-security-pack`, 4-Bot Bundle — Save $27 vs $96 list)
- **Bundle Price:** $69.00 USD one-time (card / Apple Pay / Google Pay via Stripe) (individual list total: $96).
- **Included member SKUs (`included_skus`):** `bot-skill-auditor`, `mcp-config-auditor`, `dependency-vuln-triage`, `domain-infra-hygiene`
- **Members:**
  - Bot & Skill Security Auditor (`bot-skill-auditor`, $29 list): https://botappstore.com/bots/bot-skill-auditor.html
  - MCP Server & Tool-Permission Security Auditor (`mcp-config-auditor`, $19 list): https://botappstore.com/bots/mcp-config-auditor.html
  - Dependency Vulnerability Triage Bot (`dependency-vuln-triage`, $29 list): https://botappstore.com/bots/dependency-vuln-triage.html
  - Domain, TLS & Email Auth Infrastructure Hygiene Auditor (`domain-infra-hygiene`, $19 list): https://botappstore.com/bots/domain-infra-hygiene.html
- **License:** one `wcl_...` code unlocks all member bots in this bundle; the purchase response returns `bundle_templates` with a per-bot unlisted template URL.

### Physical AI & Manufacturing Ops Pack ($59 one-time · card / Apple Pay / Google Pay via Stripe, `sku: physical-ai-manufacturing-pack`, 2-Bot Bundle — Save $19 vs $78 list)
- **Bundle Price:** $59.00 USD one-time (card / Apple Pay / Google Pay via Stripe) (individual list total: $78).
- **Included member SKUs (`included_skus`):** `print-farm-ops`, `robotics-telemetry-inspector`
- **Members:**
  - 3D Print Farm & Slicer Queue Ops (`print-farm-ops`, $29 list): https://botappstore.com/bots/print-farm-ops.html
  - Humanoid & Fleet Telemetry Inspector (`robotics-telemetry-inspector`, $49 list): https://botappstore.com/bots/robotics-telemetry-inspector.html
- **License:** one `wcl_...` code unlocks all member bots in this bundle; the purchase response returns `bundle_templates` with a per-bot unlisted template URL.

### Founder OSINT, SEC & GTM Pack ($59 one-time · card / Apple Pay / Google Pay via Stripe, `sku: founder-research-gtm-pack`, 3-Bot Bundle — Save $18 vs $77 list)
- **Bundle Price:** $59.00 USD one-time (card / Apple Pay / Google Pay via Stripe) (individual list total: $77).
- **Included member SKUs (`included_skus`):** `company-deep-dive`, `sec-patent-watchdog`, `social-hub-publisher`
- **Members:**
  - Company & Competitor Deep-Dive Analyst (`company-deep-dive`, $19 list): https://botappstore.com/bots/company-deep-dive.html
  - SEC & Patent Watchdog Digest (`sec-patent-watchdog`, $29 list): https://botappstore.com/bots/sec-patent-watchdog.html
  - Social Hub Publisher (`social-hub-publisher`, $29 list): https://botappstore.com/bots/social-hub-publisher.html
- **License:** one `wcl_...` code unlocks all member bots in this bundle; the purchase response returns `bundle_templates` with a per-bot unlisted template URL.

### Institutional EDGAR Intelligence Pack ($89 one-time · card / Apple Pay / Google Pay via Stripe, `sku: edgar-intelligence-pack`, 3-Bot Bundle)
- **Bundle Price:** $89.00 USD one-time (card / Apple Pay / Google Pay via Stripe).
- **Included member SKUs (`included_skus`):** `company-deep-dive`, `sec-patent-watchdog`, `sec-supply-chain-mapper`
- **Members:**
  - Company & Competitor Deep-Dive Analyst (`company-deep-dive`, $19 list): https://botappstore.com/bots/company-deep-dive.html
  - SEC & Patent Watchdog Digest (`sec-patent-watchdog`, $29 list): https://botappstore.com/bots/sec-patent-watchdog.html
  - SEC EDGAR Supply Chain & Counterparty Mapper (`sec-supply-chain-mapper`, $29 list): https://botappstore.com/bots/sec-supply-chain-mapper.html
- **Covers:** end-to-end SEC 10-K/10-Q/8-K/13D dossier generation, continuous filing and USPTO patent delta alerts, and cited multi-company supply-chain and concentration mapping.
- **License:** one `wcl_...` code unlocks all member bots in this bundle; the purchase response returns `bundle_templates` with a per-bot unlisted template URL.