feat: register and audit agent-wallet rules on-chain

[MicBun]

resolves: resolves: https://github.com/truflation/website/issues/4035

What

Part 2 of the Modular Agent Addresses (MAA) rule store: the node migration with the rule tables, maa_create, and the
public getters. Stacked on the precompiles PR — this PR's diff is the SQL plus integration tests; the precompiles it
calls live in the base branch.

Depends on (review/merge first):

• chore: derive an agent wallet's address from its rules #1387

Changes

• Migration 048-maa.sql: maa_rules, maa_allowed_actions, maa_events (append-only audit), maa_create (the
  restricted/agent key signs), and 6 public getters. The rule is set once at creation and immutable — committed into
  the wallet address via rules_hash. The node computes rules_hash on-chain (never trusts a caller-supplied value), so
  the address provably commits to the stored rule.
• Integration suite (tests/streams/maa/): asserts on-chain maa_create reproduces the golden-vector address, plus
  validation and audit behavior.

Testing

• go test -tags kwiltest ./tests/streams/maa/ — pass (~56s)

Notes for reviewers

• Rule store only. The execution mechanism (agent acting as the wallet), the theft-prevention gate, and the
  withdrawal/fee path are later work, not in this PR.
• Two design points are still pending a leadership decision and would need a follow-up if answered against the current
  design: (1) whether the funding address and the wallet address are one identity (this PR makes them one); (2) whether
  rules stay immutable or become editable (this PR is immutable).

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 78c90c53-8fb7-4ee0-8f95-f06af2ab57cb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/maa-migration

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[holdex]

Time Submission Status

Member	Status	Time	Action	Last Update
MicBun	✅ Submitted	4h	Update time	Jun 1, 2026, 9:17 PM

---

You can submit time with the command. Example:

@holdex pr submit-time 15m

See available commands to help comply with our Guidelines.

[MicBun]

@holdex pr submit-time 4h