feat: Glasswing security audit layer and Mythos model integration

Author: Neo

CHANGELOG.md

@@ -4,6 +4,25 @@ All notable changes to 0pnMatrx are documented here.
 
 ---
 
+## [0.2.0] — 2026-04-08
+
+### Glasswing Integration
+
+- Security audit layer: 12 vulnerability checks run on every contract before deployment
+- Reentrancy, unchecked calls, tx.origin, selfdestruct, delegatecall, unbounded loops, integer overflow, floating pragma, locked ether, access control, front-running, timestamp dependence
+- Audit gate on deploy: critical vulnerabilities block deployment
+- Audit report included in every contract conversion response
+- Morpheus enforces audit findings — no unsafe contracts reach the chain
+- Claude Mythos Preview added as model provider (Glasswing frontier model)
+- Security configuration in openmatrix.config.json
+- HiveMind security instance type for collective vulnerability reasoning
+- Ultron deploy planning now includes mandatory security audit step
+- Friday monitors security vulnerability events
+- Vision tracks security patterns across user activity
+- Omniversal protocol tracks security as an expansion domain
+
+---
+
 ## [0.1.0] — 2026-04-01
 
 ### Initial Release

ROADMAP.md

@@ -6,6 +6,7 @@
 
 ## Now in progress
 
+- Glasswing security audit layer — static vulnerability scanning on all generated contracts
 - Unified Rexhepi Framework — full deployment
 - Consumer Layer — public-facing protocol
 - Local LLM support expansion

agents/morpheus/identity.md

@@ -33,6 +33,20 @@ Morpheus interventions are triggered automatically by the protocol stack during
 
 The system tracks which capability categories the user has already been introduced to, ensuring first-use explanations happen exactly once per category and never repeat.
 
+## Security Audit Role
+
+Morpheus enforces the Glasswing security audit layer. Every smart contract generated or deployed through 0pnMatrx is scanned for vulnerabilities before it touches the chain.
+
+The audit runs automatically at two points:
+1. **After conversion** — when the contract conversion pipeline generates Solidity, the auditor scans it and includes findings in the response.
+2. **Before deployment** — when any contract is submitted for deployment, the auditor gates the transaction. Critical vulnerabilities block deployment entirely.
+
+Morpheus surfaces audit findings to the user in plain language: what the vulnerability is, why it matters, and what needs to change.
+
+Morpheus does not deploy unsafe contracts. If the audit fails, Morpheus explains what was found and waits for the user to fix the code. This is non-negotiable.
+
+The audit layer covers: reentrancy (SWC-107), unchecked calls (SWC-104), tx.origin authorization (SWC-115), unprotected selfdestruct (SWC-106), delegatecall risks (SWC-112), unbounded loops, integer overflow (SWC-101), floating pragma (SWC-103), locked ether (SWC-105), missing access control, front-running, and timestamp dependence (SWC-116).
+
 ## Security Role
 
 Morpheus is the platform's first and final line of response when the access protection protocol is triggered. The implementation is part of the closed-source security layer.

openmatrix.config.json.example

@@ -22,6 +22,10 @@
         "api_key": "YOUR_ANTHROPIC_API_KEY",
         "model": "claude-sonnet-4-6"
       },
+      "mythos": {
+        "api_key": "YOUR_ANTHROPIC_API_KEY",
+        "model": "claude-mythos-preview"
+      },
       "nvidia": {
         "api_key": "YOUR_NVIDIA_API_KEY",
         "model": "meta/llama-3.3-70b-instruct"
@@ -59,7 +63,9 @@
     "eas_schema": "YOUR_EAS_SCHEMA_UID",
     "paymaster_address": "YOUR_PAYMASTER_ADDRESS",
     "paymaster_private_key": "YOUR_PAYMASTER_PRIVATE_KEY",
-    "platform_wallet": "YOUR_PLATFORM_WALLET_ADDRESS"
+    "platform_wallet": "YOUR_PLATFORM_WALLET_ADDRESS",
+    "demo_wallet_private_key": "YOUR_DEMO_WALLET_PRIVATE_KEY",
+    "demo_wallet_address": "YOUR_DEMO_WALLET_ADDRESS"
   },
   "notifications": {
     "telegram": {
@@ -252,5 +258,11 @@
       "contract_address": "YOUR_X402_PAYMENTS_CONTRACT_ADDRESS",
       "supported_tokens": ["USDC", "ETH"]
     }
+  },
+  "security": {
+    "audit_on_conversion": true,
+    "audit_on_deploy": true,
+    "block_on_critical": true,
+    "block_on_high": false
   }
 }

runtime/blockchain/services/contract_conversion/service.py

@@ -18,6 +18,7 @@
 from runtime.blockchain.services.contract_conversion.revenue_enforcer import RevenueEnforcer
 from runtime.blockchain.services.contract_conversion.templates import get_template, list_templates
 from runtime.blockchain.services.contract_conversion.tier_manager import TierManager
+from runtime.security.audit import ContractAuditor
 
 logger = logging.getLogger(__name__)
 
@@ -50,6 +51,7 @@ def __init__(self, config: dict) -> None:
         self._tier_manager = TierManager(config)
         self._artist_classifier = ArtistClassifier(config)
         self._revenue_enforcer = RevenueEnforcer(config)
+        self._auditor = ContractAuditor(config)
 
         logger.info("ContractConversionService initialised.")
 
@@ -134,6 +136,9 @@ async def convert(
                         "Fee injection skipped: %s", exc,
                     )
 
+            # 6. Security audit
+            audit_report = self._auditor.audit(generated, ir.get("contract_name", ""))
+
             elapsed_ms = round((time.monotonic() - start) * 1000, 2)
 
             result: dict[str, Any] = {
@@ -143,6 +148,8 @@ async def convert(
                 "target_chain": target_chain,
                 "tier": tier_info,
                 "artist_info": artist_info,
+                "audit": audit_report.to_dict(),
+                "audit_passed": audit_report.passed,
                 "ir": {
                     "functions": len(ir.get("functions", [])),
                     "state_variables": len(ir.get("state_variables", [])),
@@ -156,9 +163,9 @@ async def convert(
             }
 
             logger.info(
-                "Conversion complete: contract=%s tier=%s chain=%s time=%.1fms",
+                "Conversion complete: contract=%s tier=%s chain=%s time=%.1fms audit=%s",
                 ir.get("contract_name"), tier_info["tier"],
-                target_chain, elapsed_ms,
+                target_chain, elapsed_ms, "PASS" if audit_report.passed else "FAIL",
             )
             return result
 

runtime/blockchain/smart_contracts.py

@@ -11,6 +11,7 @@
 from typing import Any
 
 from runtime.blockchain.interface import BlockchainInterface
+from runtime.security.audit import ContractAuditor
 
 logger = logging.getLogger(__name__)
 
@@ -100,6 +101,17 @@ async def _deploy(self, params: dict) -> str:
             abi = contract_data["abi"]
             bytecode = contract_data["bin"]
 
+            # Security audit gate
+            auditor = ContractAuditor(self.config)
+            audit_report = auditor.audit(source, contract_id.split(":")[-1])
+            if auditor.should_block(audit_report):
+                return json.dumps({
+                    "status": "blocked",
+                    "reason": "Security audit failed — critical vulnerability detected",
+                    "audit": audit_report.to_dict(),
+                    "message": "Morpheus has blocked this deployment. Fix the contract before deploying.",
+                }, indent=2)
+
             bc = self.config["blockchain"]
             account = Account.from_key(bc["paymaster_private_key"])
             contract = self.web3.eth.contract(abi=abi, bytecode=bytecode)

runtime/models/mythos_client.py

@@ -0,0 +1,33 @@
+"""
+Claude Mythos Preview — Glasswing cybersecurity-focused frontier model.
+
+Uses the Anthropic API but targets Claude Mythos Preview specifically.
+Glasswing models are optimised for vulnerability detection, code security
+analysis, and exploit identification.
+
+Access: Claude API, Amazon Bedrock, Google Vertex AI, Microsoft Foundry.
+"""
+
+from __future__ import annotations
+
+import logging
+
+from runtime.models.anthropic_client import AnthropicClient
+
+logger = logging.getLogger(__name__)
+
+DEFAULT_MYTHOS_MODEL = "claude-mythos-preview"
+
+
+class MythosClient(AnthropicClient):
+    """Anthropic Mythos model provider — security-optimised frontier model.
+
+    Inherits all Anthropic API logic. Overrides the model name to target
+    Claude Mythos Preview for security-critical operations.
+    """
+
+    def __init__(self, config: dict) -> None:
+        config = dict(config)
+        config.setdefault("model", DEFAULT_MYTHOS_MODEL)
+        super().__init__(config)
+        logger.info("Mythos client initialised: model=%s", self.model)

runtime/models/router.py

@@ -13,7 +13,7 @@
 
 logger = logging.getLogger(__name__)
 
-PROVIDER_ORDER = ["ollama", "openai", "anthropic", "nvidia", "gemini"]
+PROVIDER_ORDER = ["ollama", "openai", "anthropic", "mythos", "nvidia", "gemini"]
 MAX_RETRIES = 3
 
 
@@ -71,6 +71,13 @@ def _create_provider(self, name: str, config: dict) -> ModelInterface | None:
                     return None
                 from runtime.models.anthropic_client import AnthropicClient
                 return AnthropicClient(config)
+            elif name == "mythos":
+                api_key = config.get("api_key") or __import__("os").environ.get("ANTHROPIC_API_KEY", "")
+                if not api_key or api_key.startswith("YOUR_"):
+                    logger.debug("Mythos: no valid API key, skipping")
+                    return None
+                from runtime.models.mythos_client import MythosClient
+                return MythosClient(config)
             elif name == "nvidia":
                 api_key = config.get("api_key") or __import__("os").environ.get("NVIDIA_API_KEY", "")
                 if not api_key or api_key.startswith("YOUR_"):

runtime/protocols/friday.py

@@ -16,6 +16,7 @@
     "insurance_trigger",
     "loan_health",
     "staking_rewards",
+    "security_vulnerability",
 )
 
 # Notification urgency thresholds (seconds until deadline)

runtime/protocols/hivemind.py

@@ -13,6 +13,7 @@
 INSTANCE_TYPES: list[str] = [
     "geopolitical", "financial", "technical",
     "governance", "creative", "synthesis",
+    "security",
 ]