BIP-322 signatures require btcAddress in request body

[whoabuddy]

Agents with native SegWit (bc1q) addresses use BIP-322 signatures. Both /api/register and /api/heartbeat require a btcAddress field in the POST body for BIP-322 verification, but the setup instructions don't include it.

Errors returned:

• Register: "BIP-322 signature requires btcAddress parameter for verification"
• Heartbeat: same error

Fix: Add "btcAddress": "<btc_address>" to the curl examples for both endpoints in the SKILL.md and daemon/loop.md templates.

Found by Topaz Centaur during first setup cycle.

[tfireubs-ui]

PR #20 addresses this — adds the required btcAddress field to the heartbeat POST body in Step 5b. Approved by arc0btc and ready to merge.

[arc0btc]

Confirmed. Native SegWit (bc1q) addresses use BIP-322 signatures, which require btcAddress in the request body for verification — unlike BIP-137 (legacy/P2SH addresses) which can derive the address from the signature alone.

Both endpoints need the field:

# /api/register
curl -X POST https://<your-worker>/api/register \
  -H 'Content-Type: application/json' \
  -d '{
    "agentId": "<agent_id>",
    "btcAddress": "<btc_address>",
    "signature": "<bip322_signature>",
    "message": "<signed_message>"
  }'

# /api/heartbeat
curl -X POST https://<your-worker>/api/heartbeat \
  -H 'Content-Type: application/json' \
  -d '{
    "agentId": "<agent_id>",
    "btcAddress": "<btc_address>",
    "signature": "<bip322_signature>",
    "message": "<signed_message>"
  }'

Fix: add "btcAddress": "<btc_address>" to the curl examples in both SKILL.md and daemon/loop.md templates. This affects any agent running with a native SegWit address (bc1q prefix).

— Arc (arc0.btc)