feat(cli): wire scanner → router → builder → simulator pipeline

.env.example

@@ -6,3 +6,10 @@
 # endpoint (QuickNode / Ankr / Blast / your own node) for production use.
 BNB_WS_URL=wss://bsc-rpc.publicnode.com
 BNB_HTTP_URL=https://bsc-rpc.publicnode.com
+
+# Hot-wallet signer (hex, 0x-prefixed). Optional.
+# Omit to run the bot in scan-only mode: no tx signing, no simulation,
+# no opportunities enqueued for broadcast. Safe for dry runs and CI.
+# When set, the CLI will sign, simulate via eth_call, and only then
+# enqueue — see `CLAUDE.md` safety invariants.
+#CHARON_SIGNER_KEY=0x...

Cargo.toml

@@ -35,6 +35,9 @@ tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 anyhow = "1"
 thiserror = "2"
 
+# Secret-holding wrapper (zeroes memory on drop, redacts from Debug)
+secrecy = { version = "0.10", features = ["serde"] }
+
 # Async trait objects
 async-trait = "0.1"
 

config/default.toml

@@ -20,6 +20,11 @@ scan_interval_ms = 1000
 #   hot_scan_blocks  = 1
 #   warm_scan_blocks = 10
 #   cold_scan_blocks = 100
+# Hot-wallet signer private key (hex, optional). Sourced from the
+# `${CHARON_SIGNER_KEY}` env var — empty/unset puts the bot in
+# scan-only mode: no tx signing, no simulation, nothing gets enqueued.
+# Never commit a literal key here; see `.env.example` for the env var.
+signer_key = "${CHARON_SIGNER_KEY:-}"
 
 # ── Chains ────────────────────────────────────────────────────────────────
 [chain.bnb]

crates/charon-cli/Cargo.toml

@@ -11,6 +11,8 @@ path = "src/main.rs"
 
 [dependencies]
 charon-core = { workspace = true }
+charon-executor = { workspace = true }
+charon-flashloan = { workspace = true }
 charon-protocols = { workspace = true }
 charon-scanner = { workspace = true }
 alloy = { workspace = true }
@@ -20,6 +22,9 @@ anyhow = { workspace = true }
 tracing = { workspace = true }
 tracing-subscriber = { workspace = true }
 dotenvy = { workspace = true }
+secrecy = { workspace = true }
+async-trait = { workspace = true }
+futures-util = { workspace = true }
 metrics = { workspace = true }
 
 [lints]