Repository navigation
Conversation
Obsolete-rule cleanup deleted every zama-protocol-*.mdc file, including project rules that share the prefix. It now removes only files that carry the generator marker (now also on main skill rules) and links left dangling. Writing to a symlinked rule replaces the link instead of writing through it into another checkout.
- zama-protocol: one rule per heading on the FHEVM model; dApps use only @zama-fhe/sdk and @zama-fhe/react-sdk; addresses come from the public protocol registry. - zama-solidity: compiled examples for input import and forwarding, transferred amounts, FHE.select and proof-checked reveals; shift semantics by protocol version; npm overrides for peer conflicts; code map reads current deployments from the registry. - zama-typescript: no embedded SDK code; agents read the version-tagged SDK llms.txt, official examples and installed type declarations, plus rules that hold across releases. - Maintainer-only rules move to AGENTS.md; descriptions and README match. - Version 0.4.0.
- Compile every Solidity block in zama-solidity against the latest published packages on PRs and weekly (solidity-examples workflow). - Point the Hardhat and Foundry setups at the installed package README. - Correct the ZamaConfig, WALKTHROUGH and operator-access statements, add the HCU depth cap and an llms.txt fallback for older SDKs. - Label the code-map deployments the registry does not track. - Keep each rule in one place, and make the generator the only Cursor install path.
Eikix
changed the title
- Receiver callbacks check the calling token; operator contracts pull only from msg.sender; operator expiry is in Unix seconds. - Ordinary Solidity safety (CEI, nonReentrant, access control) still applies. - The example relayer routes accept any caller. - Drop the manifest integrity claim: it lives beside the files it hashes. - Install the compile job's packages without lifecycle scripts and call the local solcjs directly.
Drop the relayer route rule: the SDK and its docs own that setup. Point agents at docs.zama.org/protocol/llms.txt to find docs pages.
- State the contract rules in prose and point to the Zama code examples, which are complete and tested. Fragments were copied without the checks around them, such as closing bids at the end time. - Remove the snippet compile script, its workflow and test package. - Open the ERC-7984 reference with the standard and OpenZeppelin, then explain how it differs from ERC-20. The refund goes to the sender and is best-effort.
Check examples against the rules, install the plugin's declared peer versions, and route custom-contract client flows to the SDK's encrypt and decrypt guide.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rewrites the three skills so an agent reads one short page, then opens maintained sources only when the task needs them.
zama-protocol: which packages to use (@zama-fhe/sdkfor clients, no@zama-fhe/relayer-sdkor@fhevm/sdk), how FHEVM works, and where addresses come from (protocol-registry).zama-solidity: one rule per heading in prose with exact identifiers (encrypted input,FHE.select, access grants, public reveal withFHE.checkSignatures), linking the Zama code examples for complete contracts. References cover ERC-7984 (the standard, OpenZeppelin, and how it differs from ERC-20), reveals, operation limits, Hardhat and Foundry setup, and a map of Etherscan-verified mainnet contracts.zama-typescript: work from the installed SDK release (its version-taggedllms.txt, installed type declarations and the officialexamples/), plus rules that hold across releases. No SDK code is embedded, because the API changes between releases.The skills embed no contract or client code: fragments go stale and get copied without the checks around them. They state the safety rules agents miss, such as checking the calling token in receiver callbacks and pulling tokens only from
msg.sender.Tooling:
Verification
--check,git diff --checkand the skill validator on all three skills pass locally.msg.sender, verifies the reveal proof against the stored handle once, and uses only@zama-fhe/*client imports. 7 of 7 Hardhat tests pass, and the frontend type-checks and builds. Its remaining notes (stale plugin README version, no custom-contract client example) are addressed in the last commit.Known issues
skill-security-scanner-prfails because the repository has noANTHROPIC_API_KEYsecret. A repository admin needs to add it, or run the scanner'ssimpletier.@openzeppelin/confidential-contracts0.5.x pins@fhevm/solidity0.11.1, and current tooling uses 0.13. The Hardhat setup documents an npm override, which compiles and passes mock tests. Whether this combination is supported on mainnet still needs confirmation.dist. Shippingllms.txtor the docs in the package would let agents read version-matched docs offline.Related: #9, #10.