merge

.agents/AGENTS.md

@@ -0,0 +1,21 @@
+# Universal Anti-Hallucination & Verification Protocol (MANDATORY FOR ALL AGENTS)
+
+## 1. Zero-Hallucination Policy & Strict Verification (Universal Scope)
+- **Universal Applicability:** This protocol applies universally to ALL technologies, domains, and tools — including **MCP (Model Context Protocol) servers/tools**, smart contracts, blockchain SDKs (e.g., Zama, Circle, Viem), UI frameworks (e.g., shadcn, Next.js, Tailwind), cloud APIs, databases, and system architectures.
+- **Never Assume or Guess:** Do NOT invent, guess, or hallucinate function signatures, MCP tool parameters, contract ABIs, addresses, API endpoints, CSS classes, or configuration headers from training data memory.
+- **Read Authoritative Sources FIRST:** Before calling any tool, writing code, or generating documentation, you MUST explicitly read and verify ground-truth sources:
+  1. **MCP Servers & Tools:** Before calling lazy-loaded MCP tools or using MCP resources, always read their schema definitions (`<toolName>.json`), check available tools/resources (`list_resources`, `read_resource`), and review server instructions (`instructions.md`).
+  2. **Local Codebase & ABIs:** Inspect existing files (e.g., ABI files, types, interfaces, utility wrappers) to verify exact names, types, and signatures in use.
+  3. **Installed Dependencies & Skills:** When integrating third-party SDKs or frameworks, inspect `node_modules` or read local skill instructions (`SKILL.md`) and reference docs (`references/`) before implementing domain logic.
+
+## 2. Mandatory "Think -> Read -> Plan -> Execute" Workflow
+Before executing any coding, configuration, or integration task across any technology stack:
+1. **Think & Analyze:** Identify exact information needed (e.g., MCP tool schemas, API parameters, contract addresses, decimal scaling rules).
+2. **Read & Verify:** Use read tools (`view_file`, `grep_search`, `read_resource`, `call_mcp_tool`) to verify 100% accurate data from ground-truth sources.
+3. **Plan:** Outline exact changes or tool invocations, confirming that every name, parameter, and address matches verified sources without guessing.
+4. **Execute & Audit:** Apply changes and double-check against ground truth to ensure zero discrepancies, syntax errors, or placeholder values remain.
+
+## 3. Strict Prohibitions
+- **No Hallucinated MCP / Tool Calls:** Never call MCP tools or agent skills with guessed arguments; always verify parameter schemas first.
+- **No Unauthorized Architectural / Security Changes:** Never add custom headers (like COOP/COEP/CORP), security policies, or infrastructure overrides without explicit user authorization or documented vendor requirements.
+- **No Placeholder Leakage:** Never put fake placeholder addresses (e.g., `0x1000...`), mock ABIs, or fake API keys into production code, SDKs, or LLM reference manifests (`llms.txt`, `llms-full.txt`, `agent-tools.ts`). Always use verified ground-truth values.

.env.example

@@ -1,4 +1,4 @@
-# ZamaVault — Environment Variables
+# ShadowLine — Environment Variables
 # Copy this file to .env.local and fill in your values.
 # None of these are required — the app falls back to public RPC nodes.
 
@@ -11,6 +11,6 @@ NEXT_PUBLIC_MAINNET_RPC=
 NEXT_PUBLIC_WALLETCONNECT_PROJECT_ID=
 
 # Public deployment URL — used in docs and API examples.
-# Set this to your Vercel deployment URL, e.g. https://zamavault.vercel.app
+# Set this to your Vercel deployment URL, e.g. https://shadowline.vercel.app
 # Falls back to relative paths when not set.
 NEXT_PUBLIC_APP_URL=

.gitignore

@@ -39,3 +39,7 @@ yarn-error.log*
 # typescript
 *.tsbuildinfo
 next-env.d.ts
+
+# internal working notes — not part of the published app
+AGENT_GUIDE.md
+AUDIT_REPORT.md

Dockerfile

@@ -0,0 +1,38 @@
+# ShadowLine Production Multi-Stage Dockerfile
+# Optimized for Ubuntu Linux VPS, cloud nodes, and self-hosting.
+
+FROM node:20-alpine AS base
+
+# Step 1: Install dependencies
+FROM base AS deps
+WORKDIR /app
+COPY package.json package-lock.json* ./
+RUN npm ci
+
+# Step 2: Build production bundle
+FROM base AS builder
+WORKDIR /app
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+# Set fallback envs for build time if not passed
+ENV NEXT_PUBLIC_APP_URL="http://localhost:3000"
+ENV NEXT_PUBLIC_DEFAULT_CHAIN="sepolia"
+ENV NEXT_PUBLIC_WALLETCONNECT_PROJECT_ID="public-demo-project-id"
+RUN npm run build
+
+# Step 3: Production runner
+FROM base AS runner
+WORKDIR /app
+ENV NODE_ENV=production
+ENV PORT=3000
+ENV HOSTNAME="0.0.0.0"
+
+COPY --from=builder /app/public ./public
+COPY --from=builder /app/.next ./.next
+COPY --from=builder /app/node_modules ./node_modules
+COPY --from=builder /app/package.json ./package.json
+COPY --from=builder /app/scripts ./scripts
+
+EXPOSE 3000
+
+CMD ["npm", "start"]

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ShadowLine contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.