These instructions apply to the whole repository.
The self-contained skill/ package is the canonical AI-agent bundle.
Within that bundle:
skill/SKILL.mdis the human and agent entrypoint and carries the inline machine-readable skill metadata.skill/SKILL.mdand the bundled markdown references are the canonical execution surface for the published skill.
Keep the canonical skill slug stable as spot-advanced-swap-orders.
Use Spot Advanced Swap Orders as the human-facing display title for the skill, MCP, and hosted distribution surfaces.
The repository README.md is the exception and may use broader protocol-level branding.
Keep skill/SKILL.md and config.json as the sync inputs for the inline metadata consumed by the self-contained skill package.
Optimize retrieval with frontmatter description and opening text before changing the skill slug again.
When changing behavior, docs, packaging, or metadata that affects agent or MCP consumption, update all affected surfaces in the same change.
This commonly includes skill/SKILL.md, config.json, skill/, README.md, index.html, package.json, mcp/, and derived metadata.
Keep the MCP adapter thin and delegate to mcp/order.js.
Treat root package.json, skill/SKILL.md, config.json, and MCP-owned fields in mcp/package.json as the sync inputs for MCP metadata.
Derive skill/ and mcp/server.json via node ./script/sync.mjs.
Sync only the derived fields in mcp/package.json; do not hand-maintain duplicate fields there, but keep MCP-owned fields such as pinned runtime dependencies in that file.
The canonical MCP server name is io.github.orbs-network/spot.
The canonical skill npm package name is @orbs-network/spot-skill.
The canonical MCP npm package name is @orbs-network/spot-mcp.
The canonical npm bin name is spot-mcp.
Keep MCP runtime dependency versions pinned to specific versions unless explicitly asked to relax them.
Run npm run build after every change made in the repo.
Treat that build as the normal sync boundary for derived MCP metadata.
When the user asks for qa:
- Run
./script/qa-security.zshand format the result with emojis. - Include the
qa-securityresult as a single emoji-prefixed line in the final report wheneverqa-securityran during the task, with verdict, confidence, and summary. - Treat
qaas a local dev task that validates full skill inference from the bundled skill docs. - The default
qaflow is two sequential TWAP orders, not one mixed order or a single-shot market order. - Unless the user overrides scope or shape, place a first order that is a 2-chunk stop-loss from wrapped native to USDC, wait for that order to reach a final state, then place a second order that is a 2-chunk take-profit from USDC back to native.
- For each default order, size
input.maxAmountto about$10of that leg's input token, use exactly 2 equal chunks soinput.amount = input.maxAmount / 2is about$5per chunk, and setepoch = 60. - For the default stop-loss leg, set
output.triggerLowerto a non-zero per-chunk value chosen from the current per-chunk output so the order is immediately eligible for QA, and setoutput.triggerUpper = 0. - For the default take-profit leg, set
output.triggerUpperto a non-zero per-chunk value chosen from the current per-chunk output so the order is immediately eligible for QA, and setoutput.triggerLower = 0. - Unless the user overrides tokens, use wrapped native input and USDC output on the first order, then USDC input and native output on the second order, on each supported chain.
- Use chain skill and env.
- Do not use
mcp/order.js, MCP tools, or other repo helper surfaces unless the user explicitly asks to test those surfaces. - If the skill bundle is insufficient, report the gap instead of falling back silently.
- Do not query, reference, or use any orders from before this run as examples for any purpose.
- Honor user scope modifiers such as
just ethereum; otherwise run on all supported chains in parallel. - Do not probe a chain first; run the supported-chain set in parallel once.
- For prerequisite onchain transactions such as wrap or approve, fan out across chains with
parallel. - In
qa, when approval is needed, always use a standing max approval such asapprove(..., maxUint256)rather than an exactinput.maxAmountapproval. - In
qa, do not send approval-reset or zero-allowance cleanup transactions before, between, or after the default order legs unless the user explicitly asks for them. - Do not use
cast send --asyncinqa; each branch should surface the tx hash and final receipt directly so retries remain unambiguous. - Do not use zsh arithmetic for wei or token-amount sizing in
qa. - Use a safer exact tool such as
bcorcastfor amount math. - Execute the intended two-order flow, poll every 5 seconds until each order reaches a final state, and report a table with the run summary, choices, skill files, sufficiency, and any ambiguity.
- A
qarun passes only if both requested E2E orders complete and you can explain decisions from the skill bundle without unreported fallback.