fix: update Zama vendor file to current protocol architecture and mainnet status

[Himess]

What are you adding?

• Vendor/Protocol
• Enterprise Use Case
• Update to existing content
• Other

Description

The Zama entry described an older architecture and was still marked testnet. Rewrote it against Zama's current documentation.

1. Maturity. testnet → mainnet. Ethereum mainnet is live per the litepaper roadmap.

2. Architecture. The file said ciphertexts are persisted on-chain. In the Zama Protocol the on-chain value is a 32-byte handle and the ciphertext sits off-chain with the coprocessor (handles, coprocessor). Rewritten around symbolic execution and the five protocol components. Also replaced concrete with TFHE-rs and @fhevm/solidity: Concrete ML is a separate product line.

3. Pattern fits. Dropped Private L2s, since the litepaper states the protocol is "not a new L1 or L2, but rather a cross-chain confidentiality layer sitting on top of existing chains". Added Private Shared State (FHE). Marked Shielding as a partial fit, because ERC-7984 hides amounts and balances but not sender and receiver.

4. Risks. Added the trust assumptions the CROPS security rubric asks for: KMS threshold (13 nodes, a documented 9 of 13 example, tolerance up to one third malicious, AWS Nitro Enclaves), coprocessor majority-honest assumption, ZKPoK not yet post-quantum while FHE and MPC are, and operator pause plus the account deny list.

5. Strengths. Rewritten from generic claims to specific, sourced ones: public verifiability of coprocessor results, distributed key custody, the plain-Solidity developer surface, and audit status.

6. Additions. ERC-7984 with the OpenZeppelin confidential-contracts reference, and the ACL functions. Terminology fix "FHE encryption" → "Fully Homomorphic Encryption", one of the check-terms findings tracked in chore: fix content quality warnings from new guardrails #67.

7. patterns/pattern-private-shared-state-fhe.md. The fhEVM implementation note still said testnet, and the docs.zama.ai/fhevm link redirects to a generic docs homepage. Both corrected. The pattern's own maturity frontmatter is untouched, since that is a judgment about the pattern family rather than a fact about Zama.

Notes:

• I am not affiliated with Zama. Every claim above links to Zama's own documentation.
• Dropped "Limited developer tooling maturity" from Risks, since the current stack ships a Hardhat plugin, Foundry support and an SDK. Happy to restore it if you read that differently.
• No CROPS profile added. No existing vendor file carries one, and scoring a third party seemed like your call rather than mine. Happy to draft one against the rubric if useful.
• Ran npm run validate and npm run check-terms locally. Output is unchanged except vendors/zama.md dropping off the check-terms list.

Checklist

• I've checked this doesn't duplicate existing content
• All links work
• Info is accurate