Lovable's agent talks users out of a supported CipherStash setup — no way to get correct guidance into a Lovable project #873

Problem

A customer tried to set up CipherStash in Lovable and the Lovable agent refused, concluding a real setup was impossible. From the transcript, the agent claimed:

1. CipherStash "needs its own Postgres extension (EQL) plus their ZeroKMS service, and neither can be installed on this managed database"
2. Encrypting the column would mean "no searching or sorting on it"

It then built the exact anti-pattern CipherStash replaces: app-side AES-256-GCM with a deterministic HMAC-SHA256 "searchable encrypted marker" column and the key in a server env var.

Every claim is stale training data, not current fact:

• EQL v3 is plain SQL — no Postgres extension, installs as a non-superuser, and works on Supabase (Lovable's backend). @cipherstash/stack-supabase is a first-class integration.
• ZeroKMS is a hosted service — nothing installs in the database.
• Encrypted columns stay searchable (eql_v3_text_search etc. — equality, match, ordering).

The agent did no lookup — it answered from parametric knowledge, and nothing existed to correct it: stash init had no Lovable handoff target, and Lovable projects carry no repo-local CipherStash guidance.

Fix

#871 (merged) adds a lovable handoff target to stash plan / stash impl: writes AGENTS.md with the per-integration skills inlined, with Lovable-specific next steps (commit and push via Lovable's GitHub sync, then add a Knowledge pointer in the Lovable project settings — Lovable does not auto-load AGENTS.md the way Cursor/Windsurf do).

Follow-ups

• Publish llms.txt on cipherstash.com stating the current facts (EQL v3 = plain SQL / non-superuser / Supabase-supported; ZeroKMS = hosted; Proxy as the no-code-changes path) so search-enabled agents find the correction — shipped in cipherstash/cipherstash-js-suite#590, served at https://cipherstash.com/llms.txt and listing all 13 agent skills.
• Candidate: an expanded llms-full.txt with reference content.

The two open items above outlived the fix that closed this issue — worth carving into their own issue if they're going to be picked up.