# ZK Relay

Zero-knowledge secret relay. Clients encrypt locally; the server stores only ciphertext.
Human links use `/h/:id`. Agent links use `/a/:id`. Capability fragments stay client-side.

## Discover

This markdown response is the agent guide for `https://zkr.scalingforever.com/`. Also available: `https://zkr.scalingforever.com/llms.txt` and `https://zkr.scalingforever.com/protocol/v1`.

## Install zkr

Preferred: download a signed binary for your platform, verify checksums with GPG, then run it.

```sh
curl -fsSL https://zkr.scalingforever.com/zk-relay-releases.txt -o zk-relay-releases.asc
gpg --import zk-relay-releases.asc
curl -fsSL https://zkr.scalingforever.com/tools/v1.3.1/checksums.txt -o SHA256SUMS
curl -fsSL https://zkr.scalingforever.com/tools/v1.3.1/SHA256SUMS.asc -o SHA256SUMS.asc
gpg --verify SHA256SUMS.asc SHA256SUMS
# fingerprint must be 88E4D43113025649CDB6773953607CDFBABCDC86
# download the matching binary from the list below, then:
shasum -a 256 -c SHA256SUMS --ignore-missing
chmod +x ./zkr-*
```

From source (stdlib Go only):

```sh
go install github.com/Git-on-my-level/zk-relay/cmd/zkr@v1.3.1
```

Receiver version: v1.3.1

- linux-amd64: https://zkr.scalingforever.com/tools/v1.3.1/zkr-linux-amd64 (SHA-256: d06da2b50992b3ddf12d0887132640610b7eeff3550db2e360587e9909ca5588)
- linux-arm64: https://zkr.scalingforever.com/tools/v1.3.1/zkr-linux-arm64 (SHA-256: 8a69cd5cbde61ad3995cb5664baf91989aaf7182e1b0c5ae1d8def57763b4d46)
- darwin-amd64: https://zkr.scalingforever.com/tools/v1.3.1/zkr-darwin-amd64 (SHA-256: 6b5adc59927c0a99cc6ad0e7a20c54b178679aeec9a3b3f6ffbb6bde3280e413)
- darwin-arm64: https://zkr.scalingforever.com/tools/v1.3.1/zkr-darwin-arm64 (SHA-256: 19a419ff565a6547209864df7d0e224e8845badc71faa8a035c3f5dba967419d)
- windows-amd64: https://zkr.scalingforever.com/tools/v1.3.1/zkr-windows-amd64.exe (SHA-256: 1e5a430ae16d6d14f1fd45ed83a8dc0dbd154ff7e791416df6aa6caf9ea3a692)

- checksums: https://zkr.scalingforever.com/tools/v1.3.1/checksums.txt
- checksums signature: https://zkr.scalingforever.com/tools/v1.3.1/SHA256SUMS.asc
- GPG public key: https://zkr.scalingforever.com/zk-relay-releases.txt
- GPG fingerprint: 88E4D43113025649CDB6773953607CDFBABCDC86

## Send (create)

Secret bytes must arrive via stdin or a file. Never put the secret in a command argument.

```sh
security find-generic-password -s SERVICE -a ACCOUNT -w \
  | zkr create --stdin --ttl 1h --expire-after-reveal --origin https://zkr.scalingforever.com
```

Successful create prints a plain-English record with the agent link and a recipient instruction.

## Inspect (non-consuming)

```sh
zkr status --link-stdin
```

## Receive

Agent links (`/a/:id`) return preflight only — never ciphertext. Preferred:

```sh
zkr receive --link-stdin --output ./secret
```

Pipe into a destination secret store only with an explicit stdout acknowledgement:

```sh
zkr receive --link-stdin --stdout --allow-plaintext-stdout \
  | gcloud secrets versions add NAME --project=PROJECT --data-file=-
```

Do not print, log, or save plaintext unless that is the intentional destination.

## Protocol

Authoritative contract: https://zkr.scalingforever.com/protocol/v1