Zero-knowledge proofs over R+2 receipt chains. Prove an agent ran a workflow, charged a price, or processed a record — without revealing the inputs, outputs, or other private details. Spec v0.1 live. Reference prover lands Q3 2026. PQ-ready migration path baked in.
Some use cases need receipts but can't expose what's inside them. R+4 closes that gap.
Hospital proves agent ran within consent + protocol bounds. Doesn't reveal the actual medical record. Patient satisfied; PHI stays sealed.
Bank proves fraud-check ran on tx pattern only, never read balance. Customer satisfied without bank exposing balance to a regulator.
Vendor proves trust score ≥ 80 without revealing exact score, customer list, or transaction volume. Procurement satisfied.
Each receipt field commits via Pedersen — content hidden, position fixed.
Public statement: "there exists a receipt in chain X with field Y satisfying predicate P."
Prover uses Groth16 (current) / PLONK (next) to generate a ~200-byte proof.
Anyone with the public statement + proof + chain root verifies in <5ms. No prover trust needed.
| Statement complexity | Proof size | Prove time | Verify time |
|---|---|---|---|
| Single receipt field equals X | 192 B | ~0.8s | 3ms |
| Range proof over 1K receipts | 320 B | ~4s | 8ms |
| Aggregate sum over 10K receipts | 384 B | ~22s | 12ms |
| Trust-score-threshold proof | 256 B | ~1.4s | 5ms |
Measured on H100 GPU prover. CPU prover ~10× slower. PLONK migration targets ~50% reduction in prove time.
v0.1 spec published. Groth16 proof system selected. Pedersen commitment scheme locked.
Reference prover ships. CLI + JS library. Sample circuits for common statements (range, equality, threshold).
Public verifier endpoint at /v1/zk/verify. ZK proofs from any DCS receipt history.
PLONK migration. PQ-direction signature integration. Spec v1.0 — first stable freeze.
R+4 spec is live. Reference prover ships Q3 2026. Adopt early.