zkAPI client daemon 0.1.6

The client now recovers interrupted key provisioning using the original saved authorization. It asks the server to settle first; an older pending server falls back to exact request replay, key verification and retirement without sending that recovered key to inference. Signed zero-charge cancellation responses recover the wallet without a provider key. Ambiguous failures retain the original wallet journal for retry.

Model allowances remain aligned with OA Chat: $1, $2, $3, $4.50 or $6 based on the public model tier. New tests compare 36 cases against the actual web policy modules. This is a maximum allowance, not a fixed charge.

Includes the SOCKS5/Tor support from 0.1.5 and the Mainnet production org/verifier routing. Existing wallets, recovery files and saved key reuse settings are preserved. Stop the running daemon before updating, then start it again with the same profile.

Validation: complete Go race suite and vet; nine focused signed recovery tests plus the companion unit/integration suites; four native platform builds; Nix, Homebrew and Arch package checks; source/patch/proof provenance and installer checks; independent adversarial review. The official macOS arm64 bundle was installed and checked against the live Mainnet manifest while preserving the existing wallet and saved configuration.

zkAPI client daemon 0.1.5

What's new

• Added a loopback SOCKS5 transport for Tor. The client sends destination names through SOCKS5 for remote DNS, retains HTTPS certificate verification, and fails closed if the proxy is unavailable.
• Added transport settings and guidance to the CLI and privacy documentation.
• Includes the Mainnet production issuer update from #11.

Use with Tor

Start a local Tor SOCKS listener, then stop any running client daemon and run:

zkapi-clientd config --relay-url socks5://127.0.0.1:9050
zkapi-clientd serve

On macOS, torify alone does not route this Go client; configure the SOCKS5 URL even when launching it with torify.

Install or update using the pinned installer. The release includes native macOS and Linux builds for Intel/AMD and ARM, Linux packages, and Nix, Homebrew, and Arch package handoffs. Verify downloads with SHA256SUMS.

Full changelog: clientd-v0.1.4...clientd-v0.1.5

zkAPI client daemon 0.1.4

Mainnet now uses the production OA issuer and verifier:

• Issuer: https://org-live.openanonymity.ai
• Verifier: https://verifier-production-20260917.openanonymity.ai

Existing Mainnet profiles automatically migrate the exact previously shipped deployment manifest and historical verifier2 default. Wallet state, recovery journals, vault, signing keys and proof pins are preserved. Other custom verifier origins and Sepolia settings remain unchanged. New profiles and network selection use the corresponding network verifier. Manifest and key verification remain enabled.

Install or update:

curl -fsSL https://github.com/ethereum/zkapi/releases/download/clientd-v0.1.4/install.sh | bash

Stop zkapi-clientd serve before upgrading, then restart it with the same configuration directory. Do not reset or recreate the wallet. The installer retains the previous bundle and does not start services or modify the profile.

Native bundles support macOS 13+ and Linux with glibc 2.39+, on amd64 and arm64. Release assets include the checksum-pinned installer, native bundles, Linux packages, and Nix/Homebrew/Arch package definitions. Publishing these assets does not publish a Homebrew tap or AUR entry.

Source: 60662854f305005718f018355bcf64de9fba6122.
Validation includes manifest migration and network-selection tests, installer/package checks, native wallet and station trust tests, and a successful live Mainnet inference with verified production key status.

zkAPI client daemon 0.1.3

Version 0.1.3 adds the web app's trusted-station verification fallback to the CLI.

• When the OA verifier is unavailable or refuses approval, only the compiled oa-station signing-key pin can use the fallback. The client verifies its Ed25519 signature over the exact station ID, provider key and expiry locally. Unknown stations still require matching verifier approval.
• Fallback remains unverified. Responses report verifier-unavailable and trusted_station_fallback; the terminal warns that provider ownership and privacy settings were not confirmed.
• Known bans at verification, expired keys and mismatched verifier bindings still block access. Fallback additionally requires a valid station signature. TLS, redirect, cancellation, response-size and lease/cap/origin checks remain enforced.
• A key keeps its acquisition-time verification result for the configured fixed reuse window. The daemon does not poll for new bans or re-verify the key in the background during that window.
• Existing wallet files, configuration and recovery state are preserved. Install the complete matching client/helper bundle; the updated gateway rejects older helpers' less restrictive fallback results. Stop and restart a running daemon to use the new bundle.
• Release CI now runs the native cryptographic, HTTP policy and wallet tests on all four supported OS/architecture targets, alongside the existing Go race tests, installer checks and package validation.

The compiled pin matches the web app. Its initial trust bootstrap is the HTTPS verifier broadcast observed on October 1, 2026; the operator identity was not independently confirmed through another channel. Rotation requires a reviewed client release. Fallback authenticates the pinned station, without confirming org-signature validity, provider ownership or provider privacy settings.

zkapi-clientd 0.1.2

The client now uses the canonical zkAPI origins:

• Mainnet: https://zkapi-mainnet.openanonymity.ai
• Sepolia: https://zkapi-sepolia.openanonymity.ai

Both defaults pin the already deployed September 30 native ETH vaults. This release does not deploy or rotate any server key, contract, or proving setup.

Existing wallets: a September 30 Sepolia profile continues with its same key, private note, and transaction recovery data. The client accepts only the exact old packaged manifest with its three hostname fields updated; any other difference is rejected.

The Mainnet default advances from the September 28 vault to the September 30 vault. Preserve an older Mainnet profile with its matching earlier client for recovery, and create a separate --config-dir for the fresh deployment. The client refuses retired Mainnet companion state and does not rebind existing funding records. Older Sepolia deployments also require their matching historical client. Do not delete wallet files to bypass a deployment mismatch; previous releases remain available.

Stop serve before updating. Install or update with:

curl -fsSL https://github.com/OpenAnonymity/zkapi/releases/download/clientd-v0.1.2/install.sh | bash

Native bundles support macOS and Linux on arm64 and amd64, with checksum-pinned Homebrew, AUR and Nix packaging. This remains an experimental prerelease. Release validation covers native builds, installer/upgrade preservation and package checks; it performs no funded wallet transactions.

zkapi-clientd 0.1.1

This prerelease makes successful native ETH deposits usable after validating the mined receipt, matching the web wallet. It also improves setup, funding recovery, and inference-key handling.

• Interactive configuration adds arrow-key menus and live payment progress.
• Funding automatically recovers from fee or balance changes before signing, while preserving the selected deposit and fee approval.
• Successful deposits activate after a canonical, matching mined receipt. Failed deposits, withdrawals, and public ETH returns keep their finality checks. Earlier activation carries the web wallet's pre-finality reorganization risk; complete rollback recovery is not implemented.
• Inference activity distinguishes fresh and reused keys. With reuse disabled, each request gets fresh access and the client requests settlement when an earlier lease blocks it.
• Sepolia uses the September 30 fresh deployment. Preserve existing Sepolia profiles with their matching earlier client; use a separate configuration directory for the fresh deployment. Mainnet endpoints and proof assets are unchanged.

Install or update:

curl -fsSL https://github.com/OpenAnonymity/zkapi/releases/download/clientd-v0.1.1/install.sh | bash

Then run zkapi-clientd config and zkapi-clientd serve. For updates, stop the running daemon, rerun the install command, and start it again. Configuration and wallet state are preserved.

Native bundles are provided for macOS and Linux on Intel/AMD and ARM64. See the quick start for client configuration.

zkapi-clientd 0.1.0

The first zkAPI-only client release, moved from the OA Chat daemon to OpenAnonymity/zkapi/zkapi-clientd.

Install or update:

curl -fsSL https://github.com/OpenAnonymity/zkapi/releases/download/clientd-v0.1.0/install.sh | bash

Then run zkapi-clientd config and zkapi-clientd serve.

• Prebuilt macOS and Linux binaries for amd64 and arm64; no build tools needed.
• Mainnet by default. Configuration asks how much to deposit ($20 on Enter), displays an ETH payment QR, waits for funding, and asks Enter before depositing.
• Local OpenAI-compatible API at http://127.0.0.1:8787/v1, without an API key by default.
• Guided withdrawals, serialized inference requests, configurable key reuse, and settled session cost/balance reporting.
• Existing OA Chat zkAPI wallets are reused in place when the new default configuration directory is absent. Stop the old daemon before switching. Ticket mode is not included.
• Installer updates preserve wallet state and earlier bundles. Live mainnet/Sepolia endpoints, contracts and protocol pins are unchanged.

Supported native runtimes: macOS 13+; Linux glibc 2.39+ with OpenSSL 3, libgcc and CA certificates. Shell installation assumes its bin directory is already on PATH.

Quick start · Installation details

This is a prerelease. Native builds, install/reinstall, checksum/rollback, package and automated client tests validate the release. No live wallet transaction is part of these release checks.