A promise, measured
People say a reveal was agreed, that everyone took part, and that nobody opened it early. Relay makes the first two measurable on-chain and makes every recorded release independently checkable. Here is the whole mechanism, including where it stops.
Encryption happens on your device
Your contribution — text, image, audio or video, plus its caption and file name — is packed, padded to hide its exact size, and encrypted with a fresh AES-256-GCM key in your browser.
That key is split with Shamir secret sharing into one share per relayer (k of n needed), and each share is encrypted to that relayer's published P-256 key. Your device keeps no copy of the key.
The ciphertext and a manifest go to content-addressed storage. Before anything touches the chain, your browser reads them back and checks the hash. Only the manifest's sha256 is committed on-chain.
Consent is to an exact rule
The creator writes the rule first. Members consent with a transaction that names the rule's hash — so a consent can never attach to a different rule than the one you read.
The moment any member other than the creator consents, CapsuleRegistry refuses every change to the rule. You can only contribute after you consent, and only once.
Invitations are single-use keys that travel in the link's #fragment, which browsers never send to a server. Redeeming signs your own address, so a copied signature can't seat anyone else.
The contract decides release
The rule is: the release date has passed, at least N contributions were committed, and — if the Circle chose it — every member who joined has consented. The contract evaluates only its own stored state.
Anyone may ask for release; the contract either reverts with the unmet condition or records ReleaseEligibilityReached. Relayers act only after that event exists.
Each relayer opens its share, re-encrypts it to every consenting member's key, publishes a signed delivery, and records a receipt. The capsule counts as released only when receipts reach the threshold. Short of that, Relay shows RELEASE UNAVAILABLE and the exact number missing.
Anyone can check it
The open-source verifier reads events straight from a BOT Chain RPC, replays them through a small reference model of the rules, and flags any event the rules would have rejected.
It checks the registry's bytecode against the audited build, cross-checks the contract's own view of the capsule, and can compare a server's claimed state against the chain.
It needs nothing from Relay's servers. Run it from the command line, or on the Verify page of any capsule.
Every state a Circle can be in
Colours in Relay always mean these states, and always come with the words.
DRAFT
Rule is being written. Nobody can join yet.
AWAITING_CONSENT
Rule published. Members join and consent to it.
COLLECTING
Rule locked by a member's consent. Contributions are open.
SEALED
Contributions closed. Waiting for the release rule.
RELEASE_ELIGIBLE
The rule was true on-chain. Relayers are delivering key shares.
RELEASED
Enough relayer receipts are recorded. Members can open it.
CANCELLED
Cancelled by the creator before anyone else consented.
EXPIRED
The expiry passed before release was recorded.
Where it stops
- A contributor can keep a copy. Relay can't make you forget what you wrote, and a creator can keep anything they contributed.
- A colluding threshold of relayers could open it early. k relayers together hold enough shares. Relay records every receipt and discloses who the relayers are; it can't see off-chain collusion.
- Today's relayers are PROJECT_BASELINE. They are operated by the Relay project, so they are not independent of each other.
- Your keys live in your browser. Lose the browser and your recovery kit, and nobody — including Relay — can open your share of a reveal.
- Not for emergencies or estates. Relay makes no medical, legal or estate-planning guarantee.
What's real today
Deployed on BOT Chain testnet at 0x6f6e2c0fb44016d621e133612c61069de15cd710 (block 24389826), source verified on BOTScan. Each claim below is worded at the rung its evidence has reached; the ledger check fails if copy anywhere says more.
Release policy is immutable after consent
Tested locally: once another member consents, the contract rejects any change to the rule.
Needed for “Tested locally”: Contract and property tests.
evidence: evidence/contracts/forge-test.txt · contracts/test/CapsuleRegistry.t.sol · contracts/test/CapsuleRegistry.invariant.t.sol · evidence/parity/parity-report.json · evidence/adversarial/local/latest.json · evidence/adversarial/testnet/2026-09-23T09-34-01-018Z.json
An ineligible release is rejected
Observed on BOT Chain testnet: early release attempts reverted on-chain — while contributions were open and after sealing but before the release date — and the verifier trace shows release was recorded only after the rule was true.
Needed for “Observed on BOT Chain testnet”: Failed testnet transaction and verifier trace.
evidence: docs/proofs/testnet/2026-09-23T09-02-50-791Z/output.json · docs/proofs/testnet/2026-09-23T09-02-50-791Z/verifier-report.json · evidence/verifier/testnet.json · https://scan.bohr.life/tx/0x668fb38e49382bdebc9ca38fbf4a879519d1ef2dc547c83f067f5fd9ba9ea625 · evidence/contracts/forge-test.txt · evidence/adversarial/testnet/2026-09-23T09-34-01-018Z.json · evidence/adversarial/testnet/latest.md
The capsule lifecycle is independently replayable
Verified on BOT Chain testnet: the open-source verifier replayed every capsule on the deployed registry from the public RPC — all VALID, bytecode matching the audited build — without Relay's servers.
Needed for “Verified on BOT Chain testnet”: Published verifier output against deployed contract.
evidence: evidence/verifier/testnet.json · docs/proofs/testnet/2026-09-23T09-02-50-791Z/verifier-report.json · evidence/unit/verifier.txt · evidence/e2e/lifecycle.txt
Member payload is absent from contract events
The protocol does not store plaintext payload on-chain: contract events carry only ids, addresses, counts, timestamps and 32-byte hashes, and the BOT Chain testnet proof run found no plaintext in any registry event.
Needed for “The protocol does not store plaintext payload on-chain”: ABI/event inspection and testnet proof run.
evidence: evidence/unit/protocol-types.txt · docs/proofs/testnet/2026-09-23T09-02-50-791Z/output.json · evidence/e2e/lifecycle.txt
Testnet deployment exists
Deployed on BOT Chain testnet at 0x6f6e2c0fb44016d621e133612c61069de15cd710 (block 24389826), source verified on BOTScan.
Needed for “Deployed on BOT Chain testnet”: Address, verified source, explorer link, deployment transaction.
evidence: deployments/testnet.json · deployments/testnet.probe.json · https://scan.bohr.life/address/0x6f6e2c0fb44016d621e133612c61069de15cd710 · https://scan.bohr.life/tx/0x38d9f3545183c4a3728e3370e2df619683ea0e3825e389f1f6115b7b9eab655f
Mainnet deployment exists
Deployed on BOT Chain mainnet at 0xb565bd5875ae429f2ebca9e69e202407021c6d62 (block 24607284), source verified on scan.botchain.ai. Deployed under an owner override: testnet gates T3 and T6 and the independent security review were not complete.
Needed for “Deployed on BOT Chain mainnet”: Mainnet address, verified source, and deployment transaction.
evidence: deployments/mainnet.json · deployments/mainnet.probe.json · evidence/gates/M0.json · https://scan.botchain.ai/address/0xb565bd5875ae429f2ebca9e69e202407021c6d62 · https://scan.botchain.ai/tx/0x5a356b5443ab56410c2667c523ec8e1f4c0d934e29effd49bce0748f980d4c2c · docs/proofs/mainnet/2026-09-26T16-52-11-989Z/transcript.md · evidence/verifier/mainnet.json
Threshold release prevents all early disclosure
Relay does not claim this. A colluding threshold of relayers could disclose early, and contributors can keep their own copies.
Needed for “Never claim”: The model has a stated collusion and creator-retention limit (§6).
evidence: SECURITY.md