Agent-friendly usage

Use the CLI with --json and treat stdout as data. Never send private keys or plaintext to the relay except as locally encrypted ciphertext.

Agent contract

• Base URL: https://stashvlt.astm.co.za
• Health: GET /health
• Machine guide: GET /agent-guide.json
• CLI output: JSON when --json is supplied
• Error behavior: non-zero exit code and error: ... on stderr

Automation pattern

set -euo pipefail
relay=https://stashvlt.astm.co.za
store="$HOME/.stashvlt-agent"
StashVlt.Cli configure --store "$store" --relay "$relay" --inbox "$BLIND_INBOX" --json
StashVlt.Cli list --store "$store" --json | jq '.[].id'

Institution sender pattern

1. Receive recipient keyId, publicKeyPem, and blind inbox id from the user.
2. Use a sender ECDSA private key kept in local secret storage.
3. Run push with either --text or --file.
4. Store only the returned opaque package id in your own audit log.

Machine-readable hints

Fetch /agent-guide.json for endpoints, commands, examples, and operational limits.