Rohan: A Stateless Zero-Knowledge Trust Gateway for Privacy-Preserving Agentic Workflows via Streamable HTTP

The rapid advance of autonomous Multi-Agent Systems (MAS) across enterprise workflows, AI infrastructure increasingly transitions toward cloud-native, scale-to-zero environments and browser-native execution runtimes. However, production deployment remains severely constrained by data leakage risks inherent to the Model Context Protocol (MCP), which frequently exchanges sensitive credentials, system prompts, and negotiation constraints in plaintext. Furthermore, legacy security boundaries enforce persistent network tunnels (e.g., Server-Sent Events, WebSockets) that break serverless scalability. This paper introduces the Rohan Protocol, a stateless Zero-Knowledge (ZK) trust gateway that decouples execution data flow from cryptographic trust verification. By compiling zero-knowledge circuits into universal WebAssembly (WASM) components via WASI Preview 2 and browser WebWorkers, Rohan generates client-side proofs of validity (~580 Bytes) transmitted over a novel Streamable HTTP transport standard. Rohan integrates deterministic RAM sanitation via zeroize, an in-line semantic firewall to neutralize indirect prompt injection, and browser DOM shielding for WebMCP. We demonstrate that Rohan eliminates persistent socket overhead, guarantees privacy-by-architecture, and ensures GDPR/HIPAA compliance within highly distributed machine-to-machine (M2M) economies.