Trust leaves a trace.

Last year a client told me I had not worked the hours on my invoice. Neither side can prove anything in that conversation, so I built the proof into the tool — and then had to keep correcting it. A hash chain proves nobody edited a row. It cannot prove nobody rewrote the whole file from row one, because the database, the operator and the machine all sit inside the same trust boundary. So the head of the chain is signed on a Securosys HSM in Switzerland. To forge history you now need hardware you do not have to sign for you, and it will not, because the private key cannot leave it. Not policy. Physics.

An engineer at Securosys read one sentence on the xNAUT site and asked two questions. One was a word — we wrote 'sealed' where we meant 'signed', and encryption was never in that path. The other was a hole: every attestation receipt was signed on its own, so you could delete the one you would rather nobody saw and every remaining signature still verified. The public verifier would have shown a clean green tick for a log with a hole in it. Receipts now carry a sequence and the hash of the previous one, and the HSM signs position and content together. We had published the correct argument two days earlier and still shipped the bug one directory over — which is the part worth saying out loud.

A proof you can only check through the party who made it is a promise wearing a costume. So a receipt verifies in your own browser at xnaut.dev/attest against the published public key — or, if you do not trust that page either, with one line of stock OpenSSL against the key and the signature. No account, no API, no xNAUT installed. The math answers.

Explain Screen, chat and theme generation run against Ollama or LM Studio on localhost unless you ask otherwise. Cloud providers sit behind a privacy monitor that flags keys and PII before a prompt leaves the app. The default matters more than the option.

Hand a coding agent a one-line request and it produces something plausible. What it will not tell you is which parts of your request it quietly dropped or which assumptions it invented — because nobody wrote down what done meant, so there is nothing to check the result against except your memory of a sentence you typed an hour ago. NautFlow keeps your words verbatim as the contract, builds a document chain on top, and has a Validator attack it and write the acceptance gate before the build starts. A slice that promised an object and returned a string used to sail on and fail three steps later; now it stops at the boundary where the promise broke. Untested is not passed.

The manager watching the agents was blind: a gate that answered yes or no so four failing checks and forty looked identical, a timer that interrupted every agent every five minutes regardless of what it was doing, and a build slice that could never actually fail, so a dead build looked exactly like a slow one. Rather than invent a way out I went reading — research code, other tools, and what people said was not working. The gate reports a score now, agents are interrupted when they stall rather than on a clock, and a failing slice is allowed to fail. Almost none of that was my idea, which is the part of open source that matters most.