Signing & receipts

Today the coordinator Ed25519-signs every task assignment, and your Mac app verifies it against a pinned key before running anything. Job inputs pass through a trusted-download gate that refuses anything but HTTPS to public hosts, including across redirects. Billing settles against the recorded result.

Model weights are not hash-pinned yet. ModelManager will refuse to load a model that has no SHA-256 in our signed manifest — but the manifest currently ships empty, and every runner that needs weights fetches them through its own framework's downloader (WhisperKit and MLX from Hugging Face). Populating the manifest is tracked work; until it lands, treat model provenance as unverified rather than pinned.

A per-task verifiable receipt — input hash, output hash, model hash, price, and a coordinator signature you can check offline — is rolling out. Provider co-signature via the Secure Enclave follows. We document each field here as it ships, not before.