Proof

• The agent key exists only inside an Intel TDX machine on Phala. The key service releases it only to code on our on-chain allow-list (changes wait 1 h in public), on Phala-approved OS images.

  A fresh TDX quote from the enclave; the compose hash on the DstackApp allow-list on Ethereum; the quote's agent key = registry.agent().

• Every on-chain action follows from a published record: the model's output plus the chain data it judged, referenced by block hash. Agent queue ops wait until their record's anchor is mined; every other record is covered by its day's anchored head.

  The enclave-signed log chain; the record viewer below re-runs the public mapper; anyone can replay eth_getLogs over the referenced blocks.

• The team cannot sign as the agent or change its code without a public, delayed on-chain trace.

  Timelock events and ComposeHashAdded / ComposeHashRemoved on the DstackApp: every allowed compose hash is a public event.

• Images on its posts: the art is generated outside the enclave and checked inside it; every number and address on an image is drawn by the enclave; the image's sha256 is in the signed post record.

  Each x_post record (/api/log) holds the image's sha256, its source (generated art, a pinned plate or the logo) and the generator's request id; the enclave image pins the plates, the font and the logo. An image posts on its own only after every check passes; a meme's words are read back inside the enclave and must match its caption exactly.

• Every post and reply is signed before it goes out. The enclave writes the exact text to its log, then calls X.

  Paste a post's link into the record checker below. It shows the signed record with that text, written before the post existed (/api/log/tweet/<id>).

• Every brain decision is a signed record with the model and the hashes of its context, its persona and its self-file. The model behind each role is listed in a public registry. These are the default models. Swapping one needs a public tryout on fixed test cases, then a public hour, and the Safe can veto. Swapping the brain itself needs two Safe owners to approve.

  /api/log records of kind brain; engine/models.json; each swap is a signed model-change record. Which model does each job

• Safety does not depend on any of this. Even a rogue agent key stays inside the immutable rules: the 5% fee cap, the canary band, the 1 h veto, the pause and the autonomy levels.

  The contracts (see Hard limits).

The personality is private; its fingerprint is public, so any change is visible. Every brain decision record names the sha256 of the persona it ran under, its context and its self-file.

• The Safe (2-of-3): can veto any queued op within 1 h, pause the agent, lower its level, and is the timelock's proposer for code changes.
• Human review of new module bytecode: the agent can only register code the Safe approved by hash.
• Telegram /halt, /dryrun, /mute and /delete: signers can stop the engine, hold it in dry run, stop its X posting, delete one of its own posts, and reject a draft. These are brakes: they only restrict or remove, and none of them can make the agent act, post or approve anything.
• Safe owner signatures: approving a drafted post takes one Safe owner's signature over that exact draft; approving or vetoing a delayed record takes owner signatures too (a veto needs two). Telegram only carries the signature; the engine checks it against the Safe's owners on-chain.
• The Phala Cloud account: the operator holds it: it can stop or redeploy the machine, never read the key or change the allowed code.
• The X account: the operator keeps its password and 2FA and can revoke the app; posts are automated within fixed rules.
• Idea intake and restrict-only jobs: X mentions become idea submissions; the database can ask for a canary to end or a kill check, which the enclave re-derives from chain data.

• That a given text really came from Grok or Claude: no provider signs its responses.
• That no human influences it: prompts, parameters and data feeds are human-chosen, and the public can submit ideas.
• "Autonomous", "trustless" or "unhackable". Trust remains in Intel TDX, in Phala's platform governance and in our Safe.
• Outside our control, disclosed: Phala's key-service owner (a 2-of-3 Safe, upgradeable, no delay) can change the key service's policy. We watch it; we cannot prevent it.

These checks are ours: run them yourself instead of trusting this page. The command-line verifier does the same against Intel's own collateral service:# github.com/contractdna/dna-build (engine/) node scripts/verify.ts --attestation https://f0839119995e13aa6c5148edd0ce7c7a929952bc-8080.dstack-eth-prod9.phala.network/attestation --rpc <your node> --log https://genomedna.xyz

Anthropic and xAI do not review, verify or endorse what DNA's models decide; their outputs are used under their terms. The posts on X are written with Grok, the default model for that role. Swapping one needs a public tryout on fixed test cases, then a public hour, and the Safe can veto. Swapping the brain itself needs two Safe owners to approve.