# Exalto Seal

> Capture provider calls locally, retain encrypted checkpoints, and notarize selected calls into independently verifiable OpenTelemetry trace packages.

## Documentation

- [Overview](https://seal.exalto.ai/docs): The Trace lifecycle: capture, deferred notarization, portable packages, and shared notarized Traces.
- [Trust and guarantees](https://seal.exalto.ai/docs/how-it-works): The exact provenance claim, participants, authenticated versus observed data, and limits.
- [Install options](https://seal.exalto.ai/docs/getting-started): Choose the guided Apple silicon macOS app or install the CLI and local service for SDKs, coding agents, servers, and automation.
- [Pricing](https://seal.exalto.ai/pricing): Monthly capture, notarization, and trace-storage plans, plus additional notarization credits.
- [Plans and usage](https://seal.exalto.ai/docs/hosted-credits): Subscription allowances, Stripe billing, additional notarization, trace storage, and public allowances.
- [Trace packages](https://seal.exalto.ai/docs/trace-packages): Notarization, package layout, disclosure, and offline verification.
- [Verify online](https://seal.exalto.ai/verify): Explicitly upload one notarized package for retention-free hosted verification.
- [Share](https://seal.exalto.ai/docs/share): Preview and deliberately share an already-sealed trace package as Unlisted or Listed, then manage stop-sharing, password, and expiry access from the hosted account.

## Core trust boundary

The local proxy handles plaintext and provider credentials. The remote notary participates in the authenticated provider TLS connection without receiving API-key values, prompts, or responses. A pending encrypted checkpoint is private retry state, not public proof. A notarized `.llmtrace` package is independently verifiable with the trusted notary public key. It hides every HTTP header value except the exact structural value `Transfer-Encoding: chunked`, but its authenticated request and response bodies remain disclosed.

The independently buildable public runtime is at https://github.com/exalto-ai/notary-runtime. It contains the protocol and evidence contracts, local daemon, REST CLI, generic remote notary, local dashboard, signed updater logic, runtime documentation, and pinned TLSNotary sources. Hosted account, billing, admission-policy, upload, and website implementations are outside that public tree; the generic notary exposes an admission-policy seam for deployments that need them.

Public hosted allowances are scoped by a keyed, rotating subject derived from one IPv4 address or one IPv6 /64 prefix. This is a coarse abuse control, not a claim about a person's identity and not a privacy guarantee. Users behind the same NAT, gateway, or VPN may share an allowance.

Free accounts get 50 MB each of hosted capture and notarization per month and can store up to 1 GB of uploaded trace packages. The $9.99/month plan raises both monthly allowances to 1 GB and trace storage to 10 GB. The $49.99/month plan raises both allowances to 10 GB and has no fixed trace-storage ceiling, subject to fair-use and abuse controls. Every plan can buy non-expiring additional notarization for $10 USD per GB. Verification, Trace exports, public Trace browsing, and self-hosting do not use these allowances.

On first use, the daemon creates a user-editable `config.toml` at the standard platform configuration location. It enables routes for the OpenAI API, ChatGPT-authenticated Codex, Anthropic, DeepSeek, and OpenRouter by default; keeps encrypted checkpoints and notarized packages under the platform data directory; and creates a local SQLite metadata store. SQLite and filesystem storage remain the desktop and CLI defaults. Clustered daemon mode uses PostgreSQL, a private S3-compatible namespace, automatic replica identities, one shared 32-byte vault-key file, and authenticated public HTTPS origins; its internal leases and fencing do not require routine tuning. The metadata store indexes short, plain-text prompt and output previews for search, along with provider, model, status, size, duration, and artifact metadata. It does not store header values, cookies, or credentials.

Subscription-backed authentication is supported and live-tested with Codex CLI using its saved ChatGPT login through the fixed `/codex` route and with Claude Code using its saved claude.ai login through `/anthropic`. The local service does not collect browser cookies, read either tool's auth cache, or perform login and refresh flows. These routes prove the authenticated provider host and disclosed bodies, not an account owner, subscription tier, or billing. Exalto Capture can supervise the local proxy, but it does not make vendor application traffic use it automatically. Native Claude Desktop is not configurable for this route. Codex desktop is not yet an end-to-end-tested or supported client surface. Browser, Slack, remote, and cloud agent sessions do not run through the local proxy.

## Local service and API

```sh
curl -fsSL https://seal.exalto.ai/install.sh | sh
notaryctl skill install --target all
notaryd
```

To build from source instead:

```sh
git clone https://github.com/exalto-ai/notary-runtime.git
cd notary-runtime
cargo install --locked --path crates/notaryd --bin notaryd
cargo install --locked --path crates/notaryctl --bin notaryctl
notaryd

curl http://127.0.0.1:8788/healthz
curl http://127.0.0.1:8788/openapi.json
notaryctl --json traces list --metadata-only --query pricing
```

Exalto Capture and the public Runtime are pre-release. Exalto Capture supports Apple silicon Macs running macOS 12 or later; production app downloads are signed, notarized, and published with the CLI archives. The website's single latest channel tracks the latest explicitly published stable Runtime release. The CLI installer verifies the downloaded archive against a SHA-256 value from the same publisher, which detects corruption but is not an independent release signature. `notaryctl skill install --target codex`, `--target claude`, or `--target all` installs the bundled portable agent skill without contacting the daemon; `--skills-dir` supports another Agent Skills compatible client. The skill teaches approval, verification, disclosure, and secret-handling boundaries while using the live local OpenAPI contract. Claude Code installs under `$CLAUDE_CONFIG_DIR/skills` when that environment variable is nonempty and under `~/.claude/skills` otherwise. It detects changes inside an existing personal skills directory; restart it if that directory did not exist when the current session started. Open `http://127.0.0.1:8788` for the local dashboard. Use `notaryctl status`, `notaryctl traces list`, or another CLI command to operate the daemon through its versioned REST API; add `--json` for automation. Raw Trace-list JSON includes stored prompt and output previews, so use `--metadata-only` before sending structured results to an agent transcript. The loopback admin API is open to local processes by default; an installation can require HTTP Basic credentials by setting `admin.auth` to a username and Argon2id password hash. Use `notaryd --config /path/to/config.toml` to start the daemon with a non-standard local configuration, and pass the same `--config` option to CLI commands. For a self-hosted notary, set `notary.endpoint` and `notary.public_key` together in that file. Hosted services discover the notary endpoint and verification key from the versioned Registry served over authenticated HTTPS; Registry JSON is not separately signed.

Capture requests are enabled by default. Turn them off in the local dashboard, native macOS app, tray menu, or `PUT /v1/settings/capture` to keep using the same fixed provider proxy routes without contacting a notary or producing capture evidence. While capture is off, the daemon connects directly to the selected allowlisted provider using ordinary WebPKI-verified HTTPS and streams both directions; redirects are returned to the caller and are not followed. The durable daemon setting applies once when each request is admitted, so in-flight work does not change mode. Re-enabling capture initializes the notary before publishing the change and leaves capture off on failure; captured requests never fall back to direct passthrough.

## Optional hosted account

Local capture, notarization, and verification do not require an account. `notaryctl account connect` starts a browser approval flow for account allowances and sharing; the daemon stores the rotating device credential in its private credential vault. `notaryctl account show` reports the connected identity, credential kind, plan, billing state, and balances without displaying the credential, and `notaryctl account disconnect` disconnects that device without deleting local evidence.

For an unattended host, create a deployment-specific least-privilege API key in hosted Account settings and inject it through `NOTARYD_PLATFORM_API_KEY` or a private `NOTARYD_PLATFORM_API_KEY_FILE`. The complete key appears only once and must not enter `config.toml`, logs, captures, or artifacts. An injected key and a stored browser-approved device session are mutually exclusive. API keys are revoked from hosted Settings; local login and logout are unavailable while one is injected.

## Package layout

```text
<trace-id>.llmtrace (ZIP)
├── archive-manifest.json
├── evidence.tlsn
├── manifest.json
├── request.disclosed.http
├── response.disclosed.http
└── trace.otlp.json
```