There's a quiet assumption buried in most software: that when the screen says "the user approved this," something is telling the truth. Usually it's a checkbox a web page sets, a flag a phone app passes along, a little "yes, they confirmed" message handed from one piece of code to another. And usually nobody asks the obvious question — what if that message is lying?

This week we closed that gap for the actions in NAOMS that matter most. The decision "did the real you actually approve this?" no longer trusts a claim from a browser or an app. It is checked by the part of NAOMS that runs on your own machine, which triggers your fingerprint prompt itself and reads the answer with its own hands. The thing that asks for your tap is the thing that decides — and nothing in between gets to vouch for you.

flowchart LR
  B["A browser, phone, or script
asks to do something sensitive"] --> D["NAOMS, on your machine,
sees how sensitive it is"]
  D -->|"elevated / critical"| P["It asks the OS for your fingerprint
and reads the result itself"]
  P --> Y["You tap → it proceeds"]
  P --> N["No tap → it refuses"]
  B -. "can no longer claim
'they approved' on its own" .-> X([the client's word is not enough])

What changed, in plain terms

Before, a sensitive action could be waved through on the strength of a "they confirmed" signal coming from the screen you were looking at. Now, for the weighty stuff — the governance decisions, the elevated and critical actions — that signal isn't enough by itself. NAOMS classifies how sensitive the request is, and if it's one that matters, it goes and gets a real fingerprint from you, itself, on the spot. A tab can't fake it. A script can't assert it. If the tap doesn't happen, the answer is no — it refuses rather than waving things through, the same fail-closed instinct behind every permission decision NAOMS makes.

This builds directly on the local fingerprint check we wrote about yesterday — your own machine asking and reading the tap, with nothing sent to a server. What we did this week was make that the only way a weighty yes can happen: move the check to the one trusted place and take the vote away from everyone else.

What's real, and what's still landing

The rule of this devlog is to never call a half-built thing finished, so here's the exact line.

Proven. The core governance path — the one that signs off sensitive, authority-granting actions — now requires that real, locally-checked tap, and we proved it end-to-end with an actual owner fingerprint (not a test stand-in: the real handler ran, the prompt appeared, a finger went down, the action was authorized). The unlock for your local database was rerouted through the very same check, and that built clean on both macOS and Linux.

Still landing. Extending the same gate to every path a browser can use to approve something — and deleting the browser's own, now-redundant fingerprint code so there's nothing left to fake — is in progress right now. The final proof we hold ourselves to for that part is the full browser-to-machine-to-tap run with a real owner tap, and that's the next thing we sign off. We're telling you it isn't done yet because the whole point of this work is that you can trust what we say is checked.

The shape we're after is simple: one place, on your machine, that decides every sensitive yes — and not a single thing anywhere else able to say it for you.

Written by AI agents from real project logs; owned and edited by Mujo.