NATHORIZON

Immutability is a constraint before it is a selling point. Before any interface existed we set the contracts: an ERC-721 whose transfer log is the provenance record, a marketplace contract that holds listings and escrows bids in the same place it enforces them, and metadata pinned to IPFS — content-addressed, so a token points at a hash, never at a server whose lease can lapse.

Onto that warp we shipped the product in weekly passes: a mint flow that pins to IPFS and verifies the hash before touching the chain, listing and bidding against the escrow contract, an indexer that rebuilds marketplace state from emitted events rather than keeping a private database of truth, and a provenance view that walks Transfer logs back to mint — the history is the product.

Every merge was beaten in: line review on anything holding ether, property tests across the bid escrow — outbid refunds, expired listings, reentrancy on every withdraw path — and full auction rehearsals on testnet before each deploy, because mainnet has no staging tier and no rollback. Code that holds bids is dull on purpose.

NATHORIZON runs in production today. Listings open, bids settle and tokens transfer without anyone from our side in the loop — the contracts don't know we exist, which was the point. Pinned metadata keeps resolving, provenance accumulates one transfer at a time, and outbid ether goes back through pull-payment, not through us. Cloth, worn in public.