Your team knows what it wants to share, and your partner knows what it needs. Froglet turns that agreement into one small service that runs on infrastructure you control, with access limits you set and signed records you can check later.
Each row is a question your partnership has to settle. The middle column is what Froglet can apply today; the right column is what does not exist yet.
| The agreement asks | Works today | Not there yet |
|---|---|---|
| What is shared?Scope | You pick the exact tables and fields, a small function, or one fixed HTTPS operation of a tool you run. Your assistant shows a preview, and nothing is published until you approve that exact preview. | No organization-wide sharing policy, and nothing reads a data-sharing agreement for you. |
| What becomes public?Disclosure | Your source files, omitted columns, and upstream credentials stay private. The description, the example, the names of the tables and fields you expose, the price, and the limits are published. | Signed receipts appear on the provider’s public feed, even for invite-only services. Receipts generated by this node name the requester’s public key and carry timing, outcome, a hash of any result, and any failure diagnostics, but omit successful result bodies. In the experimental Python runtime, error output from a failing program can become public failure diagnostics and reveal data derived from its input. |
| Who may use it?Access | Services are open by default. You switch on private, invite-only, or bounded trial access in the node’s configuration and restart it. An invitation lasts up to 30 days and allows 2 to 10,000 requests; a normal call uses two. | An invitation covers every service on that Froglet host, so separate audiences need separate hosts. There are no roles, groups, or single sign-on. |
| How much can they use?Limits | A protected node will not start without finite allowances for quotes, deals, and runtime, and you can pause new work at any time. WebAssembly runs are fuel-metered with configurable memory, fuel, input/output, GPU tensor element/dimension (compute.gpu.tensor), and timeout ceilings, federated learning silos can enforce persistent Rényi DP privacy budget ledgers, and an HTTP tool has a deadline and byte limits. | Allowances are provider-wide counters, not currency budgets or a cap on cloud costs, and they do not stop work already started. Nothing spans several hosts, teams, or an organization. |
| What if we stop?Withdrawal | Pause or unpublish a service, or revoke invitations, and new work stops. | Deals already admitted still finish, and a recipient keeps results already delivered. Switching off the machine makes a service unavailable; it does not unpublish it. |
| Who can see it in transit?Confidentiality | Requests and results travel over TLS. Publishing from your own public HTTPS endpoint sends calls straight to your node. | The guided path publishes through a Froglet relay that terminates TLS and can see requests and results. There is no end-to-end encryption or confidential-computing runtime yet. |
| How do we show what happened?Evidence | Each exchange leaves signed records of the offer, quote, deal, and receipt that anyone can verify offline, with no node and no network. | A signature shows what a key signed, not that the work was correct or who the legal signatory is. SLA monitoring and remedies are future work. |
| Who is who?Identity | Each node signs with its own key, kept as a private file on the node that is not encrypted at rest. Froglet can write an encrypted backup and rotate the key on a schedule, leaving a signed continuity record. | There is no protocol-level key revocation, so a leaked key means moving to a new identity. Tying a key to an organization through a DNS record is a prototype; the service that issues attestations is specified, not built. |
| What does it cost?Payments | The guided path is free. An assistant pays nothing by default: a paid call needs an explicit price ceiling, a buyer wallet, and a cumulative spend budget. | No live-money transcript and no complete billing workflow. Do not plan a pilot around revenue. |
| Where does it run?Hosting | On an Apple Silicon Mac or a Linux machine you control, which has to stay online. With the relay it only dials out, so no inbound firewall change is needed. | There is no managed product to sign in to today. Always-on managed hosting is future work, and Windows is not supported. |
Each side keeps its own records, and anyone holding them can check them offline. Inspect a sample record.
Choose what to share and approve the exact preview. Your node signs a descriptor and an offer.
descriptor · offerTheir assistant opens your link or finds the service in the marketplace, and reads what it does.
public metadataFor one specific request, your node signs a quote. On an invited service, that is one invitation request.
quoteThe partner signs a deal that accepts the quote. On an invited service, that is a second invitation request.
dealYour node runs the work inside its limits and signs a receipt for the result.
receiptFroglet is in public beta, so treat it as a pilot rather than a platform purchase.
| Step | What you do | Done when |
|---|---|---|
| Choose one exchangeBusiness owner | Pick one small, non-confidential catalog or operation and one partner who needs it. Write down what is shared, who may use it, for how long, and what would make you stop. | Both sides can describe the exchange in one paragraph. |
| Run it yourselfOperator | Use Codex or Claude Code on Apple Silicon macOS or Linux to install Froglet and prepare the service. Review the exact preview before anything is published. | The service answers a test request from your own machine. |
| Invite one partnerOperator and partner | Publish the service with invite-only access: set it in the node’s configuration, restart, and create an invitation. The partner connects Froglet to their own assistant and calls the service. Test the deployed access controls before you rely on them. | The partner gets a result, an uninvited caller is refused, and new requests stop when the invitation expires or is revoked. |
| Review the recordSecurity or compliance | Verify a signed record offline. Read what it says about who signed, what was agreed, and what was returned, and what it does not say. | The reviewer can state in writing what the record proves and what it does not. |
| DecideBusiness owner | Continue, widen the scope, or stop. To end the pilot, revoke the invitation and pause the service. Compare what you needed with the gaps listed above. | You have a written decision and the list of gaps that matter to you. |
No. A new service is open to anyone who can reach it until you configure private or invite-only access, or bound it with trial allowances, in the node’s configuration and restart it. A node in a protected mode refuses to start without finite allowances, and one that exposes an HTTP operation refuses to start in open mode. Test the deployed access controls before you rely on them.
The data you select is copied into a separate snapshot, and the original stays private and unchanged. A service’s description and public example are published as metadata, so keep confidential data and credentials out of them. Receipts for completed calls are listed on your public feed, even for invite-only services. Receipts generated by this node name the requester’s public key and carry timing, outcome, a hash of any result, and any failure diagnostics, but omit successful result bodies. In the experimental Python runtime, error output from a failing program can become public failure diagnostics and reveal data derived from its input.
Calls travel over TLS. If you publish through the Froglet relay, which is the guided default, the relay terminates TLS and can see requests and results. Use non-confidential data for a pilot. Sensitive payloads need your own public HTTPS endpoint; an end-to-end encrypted tunnel is only a candidate for a later version.
Each node creates its own signing key on the machine that runs it. The key is a private file on that disk and is not encrypted at rest, so run the node on an encrypted disk. Froglet can write an encrypted backup with a separate recovery key, and an operator command lets a KMS or HSM protect that backup. You can rotate the provider key on a schedule. Upstream credentials for a connected tool sit in a private policy file on the node, which must be owned by its user with mode 0600 and is not encrypted.
There is no protocol-level revocation. If a key leaks, you stop the node, create a new identity, and republish under it.
It shows which key signed the offer, quote, deal, and receipt, and that they have not been altered. Anyone can check that offline. It does not show that the work was correct, identify a legal signatory by itself, prove that a payment settled elsewhere, or resolve a dispute.
No. Froglet is an open-source protocol in public beta. There is no support contract, SLA, or compliance certification, and no managed service to hold one. Community questions go to GitHub Discussions.
One person maintains Froglet today. The code is Apache-2.0, the specification and conformance vectors are public, and a second, independently written verifier in Python (alpha) checks the same vectors, so records stay verifiable and the protocol can be reimplemented. That reduces lock-in. It does not make a single-maintainer project low-risk, so plan accordingly.
The clean-machine tests on the supported platforms and a first-time-user evaluation are still open, so this is not a stable release. Pin the release you test and expect changes. Codex or Claude Code on Apple Silicon macOS or Linux is the supported path; Windows is not.
Follow the security policy in the repository. It promises an acknowledgement within 48 hours, an assessment within 7 days, and a fix or documented mitigation within 90 days. Only the latest release receives security fixes.
The long-term goal is to turn an agreement into configured services that people and their assistants can use: what is shared, the conditions of access, and the terms of service such as price, availability, and support.
This is the product direction. Froglet does not currently read an arbitrary contract and implement all its clauses. SLA monitoring, remedies, and organization-wide policy management are future work. These are directions, not commitments or dates.
Choose a small, non-confidential catalog or operation. Test it with a partner before widening the scope.
After 10 years building platforms in life sciences, this is the recurring problem that led Armanas to build Froglet.