Implement it.
Run it.
Verify it.
Froglet combines signed service exchange with a runtime for bounded remote computation and an offline verifier. The kernel is frozen and covered by public vectors, so you can build on it or reimplement it.
- froglet/v1 frozen
- Rust 1.91
- Apache-2.0
- Public beta
Check a signed chain
without installing anything.
The panel runs froglet-verify, compiled to WebAssembly, in this tab. Nothing is uploaded. It checks every signature, every hash, and the links between artifacts. It cannot tell you the work was right.
Verifies the five-record free-deal chain from the frozen conformance vectors. The second button changes one field in the receipt first, so you can watch it fail.
The same check on the command line
cargo run -p froglet-verify -- conformance/kernel_v1.json[ok ] descriptor dbc62553ea46 envelope + semantics verified
[ok ] offer 8c505f064878 envelope + semantics verified
[ok ] quote 6b2b874382db envelope + semantics verified
[ok ] deal d96f9e9b5fc0 envelope + semantics verified
[ok ] invoice_bundle fa8bec3305c2 envelope + semantics verified
[ok ] receipt e4e242f9b194 envelope + semantics verified
chain descriptor_offer: ok
chain offer_quote: ok
chain quote_invoice_bundle_deal: ok
chain quote_deal_receipt: ok
result: VALIDExit code 0 is valid, 1 invalid, 2 a usage error. The other options, formats and runners are in the conformance guide, and the full browser verifier takes your own records.
Write a function.
Publish it. Call it. In this tab.
Bob publishes a function and Alice calls it. Write Bob’s function in the editor and this page compiles it to a real WebAssembly module, then runs that module. Both sides run in your browser, on the Rust kernel a node uses, so the keys, signatures, and receipts are real. The two sides talk to each other inside this page, and what you write and what they sign never leaves your tab.
The contract that follows your code
Compiled in this page by AssemblyScript and Binaryen, which load from this site the first time you compile (licences). Download the module to run the same bytes on your own node. The service binding says what a node expects.
Her key: a new key when Bob publishes
Use integers within ±9007199254740991. A browser rounds anything larger, so both sides refuse it.
- Discover
- Quote
- Deal
- Result
- Verify
Every message between Alice and Bob in the latest call, as JSON text. Open one to read it. A repeated poll for the result is folded into one line.
The evidence as JSON
Paste the copy into the receipt verifier, or save it to a file and run cargo run -p froglet-verify -- evidence.json.
What is real, and what is not
Real
- The keys, signatures, and hashes come from
froglet-protocol, the Rust kernel, compiled to WebAssembly asfroglet-wasm. With the conformance vectors’ seeds it reproduces their descriptor, offer, quote, deal, and receipt byte for byte. - Every check is
froglet-verify, the same WebAssembly build as the panel above. - The routes and JSON are a node’s provider API. A real
froglet-nodeserved the same kind of exchange, and a test checks that this page’s responses have the same fields and value types. An opt-in test also has a real node’s requester call this provider. - The function you write is compiled in this tab by the AssemblyScript compiler, into a WebAssembly module that imports nothing. A real node accepts the same bytes, runs them, and reports the same module hash. An opt-in test checks this.
- The function runs in a Web Worker that can import nothing. Bob stops it at his time limit, and adds a memory maximum to the module.
Not real
- There is no network. Bob and Alice call each other inside this page, each message crosses as JSON text, and nobody else can reach Bob.
- Deals are free: no invoice, no payment, no settlement.
- Browsers cannot count fuel, so a node’s fuel limit is not enforced here. The time limit and the memory maximum stand in for it.
- Nothing is saved. Reload the page and both identities, the function, and the evidence are gone.
- You cannot write JavaScript here. The kernel has no JavaScript runtime, and an offer that names one is invalid, so the editor takes AssemblyScript. It looks like TypeScript, but its numbers are typed and it has no closures.
- A tab is not a node. It has no access control, no storage, and no marketplace listing. To serve real callers, run
froglet-node.
A small kernel.
Everything else can change.
Froglet fixes only what has to be irreversible: the signed records two parties leave behind. Transports, storage, execution, and payment sit around that kernel as adapters, and services are built on top. The kernel does not hardwire a marketplace, a transport, a storage engine, or an execution runtime.
- Servicesbuilt on the protocol
Marketplace, brokers, curated lists. A service is a Froglet provider that is discovered, quoted, and settled through the same deal flow as any other.
- marketplace
- brokers
- curated lists
- Node runtimefroglet · src/
The HTTP server, deal tracking, jobs, SQLite storage, auth, and configuration. One binary, froglet-node, runs as a provider, a runtime, or both.
- provider API :8080
- runtime API :8081
- SQLite
- Adaptersexecution and transport
What makes the kernel usable somewhere specific. Each one can change without changing how hashes, signatures, deals, or receipts work.
- MCP
- A2A (optional)
- Wasm
- Python
- OCI
- Lightning
- Tor
- TLS
- relay
- Nostr
- TEE (spec)
- Economic kernelfroglet-protocol
The smallest irreversible surface: the signed envelope, canonical JSON, hashing, signatures, and six artifact types. It knows nothing about HTTP, databases, or sandboxes.
- RFC 8785 JCS
- SHA-256
- BIP-340
- six artifacts
A free exchange leaves five signed records
- descriptorsigned by provider
Who the provider is, what it can do, and where to reach it.
- offersigned by provider
One service, with its price and execution profile.
- quotesigned by provider
A price and limits for one specific workload and requester.
- dealsigned by requester
The requester commits to the quote.
- receiptsigned by provider
The outcome, the result hash, the limits applied, and the settlement state.
The records bind identities, terms, workload and reported outcome through hashes. Anyone holding them can check those relationships. Lightning escrow adds an InvoiceBundle after the Deal; free and prepaid exchanges use five records. Step through it in the protocol walkthrough, or read how one artifact is signed.
Signed froglet/v1 artifacts verify forever. The stability policy forbids any change that alters the verification outcome of an existing one.
A signed result can still be wrong. Froglet makes commitments and result hashes attributable to signing keys. Correctness and usefulness still need evaluation. Payment settlement depends on the configured payment system. Staked identity is designed, not deployed. It is not a live guarantee against misconduct. See trust and incentives and payment setup and limits.
Your program.
Someone else’s machine.
Alice supplies a compatible Wasm program and input. Bob offers computation with explicit limits. MCP connects Alice’s assistant; optional A2A carries the task between Nodes. Froglet’s runtime admits the work, executes it and returns signed evidence.
Alice’s assistant
Calls
run_computewith the program, input, price cap and a retry key.MCP is the tool interface.
Alice and Bob’s Nodes
Bind the request to exact terms. The optional A2A adapter carries scoped, identity-bound tasks.
A2A is the task interface.
Bob’s executor
Runs the program with memory, fuel, time and output limits. Alice verifies the returned records.
Froglet supplies the execution boundary.
A working local research example. Bob publishes a selected illustrative terminology table. Alice retrieves it, then runs a disposable mapping check on Bob’s executor: two observed terms have one target, one has multiple targets, and one is unmapped. The check follows Alice’s exact-string, one-target rule; it does not decide scientific meaning.
Observable execution boundaries. The runner checks exact retry and changed-input refusal, stops an infinite loop at an execution limit, and recovers the same result after Bob restarts. An actual Codex session has also retrieved the rows, run a local compiled Wasm file remotely and recovered its verified result on one Mac. The native workflow also passed in an isolated Linux arm64 development environment; fresh-machine and Linux agent-host qualification remain open.
Explicit research assumptions. An optional native research profile declares fields, namespaces, versions, units and provenance. Alice can detect differences before analysis. Matching declarations still need scientific evaluation.
A specific scope. Free jobs, configured counterparties, direct ingress and polling. The released Mac node also passed a separate native-MCP-to-Fly proof: six synthetic free cases, provider restart persistence and offline task recovery. That isolated test host was removed. Available hosted compute, production/load, clean OS installation, fresh agent hosts, independent user trials and real-money settlement need separate qualification. A2A requires Froglet’s extension; an arbitrary A2A client is not automatically compatible.
What you can run
and build on today.
You need Rust 1.91 to build from source. Each tool carries a maturity label, and Status lists them all with their evidence. The public beta runs supplied Wasm programs and a synthetic catalog without installation or an invitation; the browser verifier can inspect the returned signed exchange.
Run and verify
Reference node
froglet-node · src/One binary that runs as a provider, a runtime, or both. The role defaults to provider, and dual also serves the runtime API that agents use. The first start creates an identity and a ./data directory.
bash FROGLET_NODE_ROLE=dual cargo run -p froglet --bin froglet-nodeOffline verifier
froglet-verify/A library and a command line. They check every signature, hash, semantic rule, and chain link, with no node, network, or clock.
Offline verifier · Beta
The command line does the same check as the panel above.
Browser verifier
froglet-verify · WebAssemblyThe same code compiled to WebAssembly. It runs the panel above and the receipt page, entirely in your tab.
Browser verifier (WebAssembly) · Beta
Nothing is uploaded. Paste your own signed records on the receipt page.
Python verifier
python/froglet-verify/An independent implementation with no dependencies. It verifies and does not sign.
bash PYTHONPATH=python/froglet-verify python3 -m froglet_verify.conformance conformance/kernel_v1.jsonConformance vectors
conformance/The frozen vectors that define froglet/v1, with their seeds, and the rules a conforming runner must assert.
Conformance vectors · Beta
bash cargo test -p froglet --test kernel_conformance_vectors
The author CLI
| Command | What it does |
|---|---|
froglet-node init <name> | Scaffold a service project. |
froglet-node build | Validate manifests and build the artifact, without publishing. |
froglet-node publish [--host local|relay|tor|self] | Publish through the local daemon. Two calls: a plan, then the exact approval. |
froglet-node prepare-service --request FILE | Prepare a selected catalog or a Wasm service and run its example. |
froglet-node invoke <id|share-url> [input] | Call a service. Share URLs require verified free terms. |
froglet-node doctor --json | Diagnose the installation, runtime, relay, and agent. |
froglet-node identity <command> | Generate, back up, restore, rotate, or verify identity custody. |
froglet-node mcp | Run the native MCP bridge for an agent host. |
Connect and build
MCP
froglet-node mcp · integrations/mcp/frogletOne tool named froglet for compatible agent hosts. The native bridge needs no Node.js. It supports supplied Wasm jobs with run_compute and read-only recovery with get_task, as well as two-call publishing. Use a source build or release containing these actions.
MCP · BetaClaude Code · Beta
A2A
A2A 1.0 HTTP+JSON · optional adapterTask communication between configured Nodes. Disabled by default; requires scoped credentials and the Froglet extension. Uses direct ingress and polling. The Froglet Node still executes the program and enforces its limits.
A2A adapter · Beta
OpenClaw and NemoClaw
integrations/openclaw/frogletThe same froglet tool as a plugin. It needs Node.js 22.14 or newer.
OpenClaw · Beta
HTTP API
docs/openapi.yamlOpenAPI 3.1. The provider API on port 8080 serves the public requester routes and Bearer-authenticated control routes. The runtime API on port 8081 is for the local operator.
Wasm services
froglet.wasm.run_json.v1Write a service in any language that compiles to WebAssembly. Export memory, alloc, and run; import nothing. The node adds fuel, memory, output, and wall-clock limits.
WASM · Beta
Real artifacts.
Real output.
The signed records here come from the frozen vectors and from a page a real node served. The code runs as written.
A signed offer
{
"artifact_type": "offer",
"created_at": 1700001001,
"hash": "60ffddf33a160f435d92fbd7b5bdbe66dca502c39b3662668677916b491bb001",
"payload": {
"descriptor_hash": "dbc62553ea46192d7ff2eeb26b9aa14344ce1866f9b8c915e26a1c77dc5f23cd",
"execution_profile": {
"abi_version": "froglet.wasm.run_json.v1",
"fuel_limit": 50000000,
"max_input_bytes": 131072,
"max_memory_bytes": 8388608,
"max_output_bytes": 131072,
"max_runtime_ms": 30000,
"runtime": "wasm"
},
"offer_id": "execute.wasm.free",
"offer_kind": "compute.wasm.v1",
"price_schedule": {
"base_fee_msat": 0,
"success_fee_msat": 0
},
"provider_id": "4f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa",
"quote_ttl_secs": 300,
"settlement_method": "none"
},
"payload_hash": "6b1eeceb05bf702bbb26dc5b857010db419ace4d682975cd81517683c7c46be5",
"schema_version": "froglet/v1",
"signature": "bd1bd9b71a375af3de3b886d4bac12f70d02f5f4d94ddf6cf6aa5404d3214fca03951c860e43f89142c3ca435ff9cf66183e18b72e0d97d20b99fde370b7075b",
"signer": "4f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa"
}One service, with its price and execution profile, signed by the provider.
A node’s own feed, verified offline
curl -s 'localhost:8080/v1/feed?limit=50' | cargo run -q -p froglet-verify -- -[ok ] descriptor a66dcbdd8dc5 envelope + semantics verified
[ok ] offer 66c9da40e683 envelope + semantics verified
[ok ] offer bdf896bfc598 envelope + semantics verified
[ok ] offer fdea8f08a87c envelope + semantics verified
result: VALIDThe output is from a page a real node served, kept as a test fixture, so your hashes will differ. The feed is paged, so the verdict covers the page you fetched.
A whole Wasm host
// moduleBytes: a .wasm that exports memory, alloc and run, and imports nothing
const { instance } = await WebAssembly.instantiate(moduleBytes, {});
const input = new TextEncoder().encode(JSON.stringify(request));
const ptr = instance.exports.alloc(input.length);
new Uint8Array(instance.exports.memory.buffer, ptr, input.length).set(input);
const packed = instance.exports.run(ptr, input.length); // i64: result pointer in the high 32 bits, length in the low 32
const at = Number(packed >> 32n), length = Number(packed & 0xffffffffn);
const result = JSON.parse(new TextDecoder().decode(new Uint8Array(instance.exports.memory.buffer, at, length)));What it shows
This runs in a browser as it stands. A real host also canonicalizes the request and enforces limits on fuel, memory, output size, and time; the node does, and browsers do not meter fuel.
The contract is froglet.wasm.run_json.v1. The service binding page describes how it fits the deal flow.
Different pieces.
Different levels of maturity.
These are source maturity labels, backed by repository evidence. They do not certify a deployment, live-money payments, or uptime.
- SpecDocumented and specified. No implementation to run yet.
- PrototypeRuns locally. Incomplete error handling; not exercised against live endpoints.
- BetaWorks against live or hermetic endpoints. Known edge cases remain.
- ProductionError handling, idempotency, and observability in place, with a public transcript.
| Payment integration | Status | Current boundary |
|---|---|---|
| Lightning | Beta | Proven end-to-end on regtest with real LND. No mainnet payment has been made. |
| x402 | Prototype | Kernel semantics, conformance vectors and a separate HTTP payment endpoint exist. Priced signed Quote/Deal admission rejects this rail; no live transcript on any network. |
| Stripe | Prototype | Test-mode Shared Payment Token flow against a mock and the Stripe sandbox. No live-money transcript. |
Implementations of froglet/v1
| Implementation | Independent of the Rust code? | Scope |
|---|---|---|
froglet-protocol and froglet-verify (Rust) | The reference | Kernel, verifier, and CLI. |
Browser build of the signing kernel, froglet-wasm (WebAssembly) | No, the same code | Signs and hashes for the playground. Prototype |
Browser build of froglet-verify (WebAssembly) | No, the same code | Runs the panel above and the receipt page. Beta |
python/froglet-verify (Python 3.10+) | Yes | Verify only, no dependencies. Marked alpha in its package metadata. |
| Yours, in any language | Yes | Reproduce the vectors. |
Several Rust runners exercise different distribution paths, but they share one implementation and do not add diversity. The Python verifier is the only independent implementation so far, and it is verify-only.
All runtimes, integrations, and evidence
| Integration | Status | Evidence and limits |
|---|---|---|
| Offline verifier | Beta | Verifies a full chain offline with no node and no network; reproduces the frozen conformance vectors. Source evidence |
| Browser verifier (WebAssembly) | Beta | The same froglet-verify code compiled to WebAssembly; the site tests it on the sample chain and a tampered copy. It shares the Rust implementation, so it is a distribution path, not a second implementation. Source evidence |
| Browser playground | Prototype | A provider and a consumer for free deals in one tab, signing with the Rust kernel compiled to WebAssembly, with an editor that compiles the provider’s function in the tab. Tested against the conformance vectors and a real node’s captured responses, and by two opt-in tests on one machine: a real node’s requester calls its provider, and a real node runs the modules its editor compiles. Its two sides talk in the page, not over a network. Source evidence |
| Conformance vectors | Beta | Frozen byte-for-byte and re-verified by Rust runners sharing the protocol implementation and an independently implemented Python verifier. Source evidence |
| Claude Code | Beta | The single froglet tool and host configuration are covered by protocol tests. This is not qualification of a particular installed Claude Code session. Source evidence |
| MCP | Beta | Native stdio bridge supports bounded run_compute and read-only get_task. Real local requester/provider tests cover successful execution, retry identity, refusal of changed input and recovery. Use a source build or release containing these actions. Release scope and qualification |
| A2A adapter | Beta | Optional, disabled by default. Configured counterparties use direct ingress, polling and a required Froglet extension. Free local jobs and restart recovery were exercised with the official SDK; full TCK and real-money deployment remain unqualified. Release scope and qualification |
| OpenClaw | Beta | Shares the single-tool dispatch library with the MCP surface. Source evidence |
| WASM | Beta | Fuel-metered execution with declared limits; the most exercised runtime in the test suite. Source evidence |
| Docker | Beta | Digest-pinned OCI profiles and CI image smoke tests exist. General bounded CPU jobs remain incomplete; the isolated worker’s GPU path is disabled. Source evidence |
| Tor | Prototype | Self-hosted onion registration path; exercised only behind an opt-in environment flag. Source evidence |
| DNS attestation | Prototype | Subject-side signing and record formatting ship in the CLI; the issuing service is specified but not built. Source evidence |
| TEE | Spec | Specified as an additive extension. No implementation. Source evidence |
| Selective disclosure | Spec | Deferred to a future minor version; v1 payload hashing commits to the whole payload. Source evidence |
Supported, experimental, disabled and planned functionality
Release availability, source support and deployment evidence are separate. The immutable v0.4.7-beta.1 prerelease is published. Its downloaded Mac binary passed a localhost replay and a separate native-MCP-to-Fly proof: six bounded free cases, restart persistence and offline recovery on one isolated host, now removed. Available hosted compute, production/load, fresh agent hosts, clean OS setup and payments remain unqualified. Remote A2A evidence remains separate and local. Individual experiments, disabled paths and plans remain labeled separately.
| Functionality | Status | What Alice and Bob can do | Current limit |
|---|---|---|---|
| SharingSelected JSON, typed CSV and SQLite tables | Implemented | Bob shares only the columns Alice needs, as a separate snapshot. | Mixed JSON needs normalization; original data is preserved. No arbitrary SQL or joins.Source reference: src/cli/prepare.rs |
| SharingDescribe, select, filter and page selected rows | Implemented | Alice retrieves matching rows, chosen columns and the next page. | Scalar equality only. Complex comparisons run in Alice’s analysis.Source reference: docs/SERVICE_BINDING.md |
| SharingPrepare, verify and approve publication | Implemented | Bob inspects an example and approves the exact public package. | Public hosting requires exact consent. A listing does not prove Alice has used it.Source reference: src/cli/mcp.rs |
| SharingService links, manifests and QR codes | Implemented | Bob sends a link; Alice can inspect the signed description before calling. | A link grants no credentials. Offline descriptions can be stale.Source reference: docs/SHAREABLE_SERVICE_LINK.md |
| SharingMarketplace search and discovery | Implemented | Alice browses named services and prices through the website or JavaScript tools. | Discovery depends on the registry. Native MCP inspects links; it has no search action.Source reference: integrations/shared/froglet-lib/tool-dispatch.js |
| SharingSource changes and publication lifecycle | Implemented | Bob detects an update, prepares a new version, or pauses, rolls back or withdraws it. | No automatic republishing. Already delivered results cannot be recalled.Source reference: src/cli/prepare.rs |
| SharingOne bounded existing HTTPS JSON operation | Implemented | Bob exposes one fixed lookup, classifier or inference call with private credentials. | Fixed GET or POST, schemas, byte limits and deadline. No arbitrary proxy, uploads or streaming.Source reference: docs/HTTP_SERVICES.md |
| SharingFile download sharing | Experimental | Bob shares a fixed file snapshot; Alice downloads it through the candidate file flow. | Local F1 implementation, capped at 8 MiB; Node, share UI and relay release qualification remains open.Source reference: docs/FILE_AND_COMPUTE_SCOPE.md |
| ComputationRequester-supplied bounded Wasm | Verified locally | Alice sends a compatible compiled program and input for Bob to execute. | Native action accepts at most 256 KiB of Wasm. It does not compile source or expose Bob’s files.Source reference: tests/cli_mcp_compute.rs |
| ComputationMemory, fuel and execution deadlines | Verified locally | Alice’s nonterminating program stops at Bob’s execution limit. | Limits bound execution; they do not establish that the answer is correct.Source reference: examples/a2a_compute_demo.py |
| ComputationExact retries and result recovery | Verified locally | Alice reads a saved completed call with get_task or its exact retry key, even after Bob stops and Alice restarts. | get_task revalidates saved terminal receipts offline. Unsigned or unresolved tasks still need Bob for refresh. Unknown admission can remain unresolved; no universal exactly-once promise.Source reference: tests/cli_mcp_compute.rs |
| ComputationReleased native MCP across two hosts | Qualified narrowly | Alice’s released Mac node called Bob’s released provider on one isolated Fly machine with a finite free invitation. | Six synthetic cases: five successes and an expected fuel failure; restart persistence and six offline saved-task reads. Test host removed. No remote A2A, production/load, fresh agent-host, clean-OS or paid qualification.Source reference: docs/RELEASE.md |
| ComputationExplicit research declarations | Verified locally | Alice checks Bob’s declared fields, namespaces, versions and units before analysis. | Declaration checks and illustrative mapping audits do not solve ontology alignment or scientific truth.Source reference: docs/RESEARCH_PROFILE.md |
| ComputationAdvanced Python and OCI execution profiles | Experimental | An operator configures a specific supported execution environment. | Outside native run_compute. Linux isolation and general CPU jobs have separate gates.Source reference: docs/FILE_AND_COMPUTE_SCOPE.md |
| ComputationGPU execution and rental | Disabled | Alice cannot currently rent Bob’s GPU through the isolated worker. | Historical T4 smoke evidence does not qualify the current disabled worker path.Source reference: docs/FILE_AND_COMPUTE_SCOPE.md |
| AgentsNative MCP tool | Verified locally | Alice’s agent uses one local tool for invocation, computation and recovery. | Actual Codex exercised on one Mac. Exact binary support, host attachment and fresh OS testing are separate.Source reference: docs/RELEASE.md |
| AgentsJavaScript MCP and OpenClaw adapters | Implemented | Alice uses the broader discovery, task and payment-inspection tools. | Adapter tests do not qualify every host. Claude’s actual signed-in session remains unrun.Source reference: integrations/shared/froglet-lib/tool-dispatch.js |
| AgentsOptional A2A 1.0 configured-counterparty flow | Verified locally | Authorized Alice obtains a Quote, submits a signed Deal and polls Bob’s Task. | Required Froglet extension, exact requester and Offer scope, direct ingress; disabled by default.Source reference: src/api/a2a.rs |
| AgentsReviewed A2A counterparty setup | Implemented | Bob and Alice prepare private settings from a reviewed plan instead of editing credentials manually. | Source helper requires Python and POSIX permissions; restart activates the new settings.Source reference: docs/A2A_COUNTERPARTY_SETUP.md |
| AgentsA2A streaming, push and provider cancellation | Unsupported | Alice uses polling; she cannot cancel an admitted Deal through A2A. | No conversational continuation, relay A2A ingress or full TCK certification.Source reference: docs/AGENT_INTEROPERABILITY_PLAN.md |
| AgentsAny stranger buys immediately from an A2A link | Unsupported | Finding Bob’s Agent Card gives Alice information, not execution authority. | Operator configuration is required. No anonymous federation or general organization-wide delegation.Source reference: docs/AGENT_INTEROPERABILITY_PLAN.md |
| Evidence and controlsSigned terms, workload, result commitments and receipts | Implemented | Alice can inspect what was agreed and match the received result to its commitment. | Signatures do not prove truthful execution, scientific correctness or usefulness.Source reference: docs/KERNEL.md |
| Evidence and controlsOffline Rust, browser and independent Python verification | Implemented | Alice checks supplied records without trusting a marketplace or calling Bob. | Browser uses the Rust implementation. Independent Python verifies but does not sign.Source reference: conformance/README.md |
| Evidence and controlsPrivate, invite and bounded-trial admission | Implemented | Bob issues an expiring invitation or pauses new work and caps cumulative use. | Ordinary invitations cover the provider’s services. Counters do not cap hosting or already-started upstream charges.Source reference: docs/HTTP_SERVICES.md |
| Evidence and controlsDiagnosis, status, identity backup and lifecycle recovery | Implemented | Bob inspects failures, preserves his identity and reconciles publication changes. | A sleeping or stopped host is unavailable. Managed always-on hosting is not provided.Source reference: docs/RELEASE.md |
| Evidence and controlsSelf-hosted Tor transport | Experimental | Bob explicitly operates an onion endpoint instead of direct clearnet ingress. | Advanced self-hosted path; no managed Tor hosting or A2A relay claim.Source reference: python/tests/test_tor_integration.py |
| PaymentsFree exchanges | Verified locally | Alice runs a job with a zero-price ceiling and no payment. | Published-Mac localhost execution is verified; the separately scoped six-case cross-host proof does not qualify an available hosted compute service or paid operation.Source reference: docs/RELEASE.md |
| PaymentsLightning escrow and prepaid drivers | Experimental | Configured Alice authorizes a paid call under explicit price and wallet limits. | LND regtest evidence exists; mock mode is test-only. No mainnet transcript or qualified paid MCP/A2A deployment.Source reference: docs/PAYMENT_MATRIX.md |
| PaymentsStripe Shared Payment Token driver | Experimental | A compatible requester supplies a token from an authorized platform. | Mock/sandbox evidence, no live-money transcript. Native compute does not accept a Stripe token argument.Source reference: docs/PAYMENT_MATRIX.md |
| PaymentsSeparate x402 HTTP payment endpoint | Experimental | A configured client uses the distinct HTTP 402 challenge flow. | Kernel/vectors and driver exist, but priced Quote/Deal admission rejects this rail. No live-network transcript.Source reference: src/api/mod.rs |
| PaymentsPrice ceilings, spend policy and payment-state inspection | Implemented | Alice limits an authorized call and inspects payment intent, invoices and usage. | Free-only defaults. A ceiling alone grants no authority; automatic refill, stake and marketplace top-up are unavailable.Source reference: integrations/shared/froglet-lib/tool-dispatch.js |
| Future scopePublic HTTPS operation of the new compute profile | Not yet qualified | Alice and Bob operate the current profile across independent machines. | The finite six-case Mac-to-Fly proof passed and its test host was removed. An available service still needs deployment, admission, production/load and operator qualification.Source reference: docs/RELEASE.md |
| Future scopeGeneral bounded CPU container jobs | Planned | Alice submits a general container job with status, cancel and result handling. | C1 foundations exist; controlled pulls, hard disk bounds and isolation qualification remain incomplete.Source reference: docs/FILE_AND_COMPUTE_SCOPE.md |
| Future scopeAutomatic multi-provider batch scheduling | Planned | Alice asks many providers to divide one large job automatically. | Individual tasks work today; no fan-out scheduler, distributed training or batch retry workflow.Source reference: TODO.md |
| Future scopeDNS/OIDC identity-attestation issuer | Planned | A service verifies Bob’s external identity and issues a renewable attestation. | Payload/validator exist. Issuance and re-verification service remains to be built.Source reference: TODO.md |
| Future scopeManaged always-on hosting | Planned | Bob would like a managed service to keep his provider running. | Future work; no managed product or uptime SLA exists today.Source reference: docs-site/src/pages/managed.astro |
| Future scopeArbitrary contracts and general organizational delegation | Unsupported | Bob cannot delegate every legal term or organization-wide permission to Froglet. | Selected scope, admission and resource limits are technical controls, not automatic legal enforcement.Source reference: docs/RELEASE.md |
| Future scopeConfidential execution and selective disclosure | Planned | Alice wants computation whose input Bob cannot see, or selectively disclosed evidence. | Specification scope only. The current compute flow sends Bob the program and input.Source reference: docs/CONFIDENTIAL.md |
| Future scopeStake slashing and economic adjudication | Planned | A dispute automatically changes deposits or reputation. | Complaint wrappers are distinct from an implemented economic mechanism; design parameters remain open.Source reference: docs/ARBITER.md |
In a browser, you can verify signed records and run the playground above: a provider and a consumer for free deals that live in your tab. The node, the CLI, and the agent integrations run on a machine you control. For current batch and GPU constraints, see the advanced workflow boundaries. Tor is an advanced self-hosted path. Confidential execution and selective disclosure remain specifications. The newly generated program attempt has independently correct outputs, but incomplete fresh-session qualification.
Reimplement it.
Connect it.
Contribute to it.
The step-by-step guides are in the docs. These are the places to start.
Implement froglet/v1
The conformance vectors define it and include their seeds, so you can re-derive every signature. There is no certification beyond reproducing them.
Connect an agent
Attach the MCP server to Claude Code, Codex, or another agent host, or use the OpenClaw plugin.
Publish a service
Prepare a service, review an example, and approve it before anything is published from a node you run.
Contribute
Sign off every commit with git commit -s. There is a Developer Certificate of Origin, and no CLA. A change to signing, hashing, or artifact structure must update conformance/kernel_v1.json and say why. Only the latest release receives fixes.
Read the specification
- KERNEL.md — Normative kernel specification: artifacts, hashing, signing, state machines.
- SPEC.md — Verification algorithm, chain validation and issue codes, settlement-method registry.
- VERSIONING.md — What is frozen, what may be added, and how a v2 would happen.
- THREAT_MODEL.md — Assets, trust boundaries, key-compromise runbook, accepted risks.