Froglet

Froglet

The rail-neutral evidence layer for agent transactions.

Whatever rail moves the money, Froglet produces a signed, hash-linked record of what was authorised, under which limits, and what the executing party attested to — verifiable offline by anyone, with no node and no account.

Verify a chain yourself in one command:

cargo run -p froglet-verify -- conformance/kernel_v1.json

Created and maintained by Armanas Povilionis.

Copyright Alithea Biotechnology GmbH, which operates the hosted services.

---

Table of Contents

• Overview
• Product Model
• Components
• Quick Start
• Bot Surfaces
• Verification
• Current Scope
• Documentation

---

Overview

Launch preparation, 2 October 2026: the current scope is free selected-data sharing and bounded Wasm through native MCP, with optional configured A2A. Use the production handoff and explicit remaining gates. Local software checks, local packages and the public documentation website do not qualify a new production compute deployment or an immutable release.

Development checkpoint, 1 October 2026: work has resumed on the free native MCP workflow, optional configured A2A transport, and selected-data sharing with bounded Wasm computation. The final candidate's actual Codex CLI workflow and extracted demo bundle are qualified on the current Apple Silicon Mac. The same production inputs also passed 625 library and nine native MCP tests, plus the terminology workflow, in an isolated Linux arm64 development container. Thirteen library tests were ignored; Python OS isolation and a Linux agent host remain unqualified. Claude Code host qualification is blocked on sign-in. Selected-data/profile examples and bounded local capacity have recorded checks; clean machines, public compute HTTPS/capacity, and first-user value remain separate gates. See current work and the qualification evidence.

The public documentation website was restored on 1 October; seven checked routes returned HTTP 200 and matched the local build bytes. See the deployment record and remaining gates. The last observed hosted compute trial was unavailable; this pass has not requalified that deployment. Production and available hosted compute qualification remain open. The immutable v0.4.7-beta.1 prerelease is now published; its downloaded Apple Silicon binary passed a separate deterministic localhost replay. Distribution and exact released-Mac evidence also record a separate native-MCP Mac-to-Fly proof: six bounded free cases, restart persistence and offline task recovery on one isolated test host, now removed. That proof does not qualify production, load, a fresh agent host, a clean operating system or paid operation. The September pause and rollback record is preserved. File downloads remain experimental; Node/UI/relay qualification is open. General CPU jobs, GPU rental, and new payment work are outside the resumed scope.

The optional research profile makes namespace, version, field types, units, provenance and mapping assumptions explicit. The final local example retrieves a pinned public GO catalog in 100- and 40-row pages with verified receipts; this establishes data exchange and declared metadata compatibility, not scientific correctness or independent user demand.

On one shared machine, eight concurrent tiny workflows using independent requester identities completed without errors in the measured sweep. At 16 and 32, six selected-data jobs hit the four-process limit and returned independently verified failure chains. Shared requester identities still face about one identical requester/workload/terms Quote per second; collisions now fail before Deal admission and leave no pending requester submissions. These measurements do not establish production capacity, performance superiority or developer-time savings. See the exact local qualification.

The current product candidate starts with “Make this catalog usable by another agent.” Codex or Claude Code can prepare selected JSON, typed CSV, or SQLite data, or a small Wasm function; run a local example; ask for exact publication approval; and return a provider/service share link. Native setup preserves existing agent settings. Recipients use the same native integration without npm.

See the publishing workflow and the qualification gates. This is a public prerelease: clean-machine agent tests, the real public relay journey through this profile, and first-time-user acceptance remain qualification gates. The first-user trial kit separates setup usability from evidence of a useful job. Supported targets are Apple Silicon macOS and Linux x86_64/arm64. The host must stay online.

The local captured-program replay now has complete evidence: Alice's retained 81,222-byte Wasm program matched four independently frozen answers, and all seven admitted signed chains were verified offline. The seven include an owner control, selected-data retrieval, four program executions and a separate looping program's budget failure. Exact completed data and compute retries recovered cached results after Bob stopped and Alice restarted. In that historical replay, get_task returned HTTP 502 with Bob stopped. The 3 October correction now revalidates saved terminal task evidence locally; unsigned or unresolved tasks still require Bob for refresh. Current-source local regressions pass; a fresh optimized native candidate also passed independent verification of all seven chains and all six saved Alice terminal task reads after Bob stopped and Alice restarted. Package/release gates and website publication remain separate checks.

This is deterministic replay of a program created in an earlier actual Codex session. That earlier fresh-session qualification remains failed because its complete chains were not captured and persistent Codex configuration changed. The replay starts no LLM, compiler or agent settings operation. See the reusable runbook and local finalization evidence.

Froglet gives one signed economic primitive for three product shapes:

The primary bot-facing integration surfaces are intentionally simple:

• One OpenClaw/NemoClaw plugin id: froglet (at integrations/openclaw/froglet/)
• One MCP server under integrations/mcp/froglet/, published as froglet-mcp for npx froglet-mcp, plus a dependency-minimal native bridge in froglet-node mcp
• Both surfaces register a single agent-facing tool named froglet to the host (Claude Code, Codex, Cursor, Windsurf, etc.). The headline action is two-step marketplace_publish: the first call is a non-mutating plan, and the second must carry the exact approved consent_hash. Both native and JavaScript adapters delegate to the same Rust publication module and provider-control contract.
• The froglet-node binary is both the daemon (running as a provider) and the author CLI (froglet-node init / build / publish / whoami, prepare-service, invoke, doctor, and check-updates). status --open --json returns a short-lived read-only local status URL.

Bots should be able to create small scriptable services directly, validate them locally, and publish them without starting from OCI images. OCI containers remain a supported packaging and deployment path.

---

Product Model

• Any Froglet node can publish resources and invoke remote resources
• Published resources are execution bindings backed by bot-authored projects, explicit source, or prebuilt artifacts
• Easy bot authoring and local checking of scriptable services is a core product requirement
• Identity is first-class in signed artifacts
• Clearnet HTTPS, outbound relay HTTPS, and Tor v3 onion transport are supported registration paths for self-hosted providers. Bootstrap plans the official relay URL and suffix by default but keeps them dormant; publication fails closed until an exact durable grant makes the endpoint ready. Planned configuration is not a claim that its public operator service is deployed.

[!NOTE]

Marketplace, ranking, incentive, and broker policy live above the protocol.

Payment rails are adapter-level surfaces for local or self-hosted operators,

not normal buyer onboarding.

Lightning, Stripe, and x402 are the launch adapters in this repo. Lightning

and x402 have standardized kernel settlement methods with conformance

vectors; Stripe's stripe_mpp.v1 receipt shape is standardized but attested

rather than cryptographic. Only Lightning escrow uses the signed

invoice-bundle flow. x402's wire format is settled

(x402.eip3009.v1, conformance/x402_v1.json)

but its rail is not: no publish-path exposure and no live transcript on any

network. The first-party hosted try.froglet.dev trial was retired on

8 October 2026; the free public beta at https://froglet.dev/services/

replaces it. Hosted paid rails must not be claimed live until Lightning

and Stripe have public payment transcripts, and users should not be asked to

manage LND channels or payment secrets just to try Froglet.

Discovery & Compute model

• Named services and data services are discovered through discovery
• Open-ended compute uses the provider's direct compute offer via run_compute, targeted with provider_id or provider_url
• Publication and bootstrap adapters may include Nostr-style publication without making any single relay or network the kernel source of truth

---

Components

Product-wise, Froglet is one node that can both provide and consume. The reference implementation exposes these binaries:

[!TIP]

Marketplace integration is part of the public Froglet surface. Runtimes can

point at the default public marketplace with FROGLET_MARKETPLACE_URL;

providers can self-register there after exposing a public HTTPS URL,

ident