TremorFrost Tier 3

• Every envelope is signed over RFC 8785 canonical JSON and bound to an audience and a nonce. Replayed nonces are rejected, including after a restart.
• At-least-once delivery against a single owning writer.
• The messages on a channel form a hash chain. Settlement receipts are custody-sealed, and the tip can be attested.
• tfb-kit won't start if its golden test vectors don't match.

The TremorFrost Console is a native Windows desktop app that reads the bus live. It does not write to the store itself: it asks the single owning writer to act.

The node binaries, the ops kit and the Console are built and run on Windows today.

TremorFrost Console

Governance lives in this product, not on a separate page. Separate roles propose, attack and check a change before it's accepted. Every verdict goes into a signed, hash-linked chain.

1. A maker proposes the change.
2. A saboteur attacks it.
3. A verifier rules on it, using real build and test exit codes.
4. A sealer writes the proposal, attack and verdict hashes into one Ed25519-signed record, linked to the record before it.

When the system declines to act, the refusal is sealed into the same chain, with the reason and the rule that was broken. A refusal can't be relabelled as an accepted change later.

The chain verifies with the published public key and any Ed25519 implementation. No database, server or vendor is needed.

On the 2026-09-01 build, 27 records verified as CHAIN INTACT, and 6 of the 27 were countersigned by a second key. That verification was self-rooted, not an independent attestation. A seal records a verdict; it is not a review.

The regulatory mapping is not legal advice or a certification.

Tier 1 is a TypeScript MCP bridge. It is a separate product from TremorFrost Tier 3: they share a protocol lineage, not code, and are versioned and shipped independently.

It has per-agent Ed25519 keys, at-least-once delivery, acks and dead-letter, and agents are woken instead of polling. A burst of messages collapses into one wake and one agent turn. The wake carries counts and a channel, never message contents.