What it protects,
and what it cannot.

1. What Tandem protects

These properties come from the rules themselves, not from anyone's good behaviour. Each one is enforced either by Bitcoin script or by the deterministic parser, and each names the rule that provides it.

2. Risks that pairing adds

This is the section most protocol documentation leaves out. Requiring two signatures solves one problem by creating another: now two things can go wrong instead of one.

Key loss is doubled

Two keys means two chances to lose one. A 2-of-2 has no redundancy: losing either key has the same effect as losing both. If a prepared REFUND exists and its relative lock has matured, the funds can still be recovered. If it does not, they cannot.

The recovery clock keeps restarting

The REFUND relative delay of 52,560 blocks is measured from the confirmation height of the exact carrier being spent. Every confirmed MARK or ROTATE creates a new carrier and restarts the delay. An active pair that adds chapters regularly is continually pushing their own recovery path further into the future. A pair that intends to rely on recovery should understand that using the object delays it.

A recovery path must be prepared before, not after

A REFUND spends a specific carrier and needs both signatures. Once cooperation has broken down, it is too late to obtain the second signature. The rule is therefore operational rather than protocol-level, and it is absolute: complete, export, checksum, and restore-test the recovery transaction for a carrier before broadcasting the parent that creates it.

An invalid spend is fatal, not merely rejected

If a confirmed transaction consumes an active carrier but does not match an operation template, the object terminates as EXITED_NONCANONICAL. It does not fail harmlessly. A wallet bug, an accidental coin selection that grabs a 20,000-satoshi carrier as ordinary change, or a malformed marker all end the object permanently. Rule ST-2 is not a punishment, it is an acknowledgement that the output is gone.

3. Threat notes

Blind signing defeats the whole design

Every protection on this page assumes both participants know what they signed. A signing flow that shows an opaque hash converts a 2-of-2 into a single point of failure operated by whoever composed the transaction. Reconstruct and display inputs, outputs, amounts, scripts, fees, sequences, locktime, key order, and commitments before asking for a signature, and do it for the recovery transaction too.

A single parser is a trusted third party

Bitcoin consensus does not enforce Tandem rules, so the answer to what state an object is in comes from a parser. A user reading one indexer's answer is trusting that indexer. The mitigation is the two-pipeline agreement described on the verifier page, and it only helps if products actually fail closed on disagreement rather than falling back to one pipeline.

Content is a separate trust domain

A commitment authenticates exact bytes. It says nothing about whether those bytes are available, whether they are safe to render, or whether the person who committed them was honest about what they are. Manifests arrive from whoever put a commitment on chain, which is to say from anyone. Enforce your own size and type limits, verify bytes against content_sha256 before display, and never execute retrieved content.

Everything is public and permanent

Bitcoin events are observable by anyone, forever. A Tandem object publishes that two specific keys are jointly controlling something, at specific times, with a specific cadence of activity. Even with encrypted content, the existence, timing, and pattern of a relationship is on a public ledger. Plan for correlation before committing anything personal, legal, locational, or relational.

Coercion and disputes are outside the protocol

Tandem enforces that two keys signed. It cannot tell whether a person signed freely, and it defines no ownership, no identity, and no dispute resolution. A signature obtained under pressure is indistinguishable from one given willingly.

4. Limitations

Stated as facts, not as future work.

• Mainnet is not active. The protocol is finalized; activation remains closed until independent verification, recovery, security, signer, and operational outcomes are complete and an explicit decision is recorded. No repository, website, or funded address constitutes activation.
• Exactly two participants. Not three, not a threshold, not a quorum. The carrier is a 2-of-2 and the payload has room for exactly one pair.
• No partial or conditional operations. There is no escrow, no timelock other than the fixed refund delay, and no conditional transfer.
• No transfer of an object. ROTATE replaces keys with the current pair's authorization; it is not a unilateral sale or handover, and there is no transfer primitive.
• No marketplace. The Bitcoin Universe capability snapshot lists 38 protocols, 29 with marketplace entries. Tandem has no entry in that snapshot, so no Universe product implements a buy, sell, list, or transfer path for it.
• Fixed constants. Carrier value 20,000 satoshis, refund delay 52,560 blocks, founding window 4,320 blocks, INIT lead 1,008 blocks. None are configurable; changing one is a different protocol.
• The protocol is immutable. There is no version negotiation and no extension mechanism. Unknown formats, opcodes, kinds, reasons, flags, reserved values, and oversized payloads are invalid, permanently.
• The specification prose contains one known error. See erratum 1. It cannot be corrected in place without changing the digest and therefore the protocol identity.
• No conformance authority exists. No certification, no test service, no registry.
• The published corpus is partial. It contains no raw transactions, no signatures, no block data, and no reorganization scenarios.
• Neither implementation is a released product. Both public implementations describe themselves as source with unit coverage, not deployed infrastructure, and both disclaim live chain, database, and signing evidence.
• Continuous two-pipeline agreement has not been published. The agreement design is real and runnable against the fixed corpus. Sustained agreement over a live chain is recorded as not yet performed.
• Content availability is not provided. Tandem stores no files and guarantees no URI keeps resolving.
• No recovery from key loss beyond a prepared REFUND. There is no social recovery, no backup signer, and no administrator path.

5. What Tandem is not

Nothing in Tandem defines supply, price, rarity, royalties, or transferability. If a product presents a Tandem object as any of those, the presentation is the product's claim and not the protocol's.

6. Reporting a problem

Treat fund-loss risk, signing confusion, unsafe coin selection, incorrect recovery, divergent interpretation between implementations, and exposed credentials as sensitive. Report them privately through GitHub private vulnerability reporting rather than in a public issue, and begin the title with Security report: so maintainers can route it. See SECURITY.md for the full policy.

A specification ambiguity that two reasonable implementations could resolve differently is a security issue for a deterministic protocol, not a documentation nit. Please report it as one.

7. Changelog

This records changes to the public artifacts and to this documentation. The protocol bytes themselves are frozen: any change to tandem.md would change its digest and therefore create a different protocol, so there will never be a version 2 of it under this identity.

Frozen artifact digests

These have not changed since the release promotion and are pinned in three independent places: this repository's verifier, the vector manifest, and the independent Rust verifier's input lock.

Run node scripts/verify-public.mjs from the repository root to check all of them, along with the specification byte contract and the manifest-to-fixture binding.