Tandem Object journey

The Tandem field guide

Understand the object.
Respect the boundary.

Tandem gives two people one Bitcoin-native object to shape together. This guide explains the experience first, then opens the exact public contract for inspection.

Start here

Explore safely before you build.

Tandem mainnet is not active. Do not construct or broadcast a Tandem transaction with real funds based on this repository. You can explore the product model and inspect the finalized public contract today.

No wallet connection is required.

The interactive object journey never requests keys, creates a PSBT, signs, or broadcasts. Return to the object journey to compare CREATE, MARK, ROTATE, CLOSE, and REFUND.

01

Learn the object

Understand shared control, continuous state, and the exact terminal paths.

Begin with the idea
02

Read the safety boundary

Know what cooperation, recovery, and independent verification can and cannot do.

Review safety
03

Inspect exact bytes

Verify the normative artifact, schemas, release record, and golden fixtures.

Open the public contract

The product idea

One jointly controlled object with a continuous history.

Two people create the object together. An active Tandem is represented by an exact native SegWit 2-of-2 output, so both current keys authorize every cooperative move. The pair can add a chapter, rotate one or both keys, or close. A recovery transaction prepared in advance can become usable after its relative lock matures.

What makes it distinct

  • Shared control is structural. Cooperation lives in the Bitcoin output, not an account permission.
  • The history follows exact rules. Independent implementations can derive the same state.
  • Recovery is prepared before progress. Each state-changing parent needs a completed recovery path first.
  • No administrator can rewrite it. No platform key can replace participants or edit object state.

What it is not

Tandem is not a token, marketplace, governance system, yield product, ranking system, identity proof, or promise of investment value. It does not guarantee recovery from every key-management failure or keep external content available.

Object mechanics

Five paths define the shared journey.

Bitcoin controls spendable outputs. Tandem classifies exact confirmed transaction shapes and derives the object's deterministic state.

  1. 01

    Create

    Two confirmed participant inputs produce one active 20,000-sat native SegWit 2-of-2 carrier at sequence zero.

  2. 02

    Add a chapter

    MARK advances the sequence and commits a chapter hash while preserving the active key pair.

  3. 03

    Rotate control

    ROTATE advances the sequence and replaces one or both keys with a successor pair authorized by the current pair.

  4. 04

    Close

    CLOSE ends the carrier cooperatively and pays the pair equally under the exact transaction rules.

  5. 05

    Recover

    REFUND uses a markerless, pre-signed path after the required relative lock. It terminates the carrier without advancing the sequence.

External content remains external.

Chapter and close commitments authenticate exact bytes. They do not guarantee that a URI remains available, encrypted content can be decrypted, or a host keeps operating.

Safety

Shared control changes the risk. It does not remove it.

Keys

Use fresh dedicated keys. Never place seed phrases, private keys, backups, credentials, or personal data in public content or support material.

Recovery

Complete, export, checksum, restore-test, and understand every recovery transaction before its parent is broadcast.

Signing

Reconstruct inputs, outputs, amounts, scripts, fees, sequences, locktime, key order, commitments, and recovery intent before signing.

Verification

State-changing construction and broadcast should fail closed whenever independent indexers disagree at the same block height.

Content

Treat retrieved bytes as untrusted. Enforce size and type limits, use safe rendering, and never execute retrieved content as application code.

Privacy

Bitcoin events are observable. Plan for permanence and correlation before committing personal, legal, location, or relationship data.

Use cases

Strongest when meaning comes from the pair.

Shared creative record

Two collaborators build one sequence of milestone commitments for a body of work.

Partnership archive

Two partners authenticate milestone records over time, with careful encryption and metadata planning.

Rotating stewardship

Current stewards authorize a planned successor pair without turning control into an invisible account edit.

Joint conclusion

Two participants make a cooperative ending part of the object's explicit terminal history.

These are product possibilities, not claims of legal ownership, identity, privacy, content availability, financial value, or mainnet activation.

For builders

Conform to one contract. Verify two independent views.

Build only controlled prototypes until an authorized network deployment is published. Keep mainnet construction and broadcast unavailable.

Before using public artifacts

  1. Hash tandem.md as raw bytes and compare its digest and byte count with the release record.
  2. Verify the golden fixture digest against the vector manifest.
  3. Validate chapter, close, and agreement data against the exact schemas.
  4. Reject unknown fields and preserve numeric counters represented as strings.
  5. Treat schema validity and signer authorization as separate decisions.

Independent agreement

Accept a height only when two independently authorized pipelines agree on protocol ID, height, block hash, event root, object-state root, chained root, and object counters. Validate each pipeline's parser commit, indexer commit, parser binary hash, and indexer binary hash independently against deployment trust policy. Independent implementations are expected to have different provenance values.

Content manifests

Normalize chapter and close manifests with RFC 8785 JCS before hashing. Retrieve only the payload identified by content_sha256, verify its bytes before display, and treat URI availability as separate from on-chain validity.

Public protocol contract

Exact artifacts, stable paths, independent inspection.

The normative bytes and their published checksums are intentionally exposed without a build step. Verify the specification as raw bytes. Do not normalize whitespace or line endings before hashing.

Normative specificationAuthoritative protocol bytes Specification release recordDigest, byte count, and finalization status Chapter schemaStrict public manifest contract Close schemaStrict terminal manifest contract Agreement envelope schemaSigned indexer evidence contract CREATE marker exampleMinimal public marker input Golden fixture corpusAuthoritative valid and invalid fixtures Golden vector manifestSpecification, fixture, and root binding

Go deeper

The protocol dossier restates the specification as numbered rules, works through examples using the published vectors, documents indexer semantics and the independent verifier, and provides an in-browser pair check tool.

Normative specificationNumbered, citable rules Guide and worked examplesReal bytes, decoded Pair check toolRuns in your browser Indexer semanticsConfirmation, reorganization, mempool JSON Schema referenceAll three schemas Test vectorsThe golden corpus Independent verifierWhat it proves Conformance and checklistAn ordered build order Security, limits, changelogHonest boundaries
Verify locally node scripts/verify-public.mjs

Questions

The short answers that matter.

Is Tandem live on mainnet?

No. The protocol is finalized, but activation requires completed verification and safety evidence plus an explicit launch decision.

Who owns a Tandem?

The active carrier requires both current keys for a cooperative spend. Tandem does not define legal ownership or resolve participant disputes.

Can one person change the object alone?

Not through a valid cooperative action. A prepared REFUND follows its own exact relative-lock rules after both signatures were completed in advance.

Does Tandem store files on Bitcoin?

No. Chapter and close actions can commit exact hashes. Content remains presentation data retrieved from declared URIs.

Is Tandem a token or NFT?

No. Tandem defines one jointly controlled object and exact state transitions. It has no issuance, marketplace, royalty, rarity, price, yield, or governance rules.

Does independent indexing remove all trust?

No. It reduces the risk of one parser silently presenting incorrect state. Users still depend on Bitcoin consensus, correct software, secure signing, key management, and honest status presentation.

Public readiness

Mainnet waits for proof, not a date.

Activation remains closed until every required safety and verification outcome is complete and an explicit launch decision is recorded.

Finalized
  • Normative protocol bytes
  • Specification hash and byte contract
  • Public schemas and golden vectors
  • Product explanation and repository boundary
Evidence still required
  • Independent parser and indexer agreement
  • Recovery, signer, reorganization, and fee drills
  • Wallet, web, content, dependency, and infrastructure security review
  • Keyboard, screen-reader, contrast, motion, and zoom validation
  • Explicit activation authority after every gate is green

Private reporting

Protect users before publishing details.

Treat fund-loss risk, signing confusion, unsafe coin selection, incorrect recovery, divergent interpretation, exposed credentials, and private conduct concerns as sensitive. Never place them in a public issue.

Open a private report

Begin the title with Security report: or Conduct report: so maintainers can route it correctly. Include only the minimum safe reproduction or context needed.

Contribute

Make the public experience clearer and safer.

Welcome contributions include accessibility improvements, responsive corrections, clearer explanations, safer examples, public schema documentation, and factual or typographical fixes.

  • Keep claims accurate about Bitcoin, custody, recovery, privacy, availability, and network status.
  • Never submit secrets, private transaction data, internal plans, operational procedures, or sensitive implementation detail.
  • Do not edit protocol bytes, schemas, release metadata, or golden vectors as part of a product copy change.
  • Run node scripts/verify-public.mjs and review visual changes across keyboard, motion, zoom, narrow, and wide conditions.

Repository boundary

Public by intent, never by accident.

Belongs here

  • The public product experience and rendered user guidance
  • Deliberate protocol artifacts, schemas, and golden vectors
  • Public governance, contribution, and security reporting material
  • Minimal scripts and CI that serve or verify only this public tree

Stays private

  • Implementations, indexers, databases, workers, and administrative code
  • Infrastructure, deployments, operations, evidence, logs, and recovery archives
  • Internal plans, architecture decisions, experiments, and incident procedures
  • Credentials, keys, wallet backups, access details, and private transaction data