The clock reads 11:59 and the ball is still on.
The slipper only fitsone foot.
Cinderella is a policy layer for threshold signing on Nostr. Your nsec is split into shares. Before any share signs, it checks who's asking, what they're asking for, and whether it's past midnight.
The ballhow the pieces dance
FROSTR takes one Nostr key and cuts it into three shares. Any two can sign; none can alone. The signature that comes out is an ordinary Schnorr signature — relays and clients never know a whole ballroom was involved.
The stepsisterswhat plain FROSTR can't stop
In plain FROSTR, a share is asked to sign a hash. It can't see what's underneath. A stolen phone plus a compliant server can rewrite your profile, swap your relay list, or delete your history — the shares never knew.
Everyone's foot can be forced into the shoe
if nobody looks at the foot.
Cinderella refuses blind hashes. The full event must come with the request, and each share proves it matches the hash before it looks at the kind. Then the policy decides.
Try the slipperthe real policy, running in your browser
Pick an event kind and see what the shares say. Same rules as cinderella.config.json: unknown kinds are denied, identity kinds queue for 24 hours, deletions for 48.
Midnightthe delay gate
Serious kinds don't sign right away. The first request is queued, and the shares agree on an unlock time. If it was really you, you wait a day and ask again. If it wasn't, a single kind 1 from any hot share turns the whole queue back into a pumpkin.
Every share runs the same rules independently. A compromised node can only vote yes — it still needs the others, and the others are looking at the foot.
Run a sharethree lines
cp .env.example .env # one bfshare, the bfgroup, your relays
npm install
npm run devBuilt on FROSTR and @frostr/bifrost. Alpha — test with a throwaway key first, always.