shard-core v0.3.0

shard-core 0.3.0

Second stable open-source release of shard-core.

Highlights

• Guided custody-route selection for provider-native workflows, externally
  held SHEN artifacts, and multi-holder SHRD distribution.
• Vendor-neutral custody patterns for CoinCover, Station70 Bunker and Custom
  Upload, Nemean, peer-to-peer, tri-party, and deliberately nested designs.
• Read-back verification of written SHRD and SLIP-39 artifacts before the
  guided workflow recommends distribution.
• Stronger hidden-input, non-empty passphrase, exact-byte preservation, and
  Fordefi-specific routing controls.
• Clearer trust boundaries between offline shard-core ceremonies and
  provider-required controlled connected environments.

Compatibility

• SHEN v1 and v2 artifacts remain readable.
• SHRD v1 and v2 artifacts remain readable.
• SHEN v2 and SHRD v2 wire bytes are unchanged.
• Python 3.9 through 3.14 is supported.

Verified source and candidate

• Commit: b26f0883ea6467ef40524ee0277fcf413a812ac2
• Git tree: 0cdb2940fe5d6f352ae9016d040ac03314c38f1f
• Controlled rootless-Podman candidate: PASS
• Two isolated local builds within the approved boundary: identical
• Candidate inventory, archive extraction, offline install, pip check,
  import smoke, and CLI version: PASS
• Synthetic SHRD, Fordefi SHEN, and SLIP-39 recovery smokes: PASS
• CI and CodeQL for the exact release commit: PASS

The two-build result is reproducibility within the approved local input,
runtime, image, and platform boundary. It is not a claim of independent
reproducibility across unrelated builders.

Primary hashes

• Controlled wheel:
  b82e89eab9a84b6e5b5e66ef681fb23ae17e26914eb65c46d60c24938e6e2f22
• Source distribution:
  0b3bf30f2ec222242f750d0924adc1cd31b25caa22491f40f4a26c629b2d59f7
• Offline bundle archive:
  f7790cc70e7c1c9125648ee2f2c2193ee15a8b700a3fd86fa1e1578d958d361e
• Top-level checksum file:
  fb47d5780dfd6db4529b68148a25998d234f3bf1af6968fe9146eab003427c85

Verify every downloaded asset with
shard-core-0.3.0-SHA256SUMS.txt. The offline bundle also contains its own
internal SHA256SUMS and VERIFY.md.

Release assets

• Python wheel and source distribution.
• Linux x86_64 offline bundle.
• Top-level SHA-256 inventory.
• SPDX SBOM.
• Bundle metadata and provenance.
• Sanitized build information and smoke evidence.

PyPI publication uses the repository's separate OIDC Trusted Publisher
workflow. Confirm the published files and attestations on the
shard-core PyPI project.

Security status

shard-core has not received an independent professional security audit.
Passing tests, AI-assisted review, reproducible local builds, and smoke
verification are engineering evidence, not a security audit or a guarantee
against loss. Review SECURITY.md, THREAT_MODEL.md, CEREMONY.md, and the
applicable custody runbook before protecting production material.

shard-core v0.2.0

shard-core 0.2.0

First stable open-source release of shard-core.

Highlights

• Authenticated threshold recovery using ChaCha20-Poly1305 and Shamir sharing
  of a random data-encryption key.
• Resilient recovery across bounded threshold combinations, including safe
  handling of redundant corrupted or unrelated shares.
• Explicit-output, atomic, symlink-refusing secret file operations.
• Fordefi recovery-phrase split/combine and direct SHEN encrypt/decrypt
  workflows without assuming BIP-39.
• Optional SLIP-39 support for material explicitly confirmed as BIP-39.
• Hash-locked, network-disabled, rootless-Podman offline bundle build.
• AI-agent operating guidance in AGENTS.md, with secrets kept outside the
  agent boundary.

Compatibility

• Existing SHRD v1 and v2 artifacts remain readable.
• Existing SHEN v1 and v2 artifacts remain readable.
• No SHRD v1/v2 or SHEN v1/v2 wire-layout change was made for this release.
• Python 3.9 through 3.14 is supported.

Verified source

• Commit: 0d8da202d655f6d53cd97eb833d91b391ed6737e
• Git tree: 438aafc4d3a5f08ff79148d05e4aef4e93ab5a14
• Controlled offline candidate smoke: PASS
• Candidate install, pip check, import smoke, and CLI version: PASS

Install

For a normal source install, use the immutable tag:

git clone --branch v0.2.0 --depth 1 \
  https://github.com/Protocol-Wealth/shard-core.git
cd shard-core
python3 -m pip install .

For an air-gapped install, download the offline bundle archive and the
top-level checksum file, verify the archive hash, extract it, then follow the
included VERIFY.md and run install-offline.sh.

Release assets

• Python wheel and source distribution.
• Linux x86_64 offline bundle with its own internal SHA256SUMS.
• Top-level shard-core-0.2.0-SHA256SUMS.txt.
• Bundle metadata and provenance.
• Sanitized, non-secret Stage 6 smoke evidence.

Security status

This project has not received an independent cryptographic security audit.
Passing tests and a successful offline build smoke test are release evidence,
not a security audit or a guarantee against loss. Review SECURITY.md,
THREAT_MODEL.md, and CEREMONY.md before using real secret material.

PyPI publication is not part of this GitHub release. The repository includes a
separate least-privilege Trusted Publisher workflow for an optional future
PyPI publication.