v0.3.1 — a friendlier way in

Executor File v0.3.1 — a friendlier way in

The point of this release: you no longer need a terminal editor to build or maintain your register. Everything from v0.3.0 stays; this adds a humane editing path and smooths the first-run rough edges the first real dry run exposed.

What's new since v0.3.0

• Browser register editor (web/editor.html, double-click Edit-Executor-File.command or run scripts/edit.sh): fill your register in as a form with dropdowns and plain-English help. No YAML, no terminal editor. It runs entirely in your browser on your own machine: no server, no network, nothing sent anywhere. Holds pointers only.
• Review in the browser: scripts/review.sh now opens that same editor by default for a non-technical owner, keeping its decrypt then same-passphrase re-encrypt then verify then shred flow, so your holders' shares stay valid. Power users who have set $EDITOR keep it; force either with EXECUTOR_FILE_EDIT=browser|terminal.
• Any register opens: the editor's loader now reads folded/literal block scalars, so hand-authored and example-style files load, not only editor-made ones.
• README "Get the tool" section: download, unpack, and open a Terminal in the right folder, written for someone who has never cloned a repo.

What's verified, and what isn't (unchanged honesty)

Machine-verified, green at tag time: 116 scripted tests on macOS and Ubuntu CI under both encryption mechanisms; the browser editor's output was checked against both validator tiers; the new review bridge is covered by a deterministic end-to-end test; and this exact tarball was unpacked clean and exercised (validate, render, seal, edit-server) before release.

Still pending, by design: the two human gates in RELEASE-CHECKLIST.md — a Windows dry run by a non-author and a physical fire drill with real printed shares — remain open. This release, like v0.3.0, ships ahead of them by deliberate owner decision (pre-launch, live testing). The Mac/Linux path is CI-proven; treat the printed Windows sheet as carefully written but not yet field-tested.

Still a terminal step

Sealing a brand-new register (scripts/setup.sh) still needs one Terminal command. Creating and maintaining the register's content are now terminal-free; the one-time encrypt-and-split is the last wall (tracked as EF-ISS-7).

Tool versions tested

age 1.3.1 (batchpass) and age 1.1.x (stock interactive, Ubuntu CI); ssss 0.5.

Checksum

d67e2f90fdfbe84fabb98c901053df6efdd89edcd4dc543666f8a2c8f2fa4bb2  executor-file-v0.3.1.tar.gz

v0.3.0 — the Executor Release

Executor File v0.3.0 — the Executor Release

An encrypted, self-hosted register of every account, asset, and liability you own, with what you want done about each one. No credentials stored, no service dependency: recovery needs only stock age and ssss, forever.

Schema: format 3 (format 2 registers still validate this version, with precise migrate steps — see the header of schema/estate.schema.yaml).

What's verified, and what isn't (honesty first)

Machine-verified, green at tag time: 115 scripted tests on macOS and Ubuntu CI, under both encryption mechanisms (age 1.3.1 age-plugin-batchpass, and expect driving stock interactive age — including distro age 1.1 interop on Ubuntu). Crypto round-trips proven byte-identical; the 2-of-3 share chain proven end-to-end on every setup; rotation proven to kill the old key; validators proven against planted defects.

Not yet human-verified: the two validation gates in RELEASE-CHECKLIST.md — a Windows dry run by a non-author from the printed sheets alone, and a physical fire drill with real printed shares — are still open. This release was published ahead of them by deliberate owner decision (2026-07-18) so the full pipeline can be tested live end-to-end. Findings from those sessions will land in v0.3.1. Until then: the Mac/Linux path is CI-proven; treat the printed Windows sheet as carefully written but not yet field-tested.

Highlights since v0.2

• Share scheme locked at 2-of-3 (a real defect in configurable thresholds was verified and removed; scripts refuse -t/-n loudly).
• Secret-display ceremony: shares shown one at a time with confirm-and-clear; honest close-the-terminal guidance (no false erasure claims).
• Schema v3: settle/preserve actions, first_step, depends_on, beneficiary, billing_cycle, jurisdictions array, contacts + documents sections; last_confirmed required on active entries (unknown allowed). estate.schema.json is the single source of truth with a CI drift test.
• render.sh: the executor triage report (markdown + printable HTML), dependency-aware, preserve-before-dispose.
• make-guide.sh: the two-page printed Executor Instructions, filled from your register.
• test-recovery.sh (fire drill), rotate-shares.sh (proves the old key dead), share-sheets.sh, doctor.sh, verify-copies.sh + .sha256 sidecars.
• review.sh: staleness summary before you edit, honest freshness stamping after, calendar nudges (.ics).
• docs/WINDOWS-RECOVERY.md (WSL end-to-end), docs/discovery-checklist.md, AGENTS.md, SECURITY.md, CONTRIBUTING.md.

Tool versions tested

age 1.3.1 (batchpass) and age 1.1.x (stock interactive, Ubuntu CI); ssss 0.5; shellcheck-clean scripts.

Checksum

9956fb0162960dcb33c3aaf6a1566339b3c845044b834f82e8b05eeed30d255a  executor-file-v0.3.0.tar.gz