ms-cli-v0.14.1

Full Changelog: ms-cli-v0.14.0...ms-cli-v0.14.1

ms-cli-v0.14.0

Full Changelog: ms-cli-v0.13.2...ms-cli-v0.14.0

ms-cli-v0.13.2

Full Changelog: ms-cli-v0.13.1...ms-cli-v0.13.2

ms-cli-v0.13.1

Full Changelog: ms-cli-v0.13.0...ms-cli-v0.13.1

ms-cli-v0.13.0

Full Changelog: ms-cli-v0.4.1...ms-cli-v0.13.0

ms-cli v0.4.1 — argv-hardening (PR_SET_DUMPABLE)

SemVer-PATCH — process argv-hardening. ms now calls prctl(PR_SET_DUMPABLE, 0) at the top of main() (Linux; no-op elsewhere), denying other-UID /proc/$PID/cmdline reads + core dumps. New process_hardening module. Part of the m-format argv-hardening rollout (toolkit v0.34.7 + md-cli v0.6.1 + mk-cli v0.4.2).

ms-codec v0.2.0 — bch module + decode_with_correction

Tranche B Phase B.3 + B.4 of the v0.22.x follow-ups cycle. Vendors BCH primitives + full-decode-semantic decode_with_correction for ms1 single-chunk inputs.

What's new

• bch module (NEW) — vendored from md-codec's structure, all-public surface, parameterized on `MS_REGULAR_CONST = 0x962958058f2c192a` (byte-exact with toolkit's pre-existing vendored constant).
• bch_decode module (NEW) — ~480 LOC mirror of md-codec's BM+Chien+Forney port. Parity-smoke verified GREEN against mnemonic-toolkit-v0.22.1's vendored decoder.
• decode_with_correction(s: &str) -> Result<(Tag, Payload, Vec<CorrectionDetail>), Error> — full-decode semantics (Q1 lock): BCH-corrects then runs the existing decoder.
• New Error::TooManyErrors { bound: u8 } variant (no chunk_index; ms1 is single-chunk).

Closes FOLLOWUPs

• ms-codec-decode-with-correction-public-api (toolkit + this repo)

12-word ms1 anchor constraint

ms-codec's BCH model targets the 12-word abandon vector. Non-12-word ms1 variants (15/18/21/24-word) hit pre-existing toolkit limitations (their polymod ≠ MS_REGULAR_CONST) — documented in bch_decode.rs module doc.

Lockstep

• mnemonic-toolkit v0.23.0 — toolkit consumes this via repair_via_ms_codec.
• md-codec v0.34.0 — sibling codec; same architectural pattern.
• ms-cli v0.4.0 — sibling CLI ships ms repair subcommand.

🤖 Released as part of the v0.22.x follow-ups cycle (Tranche B close).

ms-cli v0.4.0 — ms repair subcommand + D25 cascade

Tranche B Phase B.5 of the v0.22.x follow-ups cycle. Sibling-CLI repair surface mirroring toolkit's `mnemonic repair --ms1`.

What's new

• `ms repair ` — single-chunk repair via ms-codec v0.2.0's `decode_with_correction`. Stdin via `-` token. D9 secret-on-stdout warning preserved (matches toolkit's stderr byte-exact).
• Exit codes per D26: `0` (clean) / `5` (REPAIR_APPLIED) / `2` (unrepairable).
• `--json` envelope byte-matches toolkit's `RepairJson` schema per D27 (`schema_version="1"`, `kind="ms1"`, `chunk_index` always 0 — single-chunk).
• D25 handler-signature cascade — 6 existing handlers refactored to `Result` for exit-5 propagation (mirror mk-cli A.1' precedent).

Closes FOLLOWUPs

• `ms-cli-repair-flag` (toolkit + this repo)

Lockstep

• mnemonic-toolkit v0.23.0 — toolkit's `mnemonic repair --ms1` shares the JSON envelope schema.
• md-cli v0.6.0 — sibling `md repair`.
• mk-cli v0.4.0 — sibling `mk repair` (released earlier in cycle).

🤖 Released as part of the v0.22.x follow-ups cycle (Tranche B close).

ms-codec v0.1.0 — initial release (entr-only)

Initial release. Reference implementation of the ms1 backup format (HRP ms) for BIP-39 entropy. Sibling to md1 (wallet descriptors) and mk1 (xpubs). Designed for steel-plate engraving with strong BCH error correction.

What's new

• Wire format: BIP-93 codex32 used directly via Andrew Poelstra's rust-codex32 = "=0.1.0" (CC0). No fork.
• v0.1 payload kind: entr (BIP-39 entropy, 16/20/24/28/32 B = BIP-39 word counts {12, 15, 18, 21, 24}).
• v0.1 emitted strings: 50/56/62/69/75 chars (short codex32 checksum only).
• Public API: encode(Tag, &Payload) -> Result<String>, decode(&str) -> Result<(Tag, Payload)>, inspect(&str) -> Result<InspectReport>.
• Tag::ENTR const; Payload::Entr(Vec<u8>); InspectReport for debugging.
• Decoder applies the full SPEC §4 validity rule set (10 rules); encoder mirrors the reserved-not-emitted-tag rejection (SPEC §3.5.1).
• v0.2 K-of-N share-encoding migration designed up-front via the 0x00 reserved-prefix byte; v0.1 strings remain forward-readable by v0.2 decoders. See MIGRATION.md.
• Payload, PayloadKind, Error, InspectReport are #[non_exhaustive] from day 1.

Scope notes

• In: BIP-39 entropy. Tag: entr.
• Out (deferred to v0.2+): Direct BIP-32 master seed (64 B) and serialized xpriv (78 B). They overflow BIP-93 codex32's length brackets when prepended with the v0.2-migration prefix byte. The master-seed backup use case is preserved at the application layer via BIP-39 phrase → entropy → ms1 entr → engrave → recover entropy → BIP-39 mnemonic → PBKDF2 → master seed. See design/SPEC_ms_v0_1.md §1.3 for full discussion of the design tradeoff.

Engraving caveat: BIP-39 wordlist language

ms1 v0.1 does not carry the BIP-39 wordlist language on the wire. Users with non-English wallets MUST record their wordlist language alongside the engraved card. A future v0.2+ payload kind mnem (reserved tag) is allocated to address this on the wire. See SPEC §6.3.

Tests

50 tests across all targets: 28 unit + 1 doc-test + 10 negative + 5 round-trip proptests + 2 forward-compat + 3 BIP-39 integration + 1 vector-corpus replay. cargo build, cargo clippy --all-targets -D warnings, cargo fmt --check all clean.

Wire-format SHA pin

The canonical test vectors at crates/ms-codec/tests/vectors/v0.1.json are SHA-256-pinned at this release. Subsequent corpus changes that alter the SHA require a SemVer minor bump.

sha256(crates/ms-codec/tests/vectors/v0.1.json) = f8d671f543101a4b90fd028126aef66958ff4050e38a32baa48ff298cdf2901a

Documentation

• design/SPEC_ms_v0_1.md — wire format, decoder rules, BIP-93 anchoring.
• design/BRAINSTORM_ms_v0_1.md — the rationale chain.
• MIGRATION.md — v0.1 → v0.2 contract.

ms-cli v0.1.0 — companion CLI for ms-codec

Companion CLI to ms-codec v0.1.0. Encode BIP-39 entropy as ms1 strings for steel-plate engraving; decode/inspect/verify engraved strings; dump the SHA-pinned test-vector corpus.

Install

cargo install ms-cli

The installed binary is ms.

What's new

• 5 subcommands: encode / decode / inspect / verify / vectors.
• Phrase-first encode (--phrase headline; --hex codec-thin escape hatch); structured --json output mode across every command.
• Strip-whitespace stdin uniform across commands — handles pipe round-trip (ms encode | ms verify -), engraver-typed-back chunked form (printf "ms10e ntrsq…" | ms decode -), and copy-paste artifacts with one mechanism. Doubling-detection guard (SPEC §3.2 r7) handles the multi-line encode stdout cleanly.
• BIP-39 wordlist enforcement: all 10 wordlists supported via --language (default english); non-suppressible stderr warning surfaces the SPEC §6.3 wordlist hazard at decode time.
• Exit codes per SPEC §6: 0 (success) / 1 (user-input error) / 2 (format violation) / 3 (valid future v0.2+ format) / 4 (verify round-trip mismatch — distinct so scripts can detect engraving/transcription bugs) / 64 (clap usage error — overrides clap's default of 2 to keep ms1 format violations distinct).
• Engraving-friendly stdout: encode emits <ms1>\n\n<chunked-form> (5-char groups, 10/line max, never mid-chunk) for hand-engraving proofreading.
• verify --phrase round-trip check: the engraver's end-to-end integrity check. Phrases never echoed to stdout/stderr (secrets discipline).

Engraving caveat

ms1 v0.1 does NOT carry the BIP-39 wordlist language on the wire. Users with non-English wallets MUST record their wordlist language alongside the engraved card. A future v0.2+ payload kind mnem (reserved tag) is allocated to address this. See SPEC §6.3 for full discussion of the hazard.

Quickstart

# Encode a 12-word BIP-39 mnemonic.
ms encode --phrase "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about"

# Recover from an engraved string.
ms decode ms10entrsqqqqqqqqqqqqqqqqqqqqqqqqqqqqcj9sxraq34v7f

# Verify an engraved string round-trips against the original phrase.
ms verify <ms1> --phrase "abandon abandon ... about"

# Inspect a candidate string for structural validity (verdict + fields + failure reasons).
ms inspect <ms1>

# Dump the SHA-pinned test-vector corpus.
ms vectors --pretty

Tests

77 tests across the surface: 29 unit + 48 integration (assert_cmd). cargo build / cargo clippy --all-targets -D warnings / cargo fmt --check all clean. Per-phase opus reviewer-loops persisted to design/agent-reports/.

Documentation

• design/SPEC_ms_cli_v0_1.md — full CLI surface specification.
• design/IMPLEMENTATION_PLAN_ms_cli_v0_1.md — phase-by-phase build plan (reviewer-converged at r3).
• crates/ms-cli/README.md — crate-level quickstart.

Family

ms-cli is one of three sibling format crates plus a future toolkit:

• md-codec (repo) — wallet descriptors / templates (md1, HRP md).
• mk-codec (repo) — xpubs (mk1, HRP mk).
• ms-codec (release) — BIP-39 entropy library (ms1, HRP ms).
• ms-cli (this release) — companion CLI for ms-codec.
• mnemonic-toolkit (planned) — top-level integration: take a BIP-39 phrase, emit a complete ms1 + mk1 + md1 engravable bundle.