Review fixes, Phase D and E, and the eight leftover findings - #210

Merged

404SecNotFound merged 37 commits into

mainfrom

claude/trusting-fermi-rx5kxv

Sep 25, 2026

Commits on Sep 23, 2026

fix: scan recovery-share strips back in, and one unlock path at a time
404SecNotFound
committed
5187564
fix: keep one-time shares and their container from being lost
404SecNotFound
committed
7fac837
fix(scripts): close the shares dialog with its button in the audits
404SecNotFound
committed
c8c61ad
fix: carrier, service worker and recovery-script defects, and doc drift
404SecNotFound
committed
add117c
fix: returning from Tools no longer wipes the form; changelog
404SecNotFound
committed
43582c1
fix: print paper-vault symbols as SVG so multi-part backups scan back
404SecNotFound
committed
a0c37b0
build: resolve script paths with fileURLToPath so a spaced checkout builds
404SecNotFound
committed
bf3608a
ci: refuse to sign a manifest the independent builds did not reproduce
404SecNotFound
committed
0168775
ci: run the reference self-tests on Python 3.10, the RECOVERY.md floor
404SecNotFound
committed
8b81cd7
ci: correct stale workflow comments
404SecNotFound
committed
986cf15
fix: erase the secret copies the v2 unlock path made and dropped
404SecNotFound
committed
2642568
fix: size the container ceiling from the format's worst case
404SecNotFound
committed
8349285
fix: UI correctness pass (lock, scans, notices, filenames, a11y)
404SecNotFound
committed
d319e66
fix(format): one rule for ignorable characters, full set ids, confirmed keys
404SecNotFound
committed
af0f8d9
Merge build-script and CI hardening
404SecNotFound
committed
2043402
Merge secret-erasure hygiene in the crypto core
404SecNotFound
committed
42eed12
docs: changelog for the UI, parity, hygiene and CI work
404SecNotFound
committed
25b93ff
Merge remote-tracking branch 'origin/main' into claude/trusting-fermi-rx5kxv
404SecNotFound
committed
b4755e1
test(recovery): execute RECOVERY.md's commands, fix its v3 drift
404SecNotFound
committed
f0ab8a0
feat(shares): 2-of-3 and 3-of-5 presets beside the custom fields
404SecNotFound
committed
7b180e6
feat(shares): a set code on the owner's sheet and on every strip
404SecNotFound
committed
6d24b44
feat(recovery): check a printout against its backup, opening nothing
404SecNotFound
committed
3a56a18
feat(paper): print version-25 symbols; keym2.py split writes KMPART2
404SecNotFound
committed
e72fa34
feat(scan): read every QR code in one photo
404SecNotFound
committed
22c7cdf
feat(scan): live camera scanning for strips and container symbols
404SecNotFound
committed
161e919
feat(paper): offer strips that carry a small backup, with the cost stated
404SecNotFound
committed
4b1b079
feat(format): §4.8 password-and-shares slot, spec to UI
404SecNotFound
committed
1e4516a
fix(ci): pin the Python 3.10 closure instead of installing with --no-deps
404SecNotFound
committed
c6f0341

Commits on Sep 24, 2026