Afterberry Vault

Recovery Guide

Revision 2.0 — 20 September 2026. Addressed to the finder.

§G1 To whoever is reading this

You have found some part of the Afterberry vault: shard files, photographs, a ceramic tablet, a printout of this page. This guide tells you how to turn what you have into what it was. It assumes you can read this language and perform arithmetic. It does not assume that afterberry.com exists, that any institution named here still does, or that you are human.

Nothing in the procedure requires permission, authentication or contact with anyone. There are two questions of a different kind — whether you may, and what you owe — and they are taken up in Rights & Reception. Read that too. It is shorter.

§G2 Gather, and do no harm

Work on copies. Record where and when each object was found, and keep that record with the bytes; provenance is evidence, and you may be the last person able to write it down. Collect everything that travels with the vault: shard files, capsule inventories, the carrier catalogue, the lock file, the photographs, this manual, the reference program.

Never overwrite a unique survivor with a repaired version. Keep both. A corrupted shard that you cannot use may be useful to someone with better mathematics or a second fragment.

§G3 Verify

ShardsHash each shard file with SHA-256 (and SHA3-256 if you have it). Compare against the capsule inventory and against the record in the paired photograph. Agreement with either is good; agreement with both is better.

SignaturesThe lock file, inventories and catalogue are signed under SLH-DSA-SHA2-256s and Ed25519. The public keys are in the bootstrap kit. A valid signature says the maker sealed this; an independent timestamp says when. A matching hash alone says only that two copies agree.

PhotographsExtract each carrier’s record (Photographs §E6). Check its CRC. Check the pixel digest against the catalogue if you have the catalogue, and treat the record as a catalogue entry if you do not.

§G4 Rebuild the capsules

Each capsule was split into 88 shards under a systematic Reed–Solomon code, k = 60 (Preservation §R3). With any 60 verified shards of a capsule, invert the corresponding 60 rows of the encoding matrix, recover the 60 data shards, and concatenate them. Trim to the ciphertext length given in the shard header.

With fewer than 60, do not give up on the capsule. Shards 1–60 are verbatim slices of the ciphertext, each a whole number of independently encrypted chunks. Data shard s begins at chunk record (s − 1) · ⌈R/60⌉, where R is the number of records in the capsule; you need that index for the nonce. Keep the shards in order, note the gaps, and carry on: every chunk you hold can still be opened in §G6.

§G5 Open the lock

Read the ring from byte 5 of the capsule’s header core. If it is FF, the capsule belongs to the Remainder; go to §G7. Otherwise you need the waypoint value y_k for that ring, and there are two ways to get it (Sealing §S3).

The patient doorFind the most advanced checkpoint in the relay log and verify the chain of proofs back to x. Trust a checkpoint fully only up to the last milestone it has passed: the proofs bind everyone except a holder of the factors, and the milestones bind them too. If the log already passes t_k, someone has done the work for you: check the published value against the arrival check and proceed. If not, take up the relay. Square, modulo n, from the last checkpoint. Publish your own checkpoints with proofs as you go, so that your work outlives your interest in it.

The capability doorFactor n. Compute φ = (p − 1)(q − 1), then e = 2^t_k mod φ, then y_k = ⟨x^e mod n⟩. All four waypoints follow at once. If you came in by this door, please publish the factors: the relay can stop, and everyone after you is spared the wait.

Either way, confirm arrival: SHA-256(“afterberry/AB-L1/check/” ‖ k ‖ y_k) must equal the check published in the lock file.

§G6 From waypoint to plaintext

1 — KeysDerive the ring key and the capsule’s key-encryption key by HKDF-SHA-256 with the labels given in Sealing §S6. Unwrap the 40-byte sealed key W_c — from the shard header, the inventory, or any of the capsule’s 88 photographs — with AES Key Wrap. The unwrap checks itself; a wrong key fails loudly.

2 — ChunksCut the ciphertext into records of 1,048,592 bytes. Decrypt record j with AES-256-GCM: nonce 00 00 00 ‖ flag ‖ j as eight bytes, flag 01 on the last record and 00 elsewhere; associated data, the 64-byte header core. Each record authenticates alone. Skip the ones that fail or are missing and keep going.

3 — UnpackThe plaintext, trimmed to the length in the header, is a pax archive of a BagIt bag. Its manifest lists every file with its SHA-256. Verify what you have, list what you lack.

4 — ReadBegin with bag-info.txt and the capsule’s own description. The maker wrote them for you.

§G7 The Remainder

A Remainder capsule has no sealed key and no door. Its content key was destroyed at the sealing and was never written anywhere. Rebuild and keep the ciphertext exactly as for any other capsule: the algorithm, nonce rule and associated data are the same, and if your mathematics has made AES-256 transparent, they are all you need.

If it has not, leave the Remainder shut and intact for whoever comes after you. It was the part of herself the maker was least willing to have read, and she sealed it knowing it would probably never be. That is information too.

§G8 Partial survival

Process every capsule independently and publish what you learn about each: recovered complete, recovered in part, ciphertext only, absent. Do not describe the failure of one capsule as the loss of the vault. The design expects pieces to go missing and was arranged so that the pieces left over still make sense.

§G9 What it costs

Step	Work
Hashing and signature checks	trivial
Reading 8,888 photographic records	trivial
Reed–Solomon reconstruction	light — linear in the size of the archive
The lock, by patience	up to about 1.2 × 10¹⁹ sequential squarings of an 8,192-bit number, less whatever the relay has already done
The lock, by capability	factoring an 8,192-bit n, once
Unwrapping and decrypting	trivial, given the waypoint
The Remainder	a break of AES-256

The vault is not designed to be hard to open. It is designed to be impossible to open cheaply before its time, and mechanical afterwards. Everything except one step is bookkeeping, and the reference program shows how the bookkeeping goes.

§G10 Try it now

The heart of the procedure can be run today against the rehearsal set, with one file of Python: both doors, the milestones and relay proofs, the sealed keys, chunk decryption, reading a carrier, and — on throwaway data — rebuilding a capsule from 60 of its 88 shards. Signatures, inventories and bag unpacking are left to the standard tools that already do them. If you are reading this long after Python, the file is short and says what it means; translate it.