v1.0.0 — Institutional Seal Release

This release seals the shamir-cli tool as a stable, reference-grade
command-line adapter over the Shamir core and encoding layers.

No functional changes are introduced compared to v0.2.2.
The CLI behavior, flags, input/output semantics, and share formats are
considered stable and contractually defined.

Future changes are expected to be infrequent and deliberate, following
the documented versioning and compatibility guarantees.

v0.2.2 — Documentation Hardening Release

This release introduces formal, normative contracts governing the public
interfaces of shamir-cli.

No functional or behavioral changes are included.

Highlights:

• Added docs/CLI_CONTRACT.md defining the frozen and binding CLI interface
• Added docs/AGENTS_CONTRACT.md defining the explicitly unstable agents subsystem
• Clarified stability boundaries and compatibility guarantees

Compatibility:

• Fully backward-compatible with all v0.2.x releases
• No changes to CLI behavior, cryptographic guarantees, or share formats

Purpose:
This release formally seals the public interface and prevents semantic drift,
implicit behavior changes, or undocumented extensions.

v0.2.1 — Complete CLI, Canonical FORMAT=2, and Contract‑Level Tests

This release finalizes the command‑line interface and supporting
infrastructure while preserving the cryptographic and data contracts
introduced in v0.2.0.

Version v0.2.1 delivers a fully operational, audit‑ready CLI with
explicit split and recover workflows, canonical FORMAT=2 share
serialization, strict error handling, and comprehensive end‑to‑end
integration tests. Architectural boundaries between the CLI,
format layer, utilities, and cryptographic core are now formally
defined and enforced.

No breaking changes are introduced. All existing data and guarantees
remain valid.

v0.2.0 — Authenticated, Deterministic Shamir Release

This release marks the first reference‑grade version of shamir‑cli.

Version v0.2.0 introduces a fully specified, auditable cryptographic core with mandatory authenticated encryption, deterministic behavior, and explicit failure semantics. It establishes a stable security contract intended for long‑term use, external audit, and production deployment.

Highlights
Shamir Secret Sharing over GF(256)
Deterministic, table‑free arithmetic using the AES irreducible polynomial.

Mandatory AEAD Protection
Secrets are encrypted and authenticated with ChaCha20‑Poly1305 before splitting, ensuring confidentiality and integrity.

Canonical Share Format (FORMAT=2)
Strict, versioned, human‑readable share files with no auto‑detection or fallback behavior.

Fail‑Closed Semantics
Any corruption, tampering, or misuse results in explicit failure. No partial recovery is permitted.

Complete Test Coverage
Canonical JSON test vectors and automated tests for GF(256), Shamir split/recover, AEAD success, and authentication failure cases.

Formal Documentation
Includes a cryptographic specification, security model, and explicit non‑goals defining system boundaries and guarantees.

Compatibility
Breaking change: legacy v0.1.x formats are unsupported.

Mixing versions is explicitly forbidden.

Significance
v0.2.0 defines the cryptographic and behavioral contract of shamir‑cli.
All future versions build on this foundation without redefining its core guarantees.

v0.1.0 — Initial Reference Release

Initial reference release of the shamir-cli tool.

This release establishes the first complete and functional command-line
interface for Shamir Secret Sharing, defining the baseline flags,
input/output semantics, and operational behavior.