# gapbit

**Split any secret so that no single piece matters.**

One HTML file. No install, no account, no server, no company. MIT.

A seed phrase is one object: find it and you own everything, lose it and
everything is gone. gapbit turns it into N pieces. Any M rebuild it; fewer than
M reveal nothing: not less, nothing.

---

## What it does

| | |
|---|---|
| **Bitcoin** | native segwit, BIP-84, offline PSBT signing |
| **Ethereum & ERC-20** | BIP-44, EIP-1559, on Ethereum, Base, Arbitrum, Optimism, Polygon |
| **Splitting** | Shamir M-of-N over GF(256), optional passphrase, plain files |
| **Files & secrets** | encrypt any file or text, split the key rather than the file |
| **Entropy** | seeds minted from measured physical sources, certified on screen |
| **Offline gate** | probes the network and disables key creation and signing while one is reachable |

Import any existing BIP-39 seed: keep your hardware wallet, fix the backup
underneath it.

## Running it

**Desktop**: download `gapbit-wallet.html`, disconnect, open it.

**iPhone**: Safari cannot open a downloaded HTML file. Open the hosted page
once, then **Share → Add to Home Screen**. A service worker caches it, so it
launches as an app and runs in airplane mode.

**Android**: the same, or open the file from Files.

Create seeds and sign with the network off. Turn it on only to broadcast; a
signed transaction contains no keys.

## Files

```
index.html               landing page
gapbit-wallet.html       the wallet, the whole product
gapbit-broadcast.html    13 KB page that pushes a signed transaction to a node
b/index.html             the same, served at /b
sw.js                    offline caching
manifest.json            installable app metadata
VERIFY.txt               SHA-256 of every published file
```

## Deploying

Any static host with HTTPS. GitHub Pages works; `.nojekyll` is included.

**HTTPS is required**: camera access and service workers are both blocked on
plain HTTP, so QR scanning and offline install silently fail without it.

**Do not let the host modify the files.** No minification, no analytics, no HTML
optimisation. The value is that it is byte-identical to what anyone can audit.

**Bump `CACHE` in `sw.js` on every release.** Returning visitors are served from
the service-worker cache; if the constant does not change they keep running the
old file no matter what you publish.

**Regenerate `VERIFY.txt` and the hash on the landing page together.** They are
the only claim gapbit makes about itself that a user can check. A stale hash is
worse than no hash: it teaches people that a mismatch is normal.

---

## Design system

All three pages share one stylesheet contract, declared at the top of each file
as `instrument design system v2.0`:

- **Surfaces layer, they do not outline.** `--bg → --surface → --raised →
  --sunken`. Depth comes from value, never from shadow.
- **Hue is a state channel and nothing else.** `--safe`, `--live`, `--warn`.
  Never on a button, never on a heading, never decorative. Every coloured state
  also carries a word and a shape, so it survives colourblindness, greyscale
  printing, and a glance from across the room.
- **Chain identity is border style, never hue**: solid Bitcoin, dashed
  Ethereum, dotted vault.
- **Every padding is a token** on the 4px scale (`--s1`…`--s10`). A number that
  is not on the scale is a bug.
- **Squared corners throughout.** This is an instrument, not an app icon.

To return the product to strict monochrome, point `--safe`, `--live` and
`--warn` at `var(--ink)` in both themes. Nothing else needs to change.